31 Days to a More Effective Compliance Program http://compliancepodcastnetwork.net en Tom Fox is the Compliance Evangelist and is universally recognized as one of the top experts in corruption compliance, literally across the globe. In this daily podcast series, he explains how to design, create and implement a best practices compliance program. Each month, he tackles a different area of compliance. From Internal Controls, to the Role of the Board of Directors, to Communication, to the Role of HR in Compliance, Investigations, 3rd Parties and Business Ventures. Listen in each day and get one tip you can implement at little or no cost to enhance your compliance program. https://megaphone.imgix.net/podcasts/c3e370ea-2e65-11ea-aa0c-2f5355995294/image/cf85e432ef4d467200de11e5e3a4516d.png?ixlib=rails-4.3.1&max-w=3000&max-h=3000&fit=crop&auto=format,compress 31 Days to a More Effective Compliance Program http://compliancepodcastnetwork.net no episodic The Design, Creation and Implementation of a Best Practices Compliance Program Thomas Fox Tom Fox is the Compliance Evangelist and is universally recognized as one of the top experts in corruption compliance, literally across the globe. In this daily podcast series, he explains how to design, create and implement a best practices compliance program. Each month, he tackles a different area of compliance. From Internal Controls, to the Role of the Board of Directors, to Communication, to the Role of HR in Compliance, Investigations, 3rd Parties and Business Ventures. Listen in each day and get one tip you can implement at little or no cost to enhance your compliance program. Tom Fox is the Compliance Evangelist and is universally recognized as one of the top experts in corruption compliance, literally across the globe. In this daily podcast series, he explains how to design, create and implement a best practices compliance program. Each month, he tackles a different area of compliance. From Internal Controls, to the Role of the Board of Directors, to Communication, to the Role of HR in Compliance, Investigations, 3rd Parties and Business Ventures. Listen in each day and get one tip you can implement at little or no cost to enhance your compliance program.

]]> Thomas Fox tfox@tfoxlaw.com Day 31 - Leveraging Root Cause Analysis for Effective Compliance Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 31 episode, and our final day in this 2026 update to 31 Days to a More Effective Compliance Program, we end with a review of root cause analysis. Key highlights: Integrating Root Cause Analysis into Solutions Regulatory Expectations and Internal Controls Performing Effective Root Cause Analysis Developing and Implementing Solutions Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 31 Jan 2026 05:00:00 -0000 full 7 31 Thomas Fox We conclude the 2026 edition of 31 Days to a More Effective Compliance Program with a review of root cause analysis. Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 31 episode, and our final day in this 2026 update to 31 Days to a More Effective Compliance Program, we end with a review of root cause analysis. Key highlights: Integrating Root Cause Analysis into Solutions Regulatory Expectations and Internal Controls Performing Effective Root Cause Analysis Developing and Implementing Solutions Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 31 episode, and our final day in this 2026 update to 31 Days to a More Effective Compliance Program, we end with a review of root cause analysis.

Key highlights:

  • Integrating Root Cause Analysis into Solutions
  • Regulatory Expectations and Internal Controls
  • Performing Effective Root Cause Analysis
  • Developing and Implementing Solutions

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 458 no Day 30 - The Foreign Extortion Prevention Act Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 30 episode, we discuss the Foreign Extortion Prevention Act (FEPA), a significant piece of legislation that fills a critical gap in the FCPA. Key highlights: Filling the Gap in Anti-Corruption Laws Key Features and Implications of FEPA Challenges in Implementing FEPA The Name and Shame List Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 30 Jan 2026 05:00:00 -0000 full 7 30 Thomas Fox What is FEPA? Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 30 episode, we discuss the Foreign Extortion Prevention Act (FEPA), a significant piece of legislation that fills a critical gap in the FCPA. Key highlights: Filling the Gap in Anti-Corruption Laws Key Features and Implications of FEPA Challenges in Implementing FEPA The Name and Shame List Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 30 episode, we discuss the Foreign Extortion Prevention Act (FEPA), a significant piece of legislation that fills a critical gap in the FCPA.

Key highlights:

  • Filling the Gap in Anti-Corruption Laws
  • Key Features and Implications of FEPA
  • Challenges in Implementing FEPA
  • The Name and Shame List

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 477 no Day 29 - Enhancing Compliance through Automation Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 29 episode, we explore how Chief Compliance Officers and compliance professionals can enhance their programs through automation. Key highlights: Challenges in Traditional Compliance Reporting The Role of Reg Ops in Compliance Integrating Tools for Real-Time Compliance Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 29 Jan 2026 05:00:00 -0000 full Thomas Fox How to use automation in compliance. Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 29 episode, we explore how Chief Compliance Officers and compliance professionals can enhance their programs through automation. Key highlights: Challenges in Traditional Compliance Reporting The Role of Reg Ops in Compliance Integrating Tools for Real-Time Compliance Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 29 episode, we explore how Chief Compliance Officers and compliance professionals can enhance their programs through automation.

Key highlights:

  • Challenges in Traditional Compliance Reporting
  • The Role of Reg Ops in Compliance
  • Integrating Tools for Real-Time Compliance

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 406 no Day 28 - The Importance of Data Governance Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 28 episode, we look into the crucial importance of data governance in the realms of compliance and cybersecurity. Key highlights: The Role of Data Governance in Compliance and Cybersecurity Data Governance and ESG Understanding Data Privacy Laws Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 28 Jan 2026 05:00:00 -0000 full 7 28 Thomas Fox The role of data governance. Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 28 episode, we look into the crucial importance of data governance in the realms of compliance and cybersecurity. Key highlights: The Role of Data Governance in Compliance and Cybersecurity Data Governance and ESG Understanding Data Privacy Laws Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 28 episode, we look into the crucial importance of data governance in the realms of compliance and cybersecurity.

Key highlights:

  • The Role of Data Governance in Compliance and Cybersecurity
  • Data Governance and ESG
  • Understanding Data Privacy Laws

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 400 no Day 27 - The Compliance Function in an Organization Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 27 episode, we explore the growing importance and responsibilities of the compliance function within corporations, emphasizing the need for adequate staffing, resources, and independence. Key highlights: DOJ’s Expectations for Compliance Programs Funding and Resources for Compliance Compliance Program Structure and Authority Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 27 Jan 2026 05:00:00 -0000 full 7 27 Thomas Fox The role of a corporate compliance function. Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 27 episode, we explore the growing importance and responsibilities of the compliance function within corporations, emphasizing the need for adequate staffing, resources, and independence. Key highlights: DOJ’s Expectations for Compliance Programs Funding and Resources for Compliance Compliance Program Structure and Authority Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 27 episode, we explore the growing importance and responsibilities of the compliance function within corporations, emphasizing the need for adequate staffing, resources, and independence.

Key highlights:

  • DOJ’s Expectations for Compliance Programs
  • Funding and Resources for Compliance
  • Compliance Program Structure and Authority

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 456 no Day 26 - Elevating the Role and Independence of the Chief Compliance Officer Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 26 episode, we ponder the evolving stature and authority of the CCO within organizations, as highlighted by recent guidelines and regulations. Key highlights: Key Inquiries Around the CCO and Compliance Function Importance of CCO Certification and Court Decisions Critical Takeaways for Compliance Professionals Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 26 Jan 2026 05:00:00 -0000 full 7 26 Thomas Fox What is the role of the CCO in an organization? Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 26 episode, we ponder the evolving stature and authority of the CCO within organizations, as highlighted by recent guidelines and regulations. Key highlights: Key Inquiries Around the CCO and Compliance Function Importance of CCO Certification and Court Decisions Critical Takeaways for Compliance Professionals Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 26 episode, we ponder the evolving stature and authority of the CCO within organizations, as highlighted by recent guidelines and regulations.

Key highlights:

  • Key Inquiries Around the CCO and Compliance Function
  • Importance of CCO Certification and Court Decisions
  • Critical Takeaways for Compliance Professionals

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 461 no Day 25 - Investigative Findings Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 25 episode, we consider the critical importance of addressing investigative findings within a corporate compliance framework. Key highlights: The Impact of Investigations on Compliance Communicating Costs and Risks Ensuring Effective Communication Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 25 Jan 2026 05:00:00 -0000 full 7 25 Thomas Fox How to respond to investigative findings? Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 25 episode, we consider the critical importance of addressing investigative findings within a corporate compliance framework. Key highlights: The Impact of Investigations on Compliance Communicating Costs and Risks Ensuring Effective Communication Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 25 episode, we consider the critical importance of addressing investigative findings within a corporate compliance framework.

Key highlights:

  • The Impact of Investigations on Compliance
  • Communicating Costs and Risks
  • Ensuring Effective Communication

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 479 Day 24 - Internal Reporting and Triage Welcome to 31 Days to a More Effective Compliance Program, a series by Tom Fox in January 2026, where he will post daily insights on best practices for compliance programs. Each short podcast, lasting 6-8 minutes, will provide three actionable takeaways to help you create, design, or enhance your compliance program at minimal cost. Join daily for valuable guidance on compliance best practices. In today’s Day 24 episode, we look into the critical process of internal reporting and triaging of FCPA claims. Key highlights: Guidelines for Effective Compliance Programs Jonathan Marks’ Five-Step Process for Early Assessment Key Takeaways Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 24 Jan 2026 05:00:00 -0000 full 7 24 Thomas Fox The roles of internal reporting and triage. Welcome to 31 Days to a More Effective Compliance Program, a series by Tom Fox in January 2026, where he will post daily insights on best practices for compliance programs. Each short podcast, lasting 6-8 minutes, will provide three actionable takeaways to help you create, design, or enhance your compliance program at minimal cost. Join daily for valuable guidance on compliance best practices. In today’s Day 24 episode, we look into the critical process of internal reporting and triaging of FCPA claims. Key highlights: Guidelines for Effective Compliance Programs Jonathan Marks’ Five-Step Process for Early Assessment Key Takeaways Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program, a series by Tom Fox in January 2026, where he will post daily insights on best practices for compliance programs. Each short podcast, lasting 6-8 minutes, will provide three actionable takeaways to help you create, design, or enhance your compliance program at minimal cost. Join daily for valuable guidance on compliance best practices. In today’s Day 24 episode, we look into the critical process of internal reporting and triaging of FCPA claims.

Key highlights:

  • Guidelines for Effective Compliance Programs
  • Jonathan Marks’ Five-Step Process for Early Assessment
  • Key Takeaways

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 479 no Day 23 - Investigative Protocols Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 23 episode, we delve into the essential steps for conducting a thorough and effective internal investigation following an internal report. Key highlights: Key Questions for Internal Investigations Detailed Procedures for Handling Complaints Steps in the Investigative Process Importance of Consistency in Investigations Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 23 Jan 2026 05:00:00 -0000 full Thomas Fox Exploring the key steps for performing a comprehensive internal investigation. Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 23 episode, we delve into the essential steps for conducting a thorough and effective internal investigation following an internal report. Key highlights: Key Questions for Internal Investigations Detailed Procedures for Handling Complaints Steps in the Investigative Process Importance of Consistency in Investigations Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 23 episode, we delve into the essential steps for conducting a thorough and effective internal investigation following an internal report.

Key highlights:

  • Key Questions for Internal Investigations
  • Detailed Procedures for Handling Complaints
  • Steps in the Investigative Process
  • Importance of Consistency in Investigations

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 470 no Day 22 - Levels of Due Diligence Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 22 episode, we consider the levels of due diligence you should use when investigating third parties. Key highlights: What are the levels of Due Diligence? When is each level appropriate? Key Takeaways Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 22 Jan 2026 05:00:00 -0000 full Thomas Fox Appropriate levels of due diligence in investigating third parties. Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 22 episode, we consider the levels of due diligence you should use when investigating third parties. Key highlights: What are the levels of Due Diligence? When is each level appropriate? Key Takeaways Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 22 episode, we consider the levels of due diligence you should use when investigating third parties.

Key highlights:

  • What are the levels of Due Diligence?
  • When is each level appropriate?
  • Key Takeaways

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 480 no Day 21 - Managing Third Parties Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 21 episode, we dive into the essential strategies for managing third-party relationships in a compliance program. Key highlights: Strategic Approach to Third-Party Relationships Auditing and Ongoing Management Key Takeaways Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 21 Jan 2026 05:00:00 -0000 full Thomas Fox Exploring key strategies for managing third-party relationships within a compliance program. Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 21 episode, we dive into the essential strategies for managing third-party relationships in a compliance program. Key highlights: Strategic Approach to Third-Party Relationships Auditing and Ongoing Management Key Takeaways Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 21 episode, we dive into the essential strategies for managing third-party relationships in a compliance program.

Key highlights:

  • Strategic Approach to Third-Party Relationships
  • Auditing and Ongoing Management
  • Key Takeaways

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 482 no Day 20 - Third Party Risk Management Process Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 20 episode, we delve into third-party risk management, a crucial aspect of corporate compliance under the FCPA. Key highlights: Introduction to Third-Party Risk Management The Five Steps of Third-Party Risk Management Key Takeaways Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 20 Jan 2026 12:45:00 -0000 full Thomas Fox Why is third-party risk management an important element of corporate compliance related to the FCPA? Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 20 episode, we delve into third-party risk management, a crucial aspect of corporate compliance under the FCPA. Key highlights: Introduction to Third-Party Risk Management The Five Steps of Third-Party Risk Management Key Takeaways Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 20 episode, we delve into third-party risk management, a crucial aspect of corporate compliance under the FCPA.

Key highlights:

  • Introduction to Third-Party Risk Management
  • The Five Steps of Third-Party Risk Management
  • Key Takeaways

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 446 no Day 19 - Evaluating the Risk Management Process Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 19 episode, we review the critical process of evaluating and translating risk assessments into actionable risk profiles. Key highlights: Understanding Risk Profiles Evaluating Risk Management Processes Risk Matrix and Heat Maps Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 19 Jan 2026 05:00:00 -0000 full 8 19 Thomas Fox How to evaluate your RM process. Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 19 episode, we review the critical process of evaluating and translating risk assessments into actionable risk profiles. Key highlights: Understanding Risk Profiles Evaluating Risk Management Processes Risk Matrix and Heat Maps Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 19 episode, we review the critical process of evaluating and translating risk assessments into actionable risk profiles.

Key highlights:

  • Understanding Risk Profiles
  • Evaluating Risk Management Processes
  • Risk Matrix and Heat Maps

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 495 no Day 18 - Risk Assessments Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 18 episode, we discuss the essential role of risk assessments in anti-corruption compliance programs. Key highlights: The Importance of Regular Risk Assessments Methodologies for Risk Assessment Steps in Conducting a Risk Assessment Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 18 Jan 2026 05:00:00 -0000 full 7 18 Thomas Fox The importance of risk assessments. Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 18 episode, we discuss the essential role of risk assessments in anti-corruption compliance programs. Key highlights: The Importance of Regular Risk Assessments Methodologies for Risk Assessment Steps in Conducting a Risk Assessment Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 18 episode, we discuss the essential role of risk assessments in anti-corruption compliance programs.

Key highlights:

  • The Importance of Regular Risk Assessments
  • Methodologies for Risk Assessment
  • Steps in Conducting a Risk Assessment

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 520 no Day 17 - Podcasting for Compliance Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance.  In this Day 17 episode, we explore the transformative potential of podcasting in compliance training and fostering corporate culture. Key highlights: Podcast Storytelling: A New Approach Branded Podcast Series for Compliance The Benefits of Podcasting for Compliance Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 17 Jan 2026 05:00:00 -0000 full 7 17 Thomas Fox Using podcasting in compliance. Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance.  In this Day 17 episode, we explore the transformative potential of podcasting in compliance training and fostering corporate culture. Key highlights: Podcast Storytelling: A New Approach Branded Podcast Series for Compliance The Benefits of Podcasting for Compliance Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance.  In this Day 17 episode, we explore the transformative potential of podcasting in compliance training and fostering corporate culture.

Key highlights:

  • Podcast Storytelling: A New Approach
  • Branded Podcast Series for Compliance
  • The Benefits of Podcasting for Compliance

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 575 no Day 16 - Effective and Tailored Compliance Training Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today's Day 16 episode, we delve into the evolution and importance of employee compliance training, focusing on fostering a culture of compliance within organizations. Key highlights: Evolution of Compliance Training Standards Measuring Training Effectiveness Tailoring Training to Audience Needs Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 16 Jan 2026 05:00:00 -0000 full 8 16 Thomas Fox The need for both effective and tailored training. Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today's Day 16 episode, we delve into the evolution and importance of employee compliance training, focusing on fostering a culture of compliance within organizations. Key highlights: Evolution of Compliance Training Standards Measuring Training Effectiveness Tailoring Training to Audience Needs Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today's Day 16 episode, we delve into the evolution and importance of employee compliance training, focusing on fostering a culture of compliance within organizations.

Key highlights:

  • Evolution of Compliance Training Standards
  • Measuring Training Effectiveness
  • Tailoring Training to Audience Needs

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 522 no Day 15 - Monitoring and Improving Internal Controls Welcome to the 31 Days to a More Effective Compliance Program, a series by Tom Fox in January 2026. Each day will feature a brief podcast (6-8 minutes) highlighting a key component of a best-practice compliance program. By the end of the month, participants will be equipped to create or enhance their compliance programs with actionable takeaways at minimal cost. Join daily for insights into compliance best practices. In this Day 15 episode, we look at the ongoing process of monitoring and improving internal controls within companies. Key highlights: Understanding Control Overrides Continuous Monitoring and Improvement Assessing and Updating Controls Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 15 Jan 2026 05:00:00 -0000 full 7 15 Thomas Fox The importance of monitoring internal controls. Welcome to the 31 Days to a More Effective Compliance Program, a series by Tom Fox in January 2026. Each day will feature a brief podcast (6-8 minutes) highlighting a key component of a best-practice compliance program. By the end of the month, participants will be equipped to create or enhance their compliance programs with actionable takeaways at minimal cost. Join daily for insights into compliance best practices. In this Day 15 episode, we look at the ongoing process of monitoring and improving internal controls within companies. Key highlights: Understanding Control Overrides Continuous Monitoring and Improvement Assessing and Updating Controls Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to the 31 Days to a More Effective Compliance Program, a series by Tom Fox in January 2026. Each day will feature a brief podcast (6-8 minutes) highlighting a key component of a best-practice compliance program. By the end of the month, participants will be equipped to create or enhance their compliance programs with actionable takeaways at minimal cost. Join daily for insights into compliance best practices. In this Day 15 episode, we look at the ongoing process of monitoring and improving internal controls within companies.

Key highlights:

  • Understanding Control Overrides
  • Continuous Monitoring and Improvement
  • Assessing and Updating Controls

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 494 no Day 14 - Internal Controls Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. Today, on Day 14, the focus is on internal controls and their critical role in compliance frameworks. Key highlights: Defining Internal Controls Key Components of Internal Controls Internal Controls in Compliance Programs Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 14 Jan 2026 05:00:00 -0000 full 8 14 Thomas Fox The role of internal controls in compliance. Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. Today, on Day 14, the focus is on internal controls and their critical role in compliance frameworks. Key highlights: Defining Internal Controls Key Components of Internal Controls Internal Controls in Compliance Programs Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. Today, on Day 14, the focus is on internal controls and their critical role in compliance frameworks.

Key highlights:

  • Defining Internal Controls
  • Key Components of Internal Controls
  • Internal Controls in Compliance Programs

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 498 no Day 13 - Policies and Procedures Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In this Day 13 episode, we review the importance of having well-crafted compliance policies and procedures as the foundation of a robust compliance program. Key highlights: Importance of Compliance Policies Key Elements of Compliance Policies Assessment and Evolution of Policies Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 13 Jan 2026 05:00:00 -0000 full 8 13 Thomas Fox How to think about policies and procedures. Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In this Day 13 episode, we review the importance of having well-crafted compliance policies and procedures as the foundation of a robust compliance program. Key highlights: Importance of Compliance Policies Key Elements of Compliance Policies Assessment and Evolution of Policies Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In this Day 13 episode, we review the importance of having well-crafted compliance policies and procedures as the foundation of a robust compliance program.

Key highlights:

  • Importance of Compliance Policies
  • Key Elements of Compliance Policies
  • Assessment and Evolution of Policies

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 497 no Day 12- Your Corporate Code of Conduct Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over this 31 days series in January 2026, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance. This episode explores the critical value and construction of a corporate Code of Conduct, explaining its evolution from a legalistic document to a cornerstone of compliance programs. Key Highlights ·      Introduction to Code of Conduct ·      Regulatory Expectations and Guidelines ·      Crafting an Effective Code of Conduct Resources Listeners to this podcast can receive a 20% discount to The Compliance Handbook, 6th edition by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 12 Jan 2026 05:00:00 -0000 full 7 12 Thomas Fox How to think about your Code of Conduct. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over this 31 days series in January 2026, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance. This episode explores the critical value and construction of a corporate Code of Conduct, explaining its evolution from a legalistic document to a cornerstone of compliance programs. Key Highlights ·      Introduction to Code of Conduct ·      Regulatory Expectations and Guidelines ·      Crafting an Effective Code of Conduct Resources Listeners to this podcast can receive a 20% discount to The Compliance Handbook, 6th edition by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over this 31 days series in January 2026, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance. This episode explores the critical value and construction of a corporate Code of Conduct, explaining its evolution from a legalistic document to a cornerstone of compliance programs.

Key Highlights

·      Introduction to Code of Conduct

·      Regulatory Expectations and Guidelines

·      Crafting an Effective Code of Conduct

Resources

Listeners to this podcast can receive a 20% discount to The Compliance Handbook, 6th edition by clicking here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 514 no Day 11 - Moving Compliance Down into an Organization Welcome to the 31 Days to a More Effective Compliance Program, a series by Tom Fox in January 2026. Each day will feature a brief podcast (6-8 minutes) highlighting a key component of a best-practice compliance program. By the end of the month, participants will be equipped to create or enhance their compliance programs with actionable takeaways at minimal cost. Join daily for insights into compliance best practices. In this episode, Day 11, we discuss the importance of embedding a culture of compliance throughout all levels of an organization. Key highlights: Embedding Compliance Culture Role of Middle Management Tone at the Bottom Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 11 Jan 2026 05:00:00 -0000 full 8 11 Thomas Fox Moving tone down through an organization. Welcome to the 31 Days to a More Effective Compliance Program, a series by Tom Fox in January 2026. Each day will feature a brief podcast (6-8 minutes) highlighting a key component of a best-practice compliance program. By the end of the month, participants will be equipped to create or enhance their compliance programs with actionable takeaways at minimal cost. Join daily for insights into compliance best practices. In this episode, Day 11, we discuss the importance of embedding a culture of compliance throughout all levels of an organization. Key highlights: Embedding Compliance Culture Role of Middle Management Tone at the Bottom Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to the 31 Days to a More Effective Compliance Program, a series by Tom Fox in January 2026. Each day will feature a brief podcast (6-8 minutes) highlighting a key component of a best-practice compliance program. By the end of the month, participants will be equipped to create or enhance their compliance programs with actionable takeaways at minimal cost. Join daily for insights into compliance best practices. In this episode, Day 11, we discuss the importance of embedding a culture of compliance throughout all levels of an organization.

Key highlights:

  • Embedding Compliance Culture
  • Role of Middle Management
  • Tone at the Bottom

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 580 no Day 10 - Leadership’s Role in Shaping Corporate Culture and Compliance Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s episode, Day 10, we dive into the critical role of senior management in fostering a strong corporate culture of compliance. Key highlights: The Importance of Corporate Culture DOJ’s Expectations for Senior Management Five Factors for Effective Leadership Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 10 Jan 2026 05:00:00 -0000 full Thomas Fox What is the essential function of senior management in promoting a robust corporate culture focused on compliance? Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s episode, Day 10, we dive into the critical role of senior management in fostering a strong corporate culture of compliance. Key highlights: The Importance of Corporate Culture DOJ’s Expectations for Senior Management Five Factors for Effective Leadership Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s episode, Day 10, we dive into the critical role of senior management in fostering a strong corporate culture of compliance.

Key highlights:

  • The Importance of Corporate Culture
  • DOJ’s Expectations for Senior Management
  • Five Factors for Effective Leadership

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 470 no Day 9 - Continuous Monitoring and Continuous Improvement Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. Today, Day 9, we discuss continuous monitoring and continuous improvement. Key highlights: Understanding Changes in Company Risks Continuous Monitoring and Improvement External Information Sources for Compliance Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 09 Jan 2026 05:00:00 -0000 full 8 9 Thomas Fox Continuous Monitoring/Continuous Improvement. Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. Today, Day 9, we discuss continuous monitoring and continuous improvement. Key highlights: Understanding Changes in Company Risks Continuous Monitoring and Improvement External Information Sources for Compliance Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. Today, Day 9, we discuss continuous monitoring and continuous improvement.

Key highlights:

  • Understanding Changes in Company Risks
  • Continuous Monitoring and Improvement
  • External Information Sources for Compliance

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 476 no Day 8 - Building Effective Compliance Through Payroll Welcome to the 31 Days to a More Effective Compliance Program, a series by Tom Fox in January 2026. Each day will feature a brief podcast (6-8 minutes) highlighting a key component of a best-practice compliance program. By the end of the month, participants will be equipped to create or enhance their compliance programs with actionable takeaways at minimal cost. Join daily for insights into compliance best practices. Today, day 8, we discuss operationalizing a compliance program through payroll. Key highlights: Payroll should be at the forefront of any effort to prevent, detect, and remediate anti-corruption compliance issues. Key compliance program components for payroll. Watch for Offshore payments. Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 08 Jan 2026 05:00:00 -0000 full 8 8 Thomas Fox What is the role of payroll in compliance? Welcome to the 31 Days to a More Effective Compliance Program, a series by Tom Fox in January 2026. Each day will feature a brief podcast (6-8 minutes) highlighting a key component of a best-practice compliance program. By the end of the month, participants will be equipped to create or enhance their compliance programs with actionable takeaways at minimal cost. Join daily for insights into compliance best practices. Today, day 8, we discuss operationalizing a compliance program through payroll. Key highlights: Payroll should be at the forefront of any effort to prevent, detect, and remediate anti-corruption compliance issues. Key compliance program components for payroll. Watch for Offshore payments. Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to the 31 Days to a More Effective Compliance Program, a series by Tom Fox in January 2026. Each day will feature a brief podcast (6-8 minutes) highlighting a key component of a best-practice compliance program. By the end of the month, participants will be equipped to create or enhance their compliance programs with actionable takeaways at minimal cost. Join daily for insights into compliance best practices. Today, day 8, we discuss operationalizing a compliance program through payroll.

Key highlights:

  • Payroll should be at the forefront of any effort to prevent, detect, and remediate anti-corruption compliance issues.
  • Key compliance program components for payroll.
  • Watch for Offshore payments.

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 531 no Day 7 - Clawbacks and Holdbacks Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. Today, on Day 7, we explore the critical insights from the DOJ Clawback and Holdback Program for compliance professionals. Key highlights: Integrating Compliance into Compensation Financial Accountability Emphasis DOJ’s Commitment to Individual Accountability Continuous Evaluation and Improvement Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 07 Jan 2026 05:00:00 -0000 full 8 7 Thomas Fox What about clawbacks and holdbacks? Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. Today, on Day 7, we explore the critical insights from the DOJ Clawback and Holdback Program for compliance professionals. Key highlights: Integrating Compliance into Compensation Financial Accountability Emphasis DOJ’s Commitment to Individual Accountability Continuous Evaluation and Improvement Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. Today, on Day 7, we explore the critical insights from the DOJ Clawback and Holdback Program for compliance professionals.

Key highlights:

  • Integrating Compliance into Compensation
  • Financial Accountability Emphasis
  • DOJ’s Commitment to Individual Accountability
  • Continuous Evaluation and Improvement

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 494 no Day 6 - The M&A Safe Harbor Policy Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. Today, on Day 6, we delve into the DOJ’s Mergers and Acquisitions (M&A) Safe Harbor Policy. Key highlights: DOJ Mergers and Acquisitions Safe Harbor Policy Key Requirements and Deadlines Historical Context and Clarifications Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 06 Jan 2026 05:00:00 -0000 full 8 6 Thomas Fox M&A Safe Harbor. Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. Today, on Day 6, we delve into the DOJ’s Mergers and Acquisitions (M&A) Safe Harbor Policy. Key highlights: DOJ Mergers and Acquisitions Safe Harbor Policy Key Requirements and Deadlines Historical Context and Clarifications Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. Today, on Day 6, we delve into the DOJ’s Mergers and Acquisitions (M&A) Safe Harbor Policy.

Key highlights:

  • DOJ Mergers and Acquisitions Safe Harbor Policy
  • Key Requirements and Deadlines
  • Historical Context and Clarifications

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 488 no Day 5 - Enhancing Compliance Through Automation Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. Today, on Day 5, we explore how automation can revolutionize traditional compliance reporting, which is often manual, time-consuming, and error-prone. By leveraging data-driven solutions, compliance professionals can achieve near real-time reporting, improving decision-making and efficiency across their organizations. Key highlights: Challenges in Traditional Compliance Reporting Integrating Tools for Real-Time Compliance Balancing Real-Time Reporting with Data Security Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 05 Jan 2026 05:00:00 -0000 full 8 5 Thomas Fox Using automation in compliance. Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. Today, on Day 5, we explore how automation can revolutionize traditional compliance reporting, which is often manual, time-consuming, and error-prone. By leveraging data-driven solutions, compliance professionals can achieve near real-time reporting, improving decision-making and efficiency across their organizations. Key highlights: Challenges in Traditional Compliance Reporting Integrating Tools for Real-Time Compliance Balancing Real-Time Reporting with Data Security Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. Today, on Day 5, we explore how automation can revolutionize traditional compliance reporting, which is often manual, time-consuming, and error-prone. By leveraging data-driven solutions, compliance professionals can achieve near real-time reporting, improving decision-making and efficiency across their organizations.

Key highlights:

  • Challenges in Traditional Compliance Reporting
  • Integrating Tools for Real-Time Compliance
  • Balancing Real-Time Reporting with Data Security

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 412 no Day 4 - Building Effective Data Analytics Programs for Compliance Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. On Day 4, this episode focuses on defining the specific risks an organization wants to monitor, capturing relevant data creatively, and leveraging internal expertise to build effective data analytics programs. Key highlights: Defining and Identifying Risks Innovative Data Capture and Internal Collaboration Demonstrating Value to Senior Management Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 04 Jan 2026 05:00:00 -0000 full 7 4 Thomas Fox The importance of building effective data analytics programs for compliance. Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. On Day 4, this episode focuses on defining the specific risks an organization wants to monitor, capturing relevant data creatively, and leveraging internal expertise to build effective data analytics programs. Key highlights: Defining and Identifying Risks Innovative Data Capture and Internal Collaboration Demonstrating Value to Senior Management Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. On Day 4, this episode focuses on defining the specific risks an organization wants to monitor, capturing relevant data creatively, and leveraging internal expertise to build effective data analytics programs.

Key highlights:

  • Defining and Identifying Risks
  • Innovative Data Capture and Internal Collaboration
  • Demonstrating Value to Senior Management

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 431 no Day 3 - Key Updates in the ECCP: Messaging Apps, Internal Controls, and Compensation Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today's episode, Day 3, we delve into the significant updates in the evaluation of corporate compliance programs, focusing on messaging apps, internal controls, and adequate compensation. Key highlights: Messaging Apps and Compliance Internal Controls and Risk Management Adequate Compensation for Compliance Teams Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 03 Jan 2026 05:00:00 -0000 full 7 3 Thomas Fox Key 2024 ECCP updates Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today's episode, Day 3, we delve into the significant updates in the evaluation of corporate compliance programs, focusing on messaging apps, internal controls, and adequate compensation. Key highlights: Messaging Apps and Compliance Internal Controls and Risk Management Adequate Compensation for Compliance Teams Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today's episode, Day 3, we delve into the significant updates in the evaluation of corporate compliance programs, focusing on messaging apps, internal controls, and adequate compensation.

Key highlights:

  • Messaging Apps and Compliance
  • Internal Controls and Risk Management
  • Adequate Compensation for Compliance Teams

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 434 no Day 2 - The ECCP on Incentives, Consequences, and Clawbacks Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. Today, we look at what the ECCP has to say on incentives, consequences, and clawbacks. Key highlights: Starting with Incentives and Consequences Incentive Program Breakdown Consequence Management Deep Dive Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 02 Jan 2026 05:00:00 -0000 full 7 2 Thomas Fox What does the ECCP say about Incentives, Consequences, and Clawbacks? Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. Today, we look at what the ECCP has to say on incentives, consequences, and clawbacks. Key highlights: Starting with Incentives and Consequences Incentive Program Breakdown Consequence Management Deep Dive Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. Today, we look at what the ECCP has to say on incentives, consequences, and clawbacks.

Key highlights:

  • Starting with Incentives and Consequences
  • Incentive Program Breakdown
  • Consequence Management Deep Dive

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 486 no Day 1 - Data-Driven Compliance Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. On Day 1, we consider the need for data-driven compliance. Key highlights: Importance of Data Analytics in Compliance Implementing Data-Driven Compliance Challenges and Solutions in Data-Driven Compliance Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 01 Jan 2026 05:00:00 -0000 full 7 1 Thomas Fox The importance of data-driven compliance. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. On Day 1, we consider the need for data-driven compliance. Key highlights: Importance of Data Analytics in Compliance Implementing Data-Driven Compliance Challenges and Solutions in Data-Driven Compliance Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. On Day 1, we consider the need for data-driven compliance.

Key highlights:

  • Importance of Data Analytics in Compliance
  • Implementing Data-Driven Compliance
  • Challenges and Solutions in Data-Driven Compliance

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 415 no Day 31 - Leveraging Root Cause Analysis for Effective Compliance Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. In this final episode of our 31-day series, we dive into the importance of using root cause analysis for remediation in compliance programs. Emphasized by the ECCP and DOJ, an effective compliance program includes thorough root cause analysis to address misconduct and implement corrective actions. The process involves understanding who should perform the remediation, emphasizing independence and objectivity, integrating the information into solutions, and addressing deficiencies in internal controls. Key takeaways include using objective root cause analysis, effectively utilizing the information gathered, and implementing data-driven, repeatable solutions to prevent future issues. This episode provides valuable insights for compliance officers aiming to enhance their programs by focusing on root causes rather than just symptoms. Key highlights: Integrating Root Cause Analysis into Solutions Regulatory Expectations and Internal Controls Performing Effective Root Cause Analysis Developing and Implementing Solutions Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 31 Jan 2025 06:00:00 -0000 Day 31 - Leveraging Root Cause Analysis for Effective Compliance full 5 31 Thomas Fox This 31-day final episode explores the significance of root cause analysis in compliance program remediation. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. In this final episode of our 31-day series, we dive into the importance of using root cause analysis for remediation in compliance programs. Emphasized by the ECCP and DOJ, an effective compliance program includes thorough root cause analysis to address misconduct and implement corrective actions. The process involves understanding who should perform the remediation, emphasizing independence and objectivity, integrating the information into solutions, and addressing deficiencies in internal controls. Key takeaways include using objective root cause analysis, effectively utilizing the information gathered, and implementing data-driven, repeatable solutions to prevent future issues. This episode provides valuable insights for compliance officers aiming to enhance their programs by focusing on root causes rather than just symptoms. Key highlights: Integrating Root Cause Analysis into Solutions Regulatory Expectations and Internal Controls Performing Effective Root Cause Analysis Developing and Implementing Solutions Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

In this final episode of our 31-day series, we dive into the importance of using root cause analysis for remediation in compliance programs. Emphasized by the ECCP and DOJ, an effective compliance program includes thorough root cause analysis to address misconduct and implement corrective actions. The process involves understanding who should perform the remediation, emphasizing independence and objectivity, integrating the information into solutions, and addressing deficiencies in internal controls. Key takeaways include using objective root cause analysis, effectively utilizing the information gathered, and implementing data-driven, repeatable solutions to prevent future issues. This episode provides valuable insights for compliance officers aiming to enhance their programs by focusing on root causes rather than just symptoms.

Key highlights:

  • Integrating Root Cause Analysis into Solutions
  • Regulatory Expectations and Internal Controls
  • Performing Effective Root Cause Analysis
  • Developing and Implementing Solutions

Resources:

Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 458 no Day 30 - The Foreign Extortion Prevention Act Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. On Day 30, we discuss the Foreign Extortion Prevention Act (FEPA), a significant piece of legislation that fills a critical gap in the FCPA. FEPA criminalizes not only the payment of bribes but also the solicitation and acceptance of bribes by foreign officials, thereby providing a more comprehensive framework for combating global corruption. This law protects American workers abroad, promotes fair business competition, and upholds ethical practices internationally. However, it also introduces challenges, such as the complexity of extraditing foreign officials and potential impacts on international relations and companies operating overseas. Compliance officers must reassess internal controls and develop response plans to navigate the implications of FEPA effectively. Key highlights: Filling the Gap in Anti-Corruption Laws Key Features and Implications of FEPA Challenges in Implementing FEPA The Name and Shame List Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 30 Jan 2025 06:00:00 -0000 Day 30 - The Foreign Extortion Prevention Act bonus 5 30 Thomas Fox On Day 30, the FEPA is discussed as a crucial legislation addressing a significant FCPA gap. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. On Day 30, we discuss the Foreign Extortion Prevention Act (FEPA), a significant piece of legislation that fills a critical gap in the FCPA. FEPA criminalizes not only the payment of bribes but also the solicitation and acceptance of bribes by foreign officials, thereby providing a more comprehensive framework for combating global corruption. This law protects American workers abroad, promotes fair business competition, and upholds ethical practices internationally. However, it also introduces challenges, such as the complexity of extraditing foreign officials and potential impacts on international relations and companies operating overseas. Compliance officers must reassess internal controls and develop response plans to navigate the implications of FEPA effectively. Key highlights: Filling the Gap in Anti-Corruption Laws Key Features and Implications of FEPA Challenges in Implementing FEPA The Name and Shame List Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

On Day 30, we discuss the Foreign Extortion Prevention Act (FEPA), a significant piece of legislation that fills a critical gap in the FCPA. FEPA criminalizes not only the payment of bribes but also the solicitation and acceptance of bribes by foreign officials, thereby providing a more comprehensive framework for combating global corruption. This law protects American workers abroad, promotes fair business competition, and upholds ethical practices internationally. However, it also introduces challenges, such as the complexity of extraditing foreign officials and potential impacts on international relations and companies operating overseas. Compliance officers must reassess internal controls and develop response plans to navigate the implications of FEPA effectively.

Key highlights:

  • Filling the Gap in Anti-Corruption Laws
  • Key Features and Implications of FEPA
  • Challenges in Implementing FEPA
  • The Name and Shame List

Resources:

Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 489 no Day 29 - Enhancing Compliance through Automation Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. Traditional compliance reporting methods, often reliant on manual processes like Excel spreadsheets, are time-consuming and prone to errors. This episode explores how Chief Compliance Officers and compliance professionals can enhance their programs through automation. By adopting data-driven solutions and leveraging regulatory operations (Reg Ops), it’s possible to provide near real-time reporting and improve decision-making efficiency. The focus is on integrating existing security and compliance tools, gathering real-time evidence, automating compliance gap tickets, and generating comprehensive reports for stakeholders. However, challenges like balancing data accuracy and security and the cultural transformation required for adopting these new practices are critical considerations. Embracing data-driven compliance can help organizations modernize and keep pace with the evolving regulatory landscape. Key highlights: Challenges in Traditional Compliance Reporting The Role of Reg Ops in Compliance Integrating Tools for Real-Time Compliance Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 29 Jan 2025 06:00:00 -0000 Day 29 - Enhancing Compliance through Automation full 5 29 Thomas Fox How can CCOs and compliance professionals use automation to improve their programs? Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. Traditional compliance reporting methods, often reliant on manual processes like Excel spreadsheets, are time-consuming and prone to errors. This episode explores how Chief Compliance Officers and compliance professionals can enhance their programs through automation. By adopting data-driven solutions and leveraging regulatory operations (Reg Ops), it’s possible to provide near real-time reporting and improve decision-making efficiency. The focus is on integrating existing security and compliance tools, gathering real-time evidence, automating compliance gap tickets, and generating comprehensive reports for stakeholders. However, challenges like balancing data accuracy and security and the cultural transformation required for adopting these new practices are critical considerations. Embracing data-driven compliance can help organizations modernize and keep pace with the evolving regulatory landscape. Key highlights: Challenges in Traditional Compliance Reporting The Role of Reg Ops in Compliance Integrating Tools for Real-Time Compliance Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

Traditional compliance reporting methods, often reliant on manual processes like Excel spreadsheets, are time-consuming and prone to errors. This episode explores how Chief Compliance Officers and compliance professionals can enhance their programs through automation. By adopting data-driven solutions and leveraging regulatory operations (Reg Ops), it’s possible to provide near real-time reporting and improve decision-making efficiency. The focus is on integrating existing security and compliance tools, gathering real-time evidence, automating compliance gap tickets, and generating comprehensive reports for stakeholders. However, challenges like balancing data accuracy and security and the cultural transformation required for adopting these new practices are critical considerations. Embracing data-driven compliance can help organizations modernize and keep pace with the evolving regulatory landscape.

Key highlights:

  • Challenges in Traditional Compliance Reporting
  • The Role of Reg Ops in Compliance
  • Integrating Tools for Real-Time Compliance

Resources:

Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 418 no Day 28 - The Importance of Data Governance Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. On Day 28, we look into the crucial importance of data governance in compliance and cybersecurity. As data generation increases, businesses must enhance their efforts in managing, organizing, and preserving data to meet regulatory obligations and ensure accuracy, accessibility, and adherence to legal standards. We discuss the growing trend of converging compliance, data governance, and cyber security and the necessity of breaking down organizational silos for effective collaboration. Business and legal teams rely on well-managed data to make informed decisions, analyze trends, and measure key performance indicators. The episode also covers the challenges in gaining buy-in from the ELT and the vital process of transforming corporate culture to prioritize data governance and cybersecurity. We touch on the complexities of regional data privacy laws inspired by GDPR and emphasize the importance of understanding specific regulations for compliance. With key takeaways, including the significance of data preservation, the intertwined nature of compliance, data governance, and cybersecurity, and the urgency for organizations to prioritize data governance, this episode is packed with essential insights for compliance professionals. Key highlights: The Role of Data Governance in Compliance and Cybersecurity Data Governance and ESG Understanding Data Privacy Laws Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 28 Jan 2025 06:00:00 -0000 Day 28 - The Importance of Data Governance full 5 28 Thomas Fox On Day 28, we delve into the critical role of data governance in ensuring compliance and enhancing cybersecurity. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. On Day 28, we look into the crucial importance of data governance in compliance and cybersecurity. As data generation increases, businesses must enhance their efforts in managing, organizing, and preserving data to meet regulatory obligations and ensure accuracy, accessibility, and adherence to legal standards. We discuss the growing trend of converging compliance, data governance, and cyber security and the necessity of breaking down organizational silos for effective collaboration. Business and legal teams rely on well-managed data to make informed decisions, analyze trends, and measure key performance indicators. The episode also covers the challenges in gaining buy-in from the ELT and the vital process of transforming corporate culture to prioritize data governance and cybersecurity. We touch on the complexities of regional data privacy laws inspired by GDPR and emphasize the importance of understanding specific regulations for compliance. With key takeaways, including the significance of data preservation, the intertwined nature of compliance, data governance, and cybersecurity, and the urgency for organizations to prioritize data governance, this episode is packed with essential insights for compliance professionals. Key highlights: The Role of Data Governance in Compliance and Cybersecurity Data Governance and ESG Understanding Data Privacy Laws Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

On Day 28, we look into the crucial importance of data governance in compliance and cybersecurity. As data generation increases, businesses must enhance their efforts in managing, organizing, and preserving data to meet regulatory obligations and ensure accuracy, accessibility, and adherence to legal standards. We discuss the growing trend of converging compliance, data governance, and cyber security and the necessity of breaking down organizational silos for effective collaboration. Business and legal teams rely on well-managed data to make informed decisions, analyze trends, and measure key performance indicators.

The episode also covers the challenges in gaining buy-in from the ELT and the vital process of transforming corporate culture to prioritize data governance and cybersecurity. We touch on the complexities of regional data privacy laws inspired by GDPR and emphasize the importance of understanding specific regulations for compliance. With key takeaways, including the significance of data preservation, the intertwined nature of compliance, data governance, and cybersecurity, and the urgency for organizations to prioritize data governance, this episode is packed with essential insights for compliance professionals.

Key highlights:

  • The Role of Data Governance in Compliance and Cybersecurity
  • Data Governance and ESG
  • Understanding Data Privacy Laws

Resources:

Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 412 no Day 27 - The Compliance Function in an Organization Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. On Day 27, we explore the growing importance and responsibilities of the compliance function within corporations, emphasizing the need for adequate staffing, resources, and independence. The 2020 FCPA Resource Guide outlines key factors that the DOJ considers indicative of an effective compliance program, including the quality of personnel, authority, compensation, and reporting structure. We delve into the necessity of properly funding compliance initiatives and ensuring the organization empowers and sufficiently supports compliance professionals. The updated Corporate Enforcement Policy emphasizes the prevention of retaliation against compliance investigators and the need for a robust structure supporting the compliance program. We conclude with three key takeaways for enhancing compliance functions: evaluating their treatment in the budget process, ensuring management respects compliance decisions, and considering the implications of outsourced compliance services. Key highlights: DOJ’s Expectations for Compliance Programs Funding and Resources for Compliance Compliance Program Structure and Authority Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 27 Jan 2025 06:00:00 -0000 Day 27 - The Compliance Function in an Organization full 5 27 Thomas Fox What is the role of compliance? Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. On Day 27, we explore the growing importance and responsibilities of the compliance function within corporations, emphasizing the need for adequate staffing, resources, and independence. The 2020 FCPA Resource Guide outlines key factors that the DOJ considers indicative of an effective compliance program, including the quality of personnel, authority, compensation, and reporting structure. We delve into the necessity of properly funding compliance initiatives and ensuring the organization empowers and sufficiently supports compliance professionals. The updated Corporate Enforcement Policy emphasizes the prevention of retaliation against compliance investigators and the need for a robust structure supporting the compliance program. We conclude with three key takeaways for enhancing compliance functions: evaluating their treatment in the budget process, ensuring management respects compliance decisions, and considering the implications of outsourced compliance services. Key highlights: DOJ’s Expectations for Compliance Programs Funding and Resources for Compliance Compliance Program Structure and Authority Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

On Day 27, we explore the growing importance and responsibilities of the compliance function within corporations, emphasizing the need for adequate staffing, resources, and independence. The 2020 FCPA Resource Guide outlines key factors that the DOJ considers indicative of an effective compliance program, including the quality of personnel, authority, compensation, and reporting structure. We delve into the necessity of properly funding compliance initiatives and ensuring the organization empowers and sufficiently supports compliance professionals. The updated Corporate Enforcement Policy emphasizes the prevention of retaliation against compliance investigators and the need for a robust structure supporting the compliance program. We conclude with three key takeaways for enhancing compliance functions: evaluating their treatment in the budget process, ensuring management respects compliance decisions, and considering the implications of outsourced compliance services.

Key highlights:

  • DOJ’s Expectations for Compliance Programs
  • Funding and Resources for Compliance
  • Compliance Program Structure and Authority

Resources:

Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 467 no Day 26 - CCO Authority and Independence Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. On Day 26, we ponder the evolving stature and authority of the CCO within organizations, as highlighted by recent guidelines and regulations. The 2020 FCPA Resource Guide emphasizes the importance of the CCO’s direct reporting line to the board and senior management status. The DOJ’s updated Corporate Enforcement Policy has further enhanced the prestige and role of the CCO, introducing key factors like the quality, experience, authority, independence, compensation, and reporting structure of the CCO. The episode also touches on the significance of the Delaware Court of Chancery’s decision in the McDonald’s case, which formalized the oversight duties of corporate officers, positioning the CCO as the second-most important role in an organization. Key takeaways include demonstrating real authority for the CCO, evaluating their professional qualifications, and assessing their actual status within your company. Key highlights: Key Inquiries Around the CCO and Compliance Function Importance of CCO Certification and Court Decisions Critical Takeaways for Compliance Professionals Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 26 Jan 2025 06:00:00 -0000 Day 26 - CCO Authority and Independence full 5 27 Thomas Fox How do you elevate the role of the CCO? Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. On Day 26, we ponder the evolving stature and authority of the CCO within organizations, as highlighted by recent guidelines and regulations. The 2020 FCPA Resource Guide emphasizes the importance of the CCO’s direct reporting line to the board and senior management status. The DOJ’s updated Corporate Enforcement Policy has further enhanced the prestige and role of the CCO, introducing key factors like the quality, experience, authority, independence, compensation, and reporting structure of the CCO. The episode also touches on the significance of the Delaware Court of Chancery’s decision in the McDonald’s case, which formalized the oversight duties of corporate officers, positioning the CCO as the second-most important role in an organization. Key takeaways include demonstrating real authority for the CCO, evaluating their professional qualifications, and assessing their actual status within your company. Key highlights: Key Inquiries Around the CCO and Compliance Function Importance of CCO Certification and Court Decisions Critical Takeaways for Compliance Professionals Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

On Day 26, we ponder the evolving stature and authority of the CCO within organizations, as highlighted by recent guidelines and regulations. The 2020 FCPA Resource Guide emphasizes the importance of the CCO’s direct reporting line to the board and senior management status. The DOJ’s updated Corporate Enforcement Policy has further enhanced the prestige and role of the CCO, introducing key factors like the quality, experience, authority, independence, compensation, and reporting structure of the CCO. The episode also touches on the significance of the Delaware Court of Chancery’s decision in the McDonald’s case, which formalized the oversight duties of corporate officers, positioning the CCO as the second-most important role in an organization. Key takeaways include demonstrating real authority for the CCO, evaluating their professional qualifications, and assessing their actual status within your company.

Key highlights:

  • Key Inquiries Around the CCO and Compliance Function
  • Importance of CCO Certification and Court Decisions
  • Critical Takeaways for Compliance Professionals

Resources:

Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 473 no Day 25 - Responding to Investigative Findings Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. On Day 25, we consider the critical importance of addressing investigative findings within a corporate compliance framework. When a whistleblower report, DOJ subpoena, or SEC notice brings compliance violations to light, it commands the board’s and senior management’s attention. The initial outrage and ethical proclamations that follow are often a prelude to the need for a serious reality check regarding costs and time outlays for remediation. The key is maintaining transparency and solid communication between those investigating and those responsible for remediation, ensuring compliance gaps are effectively identified and addressed. Today’s takeaways emphasize using the heightened attention for compliance improvement, recognizing the interplay between investigation and remediation, and being ready to answer the ‘where else’ question effectively. Join us tomorrow as we explore the authority and independence of Chief Compliance Officers. Key highlights: The Impact of Investigations on Compliance Communicating Costs and Risks Ensuring Effective Communication Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 25 Jan 2025 06:00:00 -0000 Day 25 - Responding to Investigative Findings full 5 25 Thomas Fox On Day 25, we emphasize the critical role of addressing investigative findings within a corporate compliance framework. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. On Day 25, we consider the critical importance of addressing investigative findings within a corporate compliance framework. When a whistleblower report, DOJ subpoena, or SEC notice brings compliance violations to light, it commands the board’s and senior management’s attention. The initial outrage and ethical proclamations that follow are often a prelude to the need for a serious reality check regarding costs and time outlays for remediation. The key is maintaining transparency and solid communication between those investigating and those responsible for remediation, ensuring compliance gaps are effectively identified and addressed. Today’s takeaways emphasize using the heightened attention for compliance improvement, recognizing the interplay between investigation and remediation, and being ready to answer the ‘where else’ question effectively. Join us tomorrow as we explore the authority and independence of Chief Compliance Officers. Key highlights: The Impact of Investigations on Compliance Communicating Costs and Risks Ensuring Effective Communication Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

On Day 25, we consider the critical importance of addressing investigative findings within a corporate compliance framework. When a whistleblower report, DOJ subpoena, or SEC notice brings compliance violations to light, it commands the board’s and senior management’s attention. The initial outrage and ethical proclamations that follow are often a prelude to the need for a serious reality check regarding costs and time outlays for remediation. The key is maintaining transparency and solid communication between those investigating and those responsible for remediation, ensuring compliance gaps are effectively identified and addressed. Today’s takeaways emphasize using the heightened attention for compliance improvement, recognizing the interplay between investigation and remediation, and being ready to answer the ‘where else’ question effectively. Join us tomorrow as we explore the authority and independence of Chief Compliance Officers.

Key highlights:

  • The Impact of Investigations on Compliance
  • Communicating Costs and Risks
  • Ensuring Effective Communication

Resources:

Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 489 no Day 24 - Internal Reporting and Triage Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. On Day 24, we look into the critical internal reporting process and triaging of FCPA claims. As the CCO, you will oversee the initial steps when suspicious activities are reported. Jonathan Marks’ five-step process on early assessment of incoming information is explored, providing a structured approach for evaluating the severity of allegations from low-threat level to crisis management mode. Moreover, this episode emphasizes the necessity of effective hotlines, trained managers, and a culture of listening to employees to foster a safe reporting environment. Key takeaways include the DOJ and SEC’s emphasis on internal reporting lines, regularly testing hotlines, and the triage of claims to ensure appropriate investigation levels. Key highlights: Guidelines for Effective Compliance Programs Jonathan Marks' Five-Step Process for Early Assessment Key Takeaways Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 24 Jan 2025 06:00:00 -0000 Day 24 - Internal Reporting and Triage full 5 24 Thomas Fox On Day 24, we will examine the crucial internal reporting process and the triaging of FCPA claims. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. On Day 24, we look into the critical internal reporting process and triaging of FCPA claims. As the CCO, you will oversee the initial steps when suspicious activities are reported. Jonathan Marks’ five-step process on early assessment of incoming information is explored, providing a structured approach for evaluating the severity of allegations from low-threat level to crisis management mode. Moreover, this episode emphasizes the necessity of effective hotlines, trained managers, and a culture of listening to employees to foster a safe reporting environment. Key takeaways include the DOJ and SEC’s emphasis on internal reporting lines, regularly testing hotlines, and the triage of claims to ensure appropriate investigation levels. Key highlights: Guidelines for Effective Compliance Programs Jonathan Marks' Five-Step Process for Early Assessment Key Takeaways Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

On Day 24, we look into the critical internal reporting process and triaging of FCPA claims. As the CCO, you will oversee the initial steps when suspicious activities are reported. Jonathan Marks’ five-step process on early assessment of incoming information is explored, providing a structured approach for evaluating the severity of allegations from low-threat level to crisis management mode. Moreover, this episode emphasizes the necessity of effective hotlines, trained managers, and a culture of listening to employees to foster a safe reporting environment. Key takeaways include the DOJ and SEC’s emphasis on internal reporting lines, regularly testing hotlines, and the triage of claims to ensure appropriate investigation levels.

Key highlights:

  • Guidelines for Effective Compliance Programs
  • Jonathan Marks' Five-Step Process for Early Assessment
  • Key Takeaways

Resources:

Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 489 no Day 23 - Investigative Protocols Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. On Day 23, we delve into the essential steps for conducting a thorough and effective internal investigation following an internal report. The discussion is grounded in the ECCP’s guidelines, emphasizing the necessity of properly scoping investigations with competent personnel and adequate resources. A detailed written procedure is crucial for handling complaints or allegations of bribery and corruption, regardless of their origins. The episode outlines a five-component investigative protocol: opening and categorizing the case, planning the investigation, executing the investigative plan, determining appropriate follow-up, and closing the case. Emphasis is placed on maintaining transparency, consistency, and thorough documentation throughout the process. Three key takeaways are highlighted: the importance of a written protocol, the need for transparency and documentation, and the critical role of consistency across the organization. Key highlights: Key Questions for Internal Investigations Detailed Procedures for Handling Complaints Steps in the Investigative Process Importance of Consistency in Investigations Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 23 Jan 2025 06:00:00 -0000 Day 23 - Investigative Protocols full 5 23 Thomas Fox On Day 23, we discuss the crucial steps for conducting a comprehensive and effective internal investigation following an internal report. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. On Day 23, we delve into the essential steps for conducting a thorough and effective internal investigation following an internal report. The discussion is grounded in the ECCP’s guidelines, emphasizing the necessity of properly scoping investigations with competent personnel and adequate resources. A detailed written procedure is crucial for handling complaints or allegations of bribery and corruption, regardless of their origins. The episode outlines a five-component investigative protocol: opening and categorizing the case, planning the investigation, executing the investigative plan, determining appropriate follow-up, and closing the case. Emphasis is placed on maintaining transparency, consistency, and thorough documentation throughout the process. Three key takeaways are highlighted: the importance of a written protocol, the need for transparency and documentation, and the critical role of consistency across the organization. Key highlights: Key Questions for Internal Investigations Detailed Procedures for Handling Complaints Steps in the Investigative Process Importance of Consistency in Investigations Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

On Day 23, we delve into the essential steps for conducting a thorough and effective internal investigation following an internal report. The discussion is grounded in the ECCP’s guidelines, emphasizing the necessity of properly scoping investigations with competent personnel and adequate resources. A detailed written procedure is crucial for handling complaints or allegations of bribery and corruption, regardless of their origins. The episode outlines a five-component investigative protocol: opening and categorizing the case, planning the investigation, executing the investigative plan, determining appropriate follow-up, and closing the case. Emphasis is placed on maintaining transparency, consistency, and thorough documentation throughout the process. Three key takeaways are highlighted: the importance of a written protocol, the need for transparency and documentation, and the critical role of consistency across the organization.

Key highlights:

  • Key Questions for Internal Investigations
  • Detailed Procedures for Handling Complaints
  • Steps in the Investigative Process
  • Importance of Consistency in Investigations

Resources:

Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 492 no Day 22 - Levels of Due Diligence Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. On Day 22, we consider the levels of due diligence you should use when investigating third parties. Tom outlines the three due diligence levels necessary to manage corruption risk effectively. With insights from Candice Tal, founder and CEO of Infortal, Tom breaks down each level in detail, from initial screenings in level one to comprehensive, on-the-ground investigations in level three. He emphasizes the need for tailored approaches based on the risks associated with different business transactions and the importance of thorough documentation throughout the process. Key highlights: What are the levels of Due Diligence? When is each level appropriate? Key Takeaways Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 22 Jan 2025 06:00:00 -0000 Levels of Due Diligence bonus 5 22 Thomas Fox What are the levels of due diligence? Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. On Day 22, we consider the levels of due diligence you should use when investigating third parties. Tom outlines the three due diligence levels necessary to manage corruption risk effectively. With insights from Candice Tal, founder and CEO of Infortal, Tom breaks down each level in detail, from initial screenings in level one to comprehensive, on-the-ground investigations in level three. He emphasizes the need for tailored approaches based on the risks associated with different business transactions and the importance of thorough documentation throughout the process. Key highlights: What are the levels of Due Diligence? When is each level appropriate? Key Takeaways Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

On Day 22, we consider the levels of due diligence you should use when investigating third parties. Tom outlines the three due diligence levels necessary to manage corruption risk effectively. With insights from Candice Tal, founder and CEO of Infortal, Tom breaks down each level in detail, from initial screenings in level one to comprehensive, on-the-ground investigations in level three. He emphasizes the need for tailored approaches based on the risks associated with different business transactions and the importance of thorough documentation throughout the process.

Key highlights:

  • What are the levels of Due Diligence?
  • When is each level appropriate?
  • Key Takeaways

Resources:

Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 503 no Day 21 - Managing 3rd Parties Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. On Day 21 of our series, we dive into the essential strategies for managing third-party relationships in a compliance program. We consider the significance of a structured and strategic approach in handling third parties to mitigate anti-corruption risks. As companies mature, the operationalization of compliance through third-party management becomes crucial. Key areas explored include the importance of dual and diversified sourcing, monitoring subcontractors, legal protections, and financial stability checks. Additionally, we cover the necessity of integrating performance-based compensation and regular auditing to uphold compliance standards. Join us tomorrow as we explore levels of due diligence on Day 22. Key highlights: Strategic Approach to Third-Party Relationships Auditing and Ongoing Management Key Takeaways Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 21 Jan 2025 06:00:00 -0000 Managing 3rd Parties bonus 5 21 Thomas Fox How do you manage your 3rd parties? Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. On Day 21 of our series, we dive into the essential strategies for managing third-party relationships in a compliance program. We consider the significance of a structured and strategic approach in handling third parties to mitigate anti-corruption risks. As companies mature, the operationalization of compliance through third-party management becomes crucial. Key areas explored include the importance of dual and diversified sourcing, monitoring subcontractors, legal protections, and financial stability checks. Additionally, we cover the necessity of integrating performance-based compensation and regular auditing to uphold compliance standards. Join us tomorrow as we explore levels of due diligence on Day 22. Key highlights: Strategic Approach to Third-Party Relationships Auditing and Ongoing Management Key Takeaways Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

On Day 21 of our series, we dive into the essential strategies for managing third-party relationships in a compliance program. We consider the significance of a structured and strategic approach in handling third parties to mitigate anti-corruption risks. As companies mature, the operationalization of compliance through third-party management becomes crucial. Key areas explored include the importance of dual and diversified sourcing, monitoring subcontractors, legal protections, and financial stability checks. Additionally, we cover the necessity of integrating performance-based compensation and regular auditing to uphold compliance standards. Join us tomorrow as we explore levels of due diligence on Day 22.

Key highlights:

  • Strategic Approach to Third-Party Relationships
  • Auditing and Ongoing Management
  • Key Takeaways

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 504 no Day 20 - Third-Party Risk Management Process Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.  On Day 20, we delve into the third-party risk management process, a crucial aspect of corporate compliance under the FCPA. Third parties continue to pose the highest risk, necessitating an integrated and operational approach throughout the company. The episode outlines the five essential steps in the third-party risk management life cycle, as mandated by the DOJ in the 2020 FCPA Resource Guide. These steps include business justification, third-party questionnaires, due diligence, compliance terms and conditions, and post-contract management and oversight. Each step is explored in detail, emphasizing the importance of documenting business cases, performing thorough due diligence, and maintaining diligent oversight to mitigate potential FCPA violations. Key takeaways include the necessity of using the full five-step process, involving business development and ensuring all steps are operationalized with business unit representatives. Join us tomorrow for Day 21 to discuss managing your third parties. Key highlights: Introduction to Third Party Risk Management The Five Steps of Third-Party Risk Management Key Takeaways  Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 20 Jan 2025 06:00:00 -0000 Third-Party Risk Management Process bonus 5 20 Thomas Fox In this episode, we look at the third-party risk management process. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.  On Day 20, we delve into the third-party risk management process, a crucial aspect of corporate compliance under the FCPA. Third parties continue to pose the highest risk, necessitating an integrated and operational approach throughout the company. The episode outlines the five essential steps in the third-party risk management life cycle, as mandated by the DOJ in the 2020 FCPA Resource Guide. These steps include business justification, third-party questionnaires, due diligence, compliance terms and conditions, and post-contract management and oversight. Each step is explored in detail, emphasizing the importance of documenting business cases, performing thorough due diligence, and maintaining diligent oversight to mitigate potential FCPA violations. Key takeaways include the necessity of using the full five-step process, involving business development and ensuring all steps are operationalized with business unit representatives. Join us tomorrow for Day 21 to discuss managing your third parties. Key highlights: Introduction to Third Party Risk Management The Five Steps of Third-Party Risk Management Key Takeaways  Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. 

On Day 20, we delve into the third-party risk management process, a crucial aspect of corporate compliance under the FCPA. Third parties continue to pose the highest risk, necessitating an integrated and operational approach throughout the company. The episode outlines the five essential steps in the third-party risk management life cycle, as mandated by the DOJ in the 2020 FCPA Resource Guide. These steps include business justification, third-party questionnaires, due diligence, compliance terms and conditions, and post-contract management and oversight. Each step is explored in detail, emphasizing the importance of documenting business cases, performing thorough due diligence, and maintaining diligent oversight to mitigate potential FCPA violations. Key takeaways include the necessity of using the full five-step process, involving business development and ensuring all steps are operationalized with business unit representatives. Join us tomorrow for Day 21 to discuss managing your third parties.

Key highlights:

  • Introduction to Third Party Risk Management
  • The Five Steps of Third-Party Risk Management
  • Key Takeaways 

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 468 no Day 19 - Evaluating Risk Assessments Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.  In today's episode, we review the critical process of evaluating and translating risk assessments into actionable risk profiles. The discussion highlights the importance of prioritizing risks based on their significance and likelihood using risk matrices and heat maps. Expert insights from Ben Locwin and Bill Anathas emphasize focusing resources on high-risk employees and maintaining a robust compliance program aligned with FCPA guidelines. The episode also covers the Treasury Department's OFAC compliance framework and offers concrete steps for continuous risk monitoring and remediation. Key takeaways include the necessity of a well-reasoned approach to risk evaluation, thorough documentation, and the implementation of a dynamic risk matrix to guide compliance efforts. Key highlights: ·      Understanding Risk Profiles ·      Evaluating Risk Management Processes ·      Risk Matrix and Heat Maps Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 19 Jan 2025 06:00:00 -0000 Evaluating Risk Assessments bonus 5 19 Thomas Fox We begin by evaluating risk assessments. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.  In today's episode, we review the critical process of evaluating and translating risk assessments into actionable risk profiles. The discussion highlights the importance of prioritizing risks based on their significance and likelihood using risk matrices and heat maps. Expert insights from Ben Locwin and Bill Anathas emphasize focusing resources on high-risk employees and maintaining a robust compliance program aligned with FCPA guidelines. The episode also covers the Treasury Department's OFAC compliance framework and offers concrete steps for continuous risk monitoring and remediation. Key takeaways include the necessity of a well-reasoned approach to risk evaluation, thorough documentation, and the implementation of a dynamic risk matrix to guide compliance efforts. Key highlights: ·      Understanding Risk Profiles ·      Evaluating Risk Management Processes ·      Risk Matrix and Heat Maps Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. 

In today's episode, we review the critical process of evaluating and translating risk assessments into actionable risk profiles. The discussion highlights the importance of prioritizing risks based on their significance and likelihood using risk matrices and heat maps. Expert insights from Ben Locwin and Bill Anathas emphasize focusing resources on high-risk employees and maintaining a robust compliance program aligned with FCPA guidelines. The episode also covers the Treasury Department's OFAC compliance framework and offers concrete steps for continuous risk monitoring and remediation. Key takeaways include the necessity of a well-reasoned approach to risk evaluation, thorough documentation, and the implementation of a dynamic risk matrix to guide compliance efforts.

Key highlights:

·      Understanding Risk Profiles

·      Evaluating Risk Management Processes

·      Risk Matrix and Heat Maps

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 422 no Day 18 - Risk Assessments Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.  In this episode, we discuss the essential role of risk assessments in anti-corruption compliance programs. A well-structured risk assessment forms the foundation of every corporate compliance program. We explore how organizations should identify, assess, and define their risk profiles, emphasizing the need for annual risk assessments whenever business risks change. The focus then shifts to geopolitical issues, supply chain dynamics, and evolving work environments and how these should be factored into compliance risk assessments. Historical perspectives from DOJ guidelines and the importance of a robust risk identification, analysis, and management methodology are also discussed. As highlighted, documenting these processes is crucial for developing an effective compliance strategy that evolves with the company’s risk landscape. Finally, the episode outlines the steps to create a comprehensive risk management strategy post-assessment, including policy development, training, monitoring, and updating protocols. Key highlights: The Importance of Regular Risk Assessments Methodologies for Risk Assessment Steps in Conducting a Risk Assessment Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 18 Jan 2025 06:00:00 -0000 Risk Assessments full 5 18 Thomas Fox Today we look at Risk Assessments. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.  In this episode, we discuss the essential role of risk assessments in anti-corruption compliance programs. A well-structured risk assessment forms the foundation of every corporate compliance program. We explore how organizations should identify, assess, and define their risk profiles, emphasizing the need for annual risk assessments whenever business risks change. The focus then shifts to geopolitical issues, supply chain dynamics, and evolving work environments and how these should be factored into compliance risk assessments. Historical perspectives from DOJ guidelines and the importance of a robust risk identification, analysis, and management methodology are also discussed. As highlighted, documenting these processes is crucial for developing an effective compliance strategy that evolves with the company’s risk landscape. Finally, the episode outlines the steps to create a comprehensive risk management strategy post-assessment, including policy development, training, monitoring, and updating protocols. Key highlights: The Importance of Regular Risk Assessments Methodologies for Risk Assessment Steps in Conducting a Risk Assessment Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. 

In this episode, we discuss the essential role of risk assessments in anti-corruption compliance programs. A well-structured risk assessment forms the foundation of every corporate compliance program. We explore how organizations should identify, assess, and define their risk profiles, emphasizing the need for annual risk assessments whenever business risks change. The focus then shifts to geopolitical issues, supply chain dynamics, and evolving work environments and how these should be factored into compliance risk assessments. Historical perspectives from DOJ guidelines and the importance of a robust risk identification, analysis, and management methodology are also discussed. As highlighted, documenting these processes is crucial for developing an effective compliance strategy that evolves with the company’s risk landscape. Finally, the episode outlines the steps to create a comprehensive risk management strategy post-assessment, including policy development, training, monitoring, and updating protocols.

Key highlights:

  • The Importance of Regular Risk Assessments
  • Methodologies for Risk Assessment
  • Steps in Conducting a Risk Assessment

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 522 no Day 17 - Podcasting for Compliance Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.  In this episode, we explore the transformative potential of podcasting in compliance training and fostering corporate culture. Harnessing the power of imaginative communication methods, we discuss the effectiveness of delivering compliance messages and training through various podcast formats. We revisit the 2012 Morgan Stanley declination to underscore the impact of consistent compliance reminders and venture into how short ethics and compliance video clips and storytelling podcasts can enhance employee engagement and regulatory satisfaction.  These podcasts are standalone training tools and can be broadcast through social media, creating a larger reach and providing valuable feedback through listener engagement metrics. Additional formats discussed include a branded podcast series featuring longer episodes that humanize compliance topics through interviews and a daily compliance news show to keep employees informed and engaged. This episode emphasizes the importance of innovative storytelling in making compliance communications memorable and effective. Key highlights: ·      Podcast Storytelling: A New Approach ·      Branded Podcast Series for Compliance ·      The Benefits of Podcasting for Compliance Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 17 Jan 2025 06:00:00 -0000 Podcasting for Compliance bonus 5 17 Thomas Fox What is Podcasting for Compliance? Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.  In this episode, we explore the transformative potential of podcasting in compliance training and fostering corporate culture. Harnessing the power of imaginative communication methods, we discuss the effectiveness of delivering compliance messages and training through various podcast formats. We revisit the 2012 Morgan Stanley declination to underscore the impact of consistent compliance reminders and venture into how short ethics and compliance video clips and storytelling podcasts can enhance employee engagement and regulatory satisfaction.  These podcasts are standalone training tools and can be broadcast through social media, creating a larger reach and providing valuable feedback through listener engagement metrics. Additional formats discussed include a branded podcast series featuring longer episodes that humanize compliance topics through interviews and a daily compliance news show to keep employees informed and engaged. This episode emphasizes the importance of innovative storytelling in making compliance communications memorable and effective. Key highlights: ·      Podcast Storytelling: A New Approach ·      Branded Podcast Series for Compliance ·      The Benefits of Podcasting for Compliance Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. 

In this episode, we explore the transformative potential of podcasting in compliance training and fostering corporate culture. Harnessing the power of imaginative communication methods, we discuss the effectiveness of delivering compliance messages and training through various podcast formats. We revisit the 2012 Morgan Stanley declination to underscore the impact of consistent compliance reminders and venture into how short ethics and compliance video clips and storytelling podcasts can enhance employee engagement and regulatory satisfaction. 

These podcasts are standalone training tools and can be broadcast through social media, creating a larger reach and providing valuable feedback through listener engagement metrics. Additional formats discussed include a branded podcast series featuring longer episodes that humanize compliance topics through interviews and a daily compliance news show to keep employees informed and engaged. This episode emphasizes the importance of innovative storytelling in making compliance communications memorable and effective.

Key highlights:

·      Podcast Storytelling: A New Approach

·      Branded Podcast Series for Compliance

·      The Benefits of Podcasting for Compliance

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 577 no Day 16 - Effective and Tailored Compliance Training Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be 6-8 minutes short, with three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. In today’s episode, we delve into the evolution and importance of employee compliance training, focusing on fostering a culture of compliance within organizations. We discuss key guidelines from the FCPA Resource Guide 2nd Edition and subsequent updates from the DOJ and SEC, emphasizing the necessity of effectively communicating and tailoring training programs to an organization’s specific audience. Critical aspects include the importance of training in local languages, assessing the risk profile of employees, and ensuring senior management’s participation. Furthermore, we explore the concept of ‘espresso shots’ or concise training segments to enhance learning and retention. Metrics such as increased hotline use and survey feedback are essential for evaluating the effectiveness of compliance programs. Key highlights: Evolution of Compliance Training Standards Measuring Training Effectiveness Tailoring Training to Audience Needs Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 16 Jan 2025 06:00:00 -0000 Effective and Tailored Compliance Training bonus 5 16 Thomas Fox Today, Effective and Tailored Compliance Training. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be 6-8 minutes short, with three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. In today’s episode, we delve into the evolution and importance of employee compliance training, focusing on fostering a culture of compliance within organizations. We discuss key guidelines from the FCPA Resource Guide 2nd Edition and subsequent updates from the DOJ and SEC, emphasizing the necessity of effectively communicating and tailoring training programs to an organization’s specific audience. Critical aspects include the importance of training in local languages, assessing the risk profile of employees, and ensuring senior management’s participation. Furthermore, we explore the concept of ‘espresso shots’ or concise training segments to enhance learning and retention. Metrics such as increased hotline use and survey feedback are essential for evaluating the effectiveness of compliance programs. Key highlights: Evolution of Compliance Training Standards Measuring Training Effectiveness Tailoring Training to Audience Needs Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be 6-8 minutes short, with three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

In today’s episode, we delve into the evolution and importance of employee compliance training, focusing on fostering a culture of compliance within organizations. We discuss key guidelines from the FCPA Resource Guide 2nd Edition and subsequent updates from the DOJ and SEC, emphasizing the necessity of effectively communicating and tailoring training programs to an organization’s specific audience. Critical aspects include the importance of training in local languages, assessing the risk profile of employees, and ensuring senior management’s participation. Furthermore, we explore the concept of ‘espresso shots’ or concise training segments to enhance learning and retention. Metrics such as increased hotline use and survey feedback are essential for evaluating the effectiveness of compliance programs.

Key highlights:

  • Evolution of Compliance Training Standards
  • Measuring Training Effectiveness
  • Tailoring Training to Audience Needs

Resources:

Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 523 no Day 15 - Monitoring and Improving Internal Controls Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. In this episode, we look at the ongoing process of monitoring and improving company internal controls. Christina Ravelo starts by posing fundamental questions about the frequency of manual approvals and control overrides, emphasizing the importance of continuous evaluation and recalibration. This episode highlights the misperception among many compliance professionals and lawyers that controls are static and unchanging once implemented. Instead, internal controls should be dynamic, requiring regular reviews and updates based on collected data, such as the frequency of overrides. Proper documentation is crucial, and companies should engage in periodic self-reviews as part of their continuous monitoring efforts. Ravello also stresses the necessity of identifying issues and remedying them to prevent further complications. Today’s key takeaways include the idea that control overrides are not inherently problematic if appropriately managed, the dynamic nature of internal controls, and the importance of a comprehensive monitoring process incorporating feedback from every line of defense. Key highlights: Understanding Control Overrides Continuous Monitoring and Improvement Assessing and Updating Controls Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 15 Jan 2025 06:00:00 -0000 Monitoring and Improving Internal Controls bonus 5 15 Thomas Fox Today, there is the Monitoring and Improvement of Internal Controls. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. In this episode, we look at the ongoing process of monitoring and improving company internal controls. Christina Ravelo starts by posing fundamental questions about the frequency of manual approvals and control overrides, emphasizing the importance of continuous evaluation and recalibration. This episode highlights the misperception among many compliance professionals and lawyers that controls are static and unchanging once implemented. Instead, internal controls should be dynamic, requiring regular reviews and updates based on collected data, such as the frequency of overrides. Proper documentation is crucial, and companies should engage in periodic self-reviews as part of their continuous monitoring efforts. Ravello also stresses the necessity of identifying issues and remedying them to prevent further complications. Today’s key takeaways include the idea that control overrides are not inherently problematic if appropriately managed, the dynamic nature of internal controls, and the importance of a comprehensive monitoring process incorporating feedback from every line of defense. Key highlights: Understanding Control Overrides Continuous Monitoring and Improvement Assessing and Updating Controls Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

In this episode, we look at the ongoing process of monitoring and improving company internal controls. Christina Ravelo starts by posing fundamental questions about the frequency of manual approvals and control overrides, emphasizing the importance of continuous evaluation and recalibration. This episode highlights the misperception among many compliance professionals and lawyers that controls are static and unchanging once implemented. Instead, internal controls should be dynamic, requiring regular reviews and updates based on collected data, such as the frequency of overrides. Proper documentation is crucial, and companies should engage in periodic self-reviews as part of their continuous monitoring efforts. Ravello also stresses the necessity of identifying issues and remedying them to prevent further complications. Today’s key takeaways include the idea that control overrides are not inherently problematic if appropriately managed, the dynamic nature of internal controls, and the importance of a comprehensive monitoring process incorporating feedback from every line of defense.

Key highlights:

  • Understanding Control Overrides
  • Continuous Monitoring and Improvement
  • Assessing and Updating Controls

Resources:

Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 495 Day 14 - Internal Controls Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. Today, the focus is on internal controls and their critical role in compliance frameworks. The episode provides a comprehensive definition of internal controls, emphasizing their importance for achieving operational efficiency, reliable financial reporting, compliance with laws and policies, and the reduction of risks such as fraud and waste. The discussion highlights the requirements outlined in the FCPA for internal controls, including the authorization and documentation of transactions and the protection and accountability of assets. Moreover, four significant internal controls for compliance practitioners are identified: delegation of authority, maintenance of the vendor master file, contracts with third parties, and management of cash and currency transfers. The episode underscores that effective internal controls are essential and mandated by the FCPA, forming a cornerstone of any robust compliance program. Key highlights: Defining Internal Controls Key Components of Internal Controls Internal Controls in Compliance Programs Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 14 Jan 2025 06:00:00 -0000 Internal Controls bonus 5 12 Thomas Fox Today, we look at Internal Controls. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. Today, the focus is on internal controls and their critical role in compliance frameworks. The episode provides a comprehensive definition of internal controls, emphasizing their importance for achieving operational efficiency, reliable financial reporting, compliance with laws and policies, and the reduction of risks such as fraud and waste. The discussion highlights the requirements outlined in the FCPA for internal controls, including the authorization and documentation of transactions and the protection and accountability of assets. Moreover, four significant internal controls for compliance practitioners are identified: delegation of authority, maintenance of the vendor master file, contracts with third parties, and management of cash and currency transfers. The episode underscores that effective internal controls are essential and mandated by the FCPA, forming a cornerstone of any robust compliance program. Key highlights: Defining Internal Controls Key Components of Internal Controls Internal Controls in Compliance Programs Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

Today, the focus is on internal controls and their critical role in compliance frameworks. The episode provides a comprehensive definition of internal controls, emphasizing their importance for achieving operational efficiency, reliable financial reporting, compliance with laws and policies, and the reduction of risks such as fraud and waste. The discussion highlights the requirements outlined in the FCPA for internal controls, including the authorization and documentation of transactions and the protection and accountability of assets. Moreover, four significant internal controls for compliance practitioners are identified: delegation of authority, maintenance of the vendor master file, contracts with third parties, and management of cash and currency transfers. The episode underscores that effective internal controls are essential and mandated by the FCPA, forming a cornerstone of any robust compliance program.

Key highlights:

  • Defining Internal Controls
  • Key Components of Internal Controls
  • Internal Controls in Compliance Programs

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 498 no Day 13 - Policies and Procedures Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. In this episode, we review the importance of having well-crafted compliance policies and procedures as the foundation of a robust compliance program. As highlighted by the 2024 ECCP and 2020 FCPA Resource Guide, such policies and procedures are crucial for addressing and mitigating risks identified during a company’s risk assessment. Regulators emphasize having articulated anti-bribery and anti-corruption policies regularly reviewed and updated to reflect evolving risks. We discuss the five general elements of a compliance policy and underscore the need for consistent implementation to maintain the credibility and effectiveness of the compliance program. Key takeaways include the necessity of written policies, expectations from the DOJ and SEC, and the critical role of institutional fairness. Key highlights: Importance of Compliance Policies Key Elements of Compliance Policies Assessment and Evolution of Policies Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 13 Jan 2025 06:00:00 -0000 Policies and Procedures bonus 5 13 Thomas Fox Today, we look at Policies and Procedures. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. In this episode, we review the importance of having well-crafted compliance policies and procedures as the foundation of a robust compliance program. As highlighted by the 2024 ECCP and 2020 FCPA Resource Guide, such policies and procedures are crucial for addressing and mitigating risks identified during a company’s risk assessment. Regulators emphasize having articulated anti-bribery and anti-corruption policies regularly reviewed and updated to reflect evolving risks. We discuss the five general elements of a compliance policy and underscore the need for consistent implementation to maintain the credibility and effectiveness of the compliance program. Key takeaways include the necessity of written policies, expectations from the DOJ and SEC, and the critical role of institutional fairness. Key highlights: Importance of Compliance Policies Key Elements of Compliance Policies Assessment and Evolution of Policies Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

In this episode, we review the importance of having well-crafted compliance policies and procedures as the foundation of a robust compliance program. As highlighted by the 2024 ECCP and 2020 FCPA Resource Guide, such policies and procedures are crucial for addressing and mitigating risks identified during a company’s risk assessment. Regulators emphasize having articulated anti-bribery and anti-corruption policies regularly reviewed and updated to reflect evolving risks. We discuss the five general elements of a compliance policy and underscore the need for consistent implementation to maintain the credibility and effectiveness of the compliance program. Key takeaways include the necessity of written policies, expectations from the DOJ and SEC, and the critical role of institutional fairness.

Key highlights:

  • Importance of Compliance Policies
  • Key Elements of Compliance Policies
  • Assessment and Evolution of Policies

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 498 no Day 12 - The Importance and Construction of a Corporate Code of Conduct Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. This episode explores the critical value and construction of a corporate Code of Conduct, explaining its evolution from a legalistic document to a cornerstone of compliance programs. The discussion includes an analysis of the 2016 SEC Enforcement Action against United Airlines, highlighting how violations of the Code of Conduct can lead to severe consequences, including substantial penalties and executive resignations. Key takeaways emphasize that a Code of Conduct should be tailored to a company’s specific culture and industry, must be accessible to all employees, and needs to be regularly updated and documented to ensure its effectiveness. Tune in to learn why a robust Code of Conduct is foundational for any compliance program. Key highlights: Introduction to Code of Conduct Regulatory Expectations and Guidelines Crafting an Effective Code of Conduct Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 12 Jan 2025 06:00:00 -0000 The Importance and Construction of a Corporate Code of Conduct bonus 5 12 Thomas Fox Today, we take up the Code of Conduct. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. This episode explores the critical value and construction of a corporate Code of Conduct, explaining its evolution from a legalistic document to a cornerstone of compliance programs. The discussion includes an analysis of the 2016 SEC Enforcement Action against United Airlines, highlighting how violations of the Code of Conduct can lead to severe consequences, including substantial penalties and executive resignations. Key takeaways emphasize that a Code of Conduct should be tailored to a company’s specific culture and industry, must be accessible to all employees, and needs to be regularly updated and documented to ensure its effectiveness. Tune in to learn why a robust Code of Conduct is foundational for any compliance program. Key highlights: Introduction to Code of Conduct Regulatory Expectations and Guidelines Crafting an Effective Code of Conduct Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

This episode explores the critical value and construction of a corporate Code of Conduct, explaining its evolution from a legalistic document to a cornerstone of compliance programs. The discussion includes an analysis of the 2016 SEC Enforcement Action against United Airlines, highlighting how violations of the Code of Conduct can lead to severe consequences, including substantial penalties and executive resignations. Key takeaways emphasize that a Code of Conduct should be tailored to a company’s specific culture and industry, must be accessible to all employees, and needs to be regularly updated and documented to ensure its effectiveness. Tune in to learn why a robust Code of Conduct is foundational for any compliance program.

Key highlights:

  • Introduction to Code of Conduct
  • Regulatory Expectations and Guidelines
  • Crafting an Effective Code of Conduct

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 516 no Day 11 - Moving Compliance Down into an Organization Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of the best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. In this episode, Tom Fox discusses the importance of embedding a culture of compliance throughout all levels of an organization. Mike Volkov emphasizes that having senior management committed to compliance is not enough; the culture must permeate middle and lower management for a program to be effective. The 2024 ECCP underscores the necessity for ethical values to be embedded throughout the company’s hierarchy. This involves senior and middle management actively demonstrating their commitment to compliance, even in the face of competing business interests. Middle management plays a critical role, as they are the primary interface between most employees and upper management. The script highlights practical steps such as assembling compliance focus groups, training managers in effective listening, and ensuring organizational justice to operationalize a compliance program effectively. We also consider how to assess the real-world application of compliance measures within the company and the need for consistent and fair disciplinary actions across different regions and business units to reinforce a culture of compliance. Key highlights: Embedding Compliance Culture Role of Middle Management Tone at the Bottom Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 11 Jan 2025 06:00:00 -0000 Moving Compliance Down into an Organization bonus 5 11 Thomas Fox Today, we will discuss how to move the compliance tone down in an organization. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of the best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. In this episode, Tom Fox discusses the importance of embedding a culture of compliance throughout all levels of an organization. Mike Volkov emphasizes that having senior management committed to compliance is not enough; the culture must permeate middle and lower management for a program to be effective. The 2024 ECCP underscores the necessity for ethical values to be embedded throughout the company’s hierarchy. This involves senior and middle management actively demonstrating their commitment to compliance, even in the face of competing business interests. Middle management plays a critical role, as they are the primary interface between most employees and upper management. The script highlights practical steps such as assembling compliance focus groups, training managers in effective listening, and ensuring organizational justice to operationalize a compliance program effectively. We also consider how to assess the real-world application of compliance measures within the company and the need for consistent and fair disciplinary actions across different regions and business units to reinforce a culture of compliance. Key highlights: Embedding Compliance Culture Role of Middle Management Tone at the Bottom Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of the best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

In this episode, Tom Fox discusses the importance of embedding a culture of compliance throughout all levels of an organization. Mike Volkov emphasizes that having senior management committed to compliance is not enough; the culture must permeate middle and lower management for a program to be effective. The 2024 ECCP underscores the necessity for ethical values to be embedded throughout the company’s hierarchy. This involves senior and middle management actively demonstrating their commitment to compliance, even in the face of competing business interests. Middle management plays a critical role, as they are the primary interface between most employees and upper management. The script highlights practical steps such as assembling compliance focus groups, training managers in effective listening, and ensuring organizational justice to operationalize a compliance program effectively. We also consider how to assess the real-world application of compliance measures within the company and the need for consistent and fair disciplinary actions across different regions and business units to reinforce a culture of compliance.

Key highlights:

  • Embedding Compliance Culture
  • Role of Middle Management
  • Tone at the Bottom

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 522 no Day 10 - Leadership’s Role in Shaping Corporate Culture and Compliance Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. In today’s episode, we dive into the critical role of senior management in fostering a strong corporate culture of compliance, as highlighted by the 2022 Monaco Memo and the 2020 FCPA Resource Guide, 2nd edition. Emphasizing that corporate culture is vital to a company’s success, we discuss how the DOJ assesses ethical cultures and the importance of senior management’s active participation in compliance efforts. The episode outlines five key factors to guide senior leadership in setting, modeling, and monitoring the right tone at the top. These include clear communication of values, personal commitment to those values, supportive systems, integration into decision-making, and empowering managers to make ethically sound decisions. We conclude with three takeaways: senior management must engage in compliance, the DOJ evaluates corporate culture during investigations, and CEOs should be seen as chief compliance ambassadors. Key highlights: The Importance of Corporate Culture DOJ’s Expectations for Senior Management Five Factors for Effective Leadership Resources Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 10 Jan 2025 06:00:00 -0000 Leadership’s Role in Shaping Corporate Culture and Compliance full 6 10 Thomas Fox Today, how can senior leadership shape compliance and culture? Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. In today’s episode, we dive into the critical role of senior management in fostering a strong corporate culture of compliance, as highlighted by the 2022 Monaco Memo and the 2020 FCPA Resource Guide, 2nd edition. Emphasizing that corporate culture is vital to a company’s success, we discuss how the DOJ assesses ethical cultures and the importance of senior management’s active participation in compliance efforts. The episode outlines five key factors to guide senior leadership in setting, modeling, and monitoring the right tone at the top. These include clear communication of values, personal commitment to those values, supportive systems, integration into decision-making, and empowering managers to make ethically sound decisions. We conclude with three takeaways: senior management must engage in compliance, the DOJ evaluates corporate culture during investigations, and CEOs should be seen as chief compliance ambassadors. Key highlights: The Importance of Corporate Culture DOJ’s Expectations for Senior Management Five Factors for Effective Leadership Resources Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

In today’s episode, we dive into the critical role of senior management in fostering a strong corporate culture of compliance, as highlighted by the 2022 Monaco Memo and the 2020 FCPA Resource Guide, 2nd edition. Emphasizing that corporate culture is vital to a company’s success, we discuss how the DOJ assesses ethical cultures and the importance of senior management’s active participation in compliance efforts. The episode outlines five key factors to guide senior leadership in setting, modeling, and monitoring the right tone at the top. These include clear communication of values, personal commitment to those values, supportive systems, integration into decision-making, and empowering managers to make ethically sound decisions. We conclude with three takeaways: senior management must engage in compliance, the DOJ evaluates corporate culture during investigations, and CEOs should be seen as chief compliance ambassadors.

Key highlights:


  • The Importance of Corporate Culture
  • DOJ’s Expectations for Senior Management
  • Five Factors for Effective Leadership

Resources

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 470 no Day 9 - Continuous Monitoring and Continuous Improvement Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. Continuous monitoring and improvement are essential in developing effective compliance programs, serving as a dynamic approach to addressing and adapting to evolving risks. This underscores the critical nature of these concepts, particularly highlighted in the 2023 update to evaluating corporate compliance programs, and emphasizes the necessity for organizations to integrate real-time data and maintain comprehensive documentation in their decision-making processes. This approach ensures compliance and fosters agility and resilience in navigating the complexities of modern business landscapes. Key highlights: Understanding Changes in Company Risks Continuous Monitoring and Improvement External Information Sources for Compliance Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 09 Jan 2025 06:00:00 -0000 Continuous Monitoring and Continuous Improvement full 5 9 Thomas Fox Today, we consider Continuous Monitoring and Continuous Improvement. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. Continuous monitoring and improvement are essential in developing effective compliance programs, serving as a dynamic approach to addressing and adapting to evolving risks. This underscores the critical nature of these concepts, particularly highlighted in the 2023 update to evaluating corporate compliance programs, and emphasizes the necessity for organizations to integrate real-time data and maintain comprehensive documentation in their decision-making processes. This approach ensures compliance and fosters agility and resilience in navigating the complexities of modern business landscapes. Key highlights: Understanding Changes in Company Risks Continuous Monitoring and Improvement External Information Sources for Compliance Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.


Continuous monitoring and improvement are essential in developing effective compliance programs, serving as a dynamic approach to addressing and adapting to evolving risks. This underscores the critical nature of these concepts, particularly highlighted in the 2023 update to evaluating corporate compliance programs, and emphasizes the necessity for organizations to integrate real-time data and maintain comprehensive documentation in their decision-making processes. This approach ensures compliance and fosters agility and resilience in navigating the complexities of modern business landscapes.


Key highlights:

  • Understanding Changes in Company Risks
  • Continuous Monitoring and Improvement
  • External Information Sources for Compliance

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 476 no Day 8 - Building Effective Compliance Through Payroll Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. Operationalizing a compliance program through payroll is a vital component of a company’s risk management strategy, serving as both a control mechanism and a crucial link to the broader compliance function. Payroll is instrumental in identifying potential red flags, such as offshore payments, which require meticulous documentation and enhanced internal controls to prevent compliance violations. Tom Fox, a noted expert in compliance, underscores the significant role payroll plays in fortifying compliance programs by aligning with FCPA requirements and preventing fraudulent activities. He advocates for implementing demonstrable controls like Approval Certification processes, segregation of duties, and regular review procedures to mitigate compliance risks effectively. According to Tom, by embedding robust controls within payroll operations, companies deter potential violations and ensure compliance is woven into the organizational fabric, thus operationalizing their compliance programs seamlessly. Key highlights: Payroll should be on the front lines of any attempt to prevent, detect, and remediate anti-corruption compliance. Key compliance program components for payroll. Watch for offshore payments. Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 08 Jan 2025 12:46:00 -0000 Building Effective Compliance Through Payroll bonus 5 8 Thomas Fox Today, we look at the role of payroll in compliance. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. Operationalizing a compliance program through payroll is a vital component of a company’s risk management strategy, serving as both a control mechanism and a crucial link to the broader compliance function. Payroll is instrumental in identifying potential red flags, such as offshore payments, which require meticulous documentation and enhanced internal controls to prevent compliance violations. Tom Fox, a noted expert in compliance, underscores the significant role payroll plays in fortifying compliance programs by aligning with FCPA requirements and preventing fraudulent activities. He advocates for implementing demonstrable controls like Approval Certification processes, segregation of duties, and regular review procedures to mitigate compliance risks effectively. According to Tom, by embedding robust controls within payroll operations, companies deter potential violations and ensure compliance is woven into the organizational fabric, thus operationalizing their compliance programs seamlessly. Key highlights: Payroll should be on the front lines of any attempt to prevent, detect, and remediate anti-corruption compliance. Key compliance program components for payroll. Watch for offshore payments. Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6–8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.


Operationalizing a compliance program through payroll is a vital component of a company’s risk management strategy, serving as both a control mechanism and a crucial link to the broader compliance function. Payroll is instrumental in identifying potential red flags, such as offshore payments, which require meticulous documentation and enhanced internal controls to prevent compliance violations. Tom Fox, a noted expert in compliance, underscores the significant role payroll plays in fortifying compliance programs by aligning with FCPA requirements and preventing fraudulent activities. He advocates for implementing demonstrable controls like Approval Certification processes, segregation of duties, and regular review procedures to mitigate compliance risks effectively. According to Tom, by embedding robust controls within payroll operations, companies deter potential violations and ensure compliance is woven into the organizational fabric, thus operationalizing their compliance programs seamlessly.

Key highlights:

  • Payroll should be on the front lines of any attempt to prevent, detect, and remediate anti-corruption compliance.
  • Key compliance program components for payroll.
  • Watch for offshore payments.

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 531 no Day 7 - Argentieri on Clawbacks and Holdbacks Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. In this episode, we explore the critical insights from the DOJ Clawback Program for compliance professionals. It emphasizes integrating compliance into the compensation structure as an effective strategy to promote ethical behavior and prevent misconduct. We also delve into the significance of financial accountability, noting the DOJ’s practice of reducing fines for firms that reclaim compensation from responsible employees. Finally, the episode highlights the necessity of continuously evaluating and enhancing compliance-linked compensation systems, urging companies to regularly assess their effectiveness, gather feedback, and make necessary adjustments. This iterative process reinforces the idea that compliance programs must be dynamic and proactive rather than static operational checklists. Key highlights: Integrating Compliance into Compensation Financial Accountability Emphasis DOJ’s Commitment to Individual Accountability Continuous Evaluation and Improvement Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 07 Jan 2025 06:00:00 -0000 Argentieri on Clawbacks and Holdbacks bonus 5 7 Thomas Fox Today, clawbacks and holdbacks. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. In this episode, we explore the critical insights from the DOJ Clawback Program for compliance professionals. It emphasizes integrating compliance into the compensation structure as an effective strategy to promote ethical behavior and prevent misconduct. We also delve into the significance of financial accountability, noting the DOJ’s practice of reducing fines for firms that reclaim compensation from responsible employees. Finally, the episode highlights the necessity of continuously evaluating and enhancing compliance-linked compensation systems, urging companies to regularly assess their effectiveness, gather feedback, and make necessary adjustments. This iterative process reinforces the idea that compliance programs must be dynamic and proactive rather than static operational checklists. Key highlights: Integrating Compliance into Compensation Financial Accountability Emphasis DOJ’s Commitment to Individual Accountability Continuous Evaluation and Improvement Resources: Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

In this episode, we explore the critical insights from the DOJ Clawback Program for compliance professionals. It emphasizes integrating compliance into the compensation structure as an effective strategy to promote ethical behavior and prevent misconduct. We also delve into the significance of financial accountability, noting the DOJ’s practice of reducing fines for firms that reclaim compensation from responsible employees. Finally, the episode highlights the necessity of continuously evaluating and enhancing compliance-linked compensation systems, urging companies to regularly assess their effectiveness, gather feedback, and make necessary adjustments. This iterative process reinforces the idea that compliance programs must be dynamic and proactive rather than static operational checklists.

Key highlights:

  • Integrating Compliance into Compensation
  • Financial Accountability Emphasis
  • DOJ’s Commitment to Individual Accountability
  • Continuous Evaluation and Improvement

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 500 no Day 6 - M&A Safe Harbor Policy Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. This episode delves into the Department of Justice’s mergers and acquisitions (M&A) Safe Harbor Policy, as Deputy Attorney General Lisa Monaco explained. This policy encourages companies to voluntarily self-disclose criminal conduct discovered during acquisition. If a company promptly discloses such misconduct, cooperates with the ensuing investigation, and engages in appropriate remediation, restitution, and disgorgement, it can receive a presumption of a criminal declination. Key deadlines include disclosing misconduct within six months of the closing date and fully remediating within one year. The DOJ aims to incentivize acquiring companies to perform robust pre- and post-acquisition due diligence and self-disclosure to mitigate risks and de-risk transactions effectively. Key highlights: New DOJ Mergers and Acquisitions Safe Harbor Policy Key Requirements and Deadlines Historical Context and Clarifications Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 06 Jan 2025 06:00:00 -0000 M&A Safe Harbor Policy full 5 6 Thomas Fox Today, how to use the DOJ M&A Safe Harbor Policy. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance. This episode delves into the Department of Justice’s mergers and acquisitions (M&A) Safe Harbor Policy, as Deputy Attorney General Lisa Monaco explained. This policy encourages companies to voluntarily self-disclose criminal conduct discovered during acquisition. If a company promptly discloses such misconduct, cooperates with the ensuing investigation, and engages in appropriate remediation, restitution, and disgorgement, it can receive a presumption of a criminal declination. Key deadlines include disclosing misconduct within six months of the closing date and fully remediating within one year. The DOJ aims to incentivize acquiring companies to perform robust pre- and post-acquisition due diligence and self-disclosure to mitigate risks and de-risk transactions effectively. Key highlights: New DOJ Mergers and Acquisitions Safe Harbor Policy Key Requirements and Deadlines Historical Context and Clarifications Resources: Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.


This episode delves into the Department of Justice’s mergers and acquisitions (M&A) Safe Harbor Policy, as Deputy Attorney General Lisa Monaco explained. This policy encourages companies to voluntarily self-disclose criminal conduct discovered during acquisition. If a company promptly discloses such misconduct, cooperates with the ensuing investigation, and engages in appropriate remediation, restitution, and disgorgement, it can receive a presumption of a criminal declination. Key deadlines include disclosing misconduct within six months of the closing date and fully remediating within one year. The DOJ aims to incentivize acquiring companies to perform robust pre- and post-acquisition due diligence and self-disclosure to mitigate risks and de-risk transactions effectively.


Key highlights:


  • New DOJ Mergers and Acquisitions Safe Harbor Policy
  • Key Requirements and Deadlines
  • Historical Context and Clarifications


Resources:


Click here to receive a 20% discount on The Compliance Handbook, 5th edition, for listeners to this podcast.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 425 no Day 5- Enhancing Compliance Through Automation Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 05 Jan 2025 06:00:00 -0000 Enhancing Compliance Through Automation bonus 5 5 Thomas Fox Today we take up enhancing compliance through automation. Learn more about your ad choices. Visit megaphone.fm/adchoices

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 356 yes Day 4- Building Effective Data Analytics Programs for Compliance Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2025, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance.  In today's business environment, compliance professionals leverage data analytics to adhere to regulatory requirements and ethical standards. This episode focuses on the importance of defining specific risks an organization wants to monitor, capturing relevant data creatively, and utilizing internal expertise to build effective data analytics programs. By starting small and focusing on one risk at a time, compliance officers can demonstrate their dedication to improving compliance despite limited resources. Additionally, a data-driven approach helps shift focus from individual policy violations to identifying systemic issues, enhancing overall organizational compliance. Key takeaways include understanding multiple factors in creating data-driven compliance programs, recognizing the value of shifting focus to systemic issues, and gradually building analytics capabilities. Key Highlights ·       Defining and Identifying Risks ·       Innovative Data Capture and Internal Collaboration ·       Demonstrating Value to Senior Management Resources Listeners to this podcast can receive a 20% discount to The Compliance Handbook, 5th edition by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 04 Jan 2025 06:00:00 -0000 Building Effective Data Analytics Programs for Compliance bonus 5 4 Thomas Fox Why you need an effective data analytics program. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2025, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance.  In today's business environment, compliance professionals leverage data analytics to adhere to regulatory requirements and ethical standards. This episode focuses on the importance of defining specific risks an organization wants to monitor, capturing relevant data creatively, and utilizing internal expertise to build effective data analytics programs. By starting small and focusing on one risk at a time, compliance officers can demonstrate their dedication to improving compliance despite limited resources. Additionally, a data-driven approach helps shift focus from individual policy violations to identifying systemic issues, enhancing overall organizational compliance. Key takeaways include understanding multiple factors in creating data-driven compliance programs, recognizing the value of shifting focus to systemic issues, and gradually building analytics capabilities. Key Highlights ·       Defining and Identifying Risks ·       Innovative Data Capture and Internal Collaboration ·       Demonstrating Value to Senior Management Resources Listeners to this podcast can receive a 20% discount to The Compliance Handbook, 5th edition by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2025, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance. 

In today's business environment, compliance professionals leverage data analytics to adhere to regulatory requirements and ethical standards. This episode focuses on the importance of defining specific risks an organization wants to monitor, capturing relevant data creatively, and utilizing internal expertise to build effective data analytics programs. By starting small and focusing on one risk at a time, compliance officers can demonstrate their dedication to improving compliance despite limited resources. Additionally, a data-driven approach helps shift focus from individual policy violations to identifying systemic issues, enhancing overall organizational compliance. Key takeaways include understanding multiple factors in creating data-driven compliance programs, recognizing the value of shifting focus to systemic issues, and gradually building analytics capabilities.

Key Highlights

·       Defining and Identifying Risks

·       Innovative Data Capture and Internal Collaboration

·       Demonstrating Value to Senior Management

Resources

Listeners to this podcast can receive a 20% discount to The Compliance Handbook, 5th edition by clicking here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 431 no Day 3- Key Updates in the ECCP: Messaging Apps, Internal Controls, and Compensation Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2025, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance.  In today's episode, we delve into the significant updates in the evaluation of corporate compliance programs, focusing on messaging apps, internal controls, and adequate compensation. The revised language in the ECCP highlights the DOJ's increased scrutiny on the use of messaging apps, emphasizing the need for tailored policies that align with a company's specific risks and business needs. We also discuss the critical importance of internal controls as minimum expectations set by the DOJ, and the necessity of continuous monitoring to manage these risks effectively. Lastly, we examine the newly added provisions related to adequate compensation, ensuring that compliance teams are empowered and protected against retaliation. The episode concludes by summarizing three key takeaways for compliance professionals: the growing importance of communications compliance, the need for robust and functional internal controls, and the imperative of adequately compensating compliance personnel.  Key Highlights ·       Messaging Apps and Compliance ·       Internal Controls and Risk Management ·       Adequate Compensation for Compliance Teams Resources Listeners to this podcast can receive a 20% discount to The Compliance Handbook, 5th edition by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 03 Jan 2025 06:00:00 -0000 Key Updates in the ECCP: Messaging Apps, Internal Controls, and Compensation bonus 5 3 Thomas Fox Today we consider updates on Messaging Apps, Internal Controls, and Compensation. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2025, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance.  In today's episode, we delve into the significant updates in the evaluation of corporate compliance programs, focusing on messaging apps, internal controls, and adequate compensation. The revised language in the ECCP highlights the DOJ's increased scrutiny on the use of messaging apps, emphasizing the need for tailored policies that align with a company's specific risks and business needs. We also discuss the critical importance of internal controls as minimum expectations set by the DOJ, and the necessity of continuous monitoring to manage these risks effectively. Lastly, we examine the newly added provisions related to adequate compensation, ensuring that compliance teams are empowered and protected against retaliation. The episode concludes by summarizing three key takeaways for compliance professionals: the growing importance of communications compliance, the need for robust and functional internal controls, and the imperative of adequately compensating compliance personnel.  Key Highlights ·       Messaging Apps and Compliance ·       Internal Controls and Risk Management ·       Adequate Compensation for Compliance Teams Resources Listeners to this podcast can receive a 20% discount to The Compliance Handbook, 5th edition by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2025, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance. 


In today's episode, we delve into the significant updates in the evaluation of corporate compliance programs, focusing on messaging apps, internal controls, and adequate compensation. The revised language in the ECCP highlights the DOJ's increased scrutiny on the use of messaging apps, emphasizing the need for tailored policies that align with a company's specific risks and business needs. We also discuss the critical importance of internal controls as minimum expectations set by the DOJ, and the necessity of continuous monitoring to manage these risks effectively. Lastly, we examine the newly added provisions related to adequate compensation, ensuring that compliance teams are empowered and protected against retaliation. The episode concludes by summarizing three key takeaways for compliance professionals: the growing importance of communications compliance, the need for robust and functional internal controls, and the imperative of adequately compensating compliance personnel. 


Key Highlights

·       Messaging Apps and Compliance

·       Internal Controls and Risk Management

·       Adequate Compensation for Compliance Teams


Resources

Listeners to this podcast can receive a 20% discount to The Compliance Handbook, 5th edition by clicking here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 434 no Day 2- 2024 ECCP on Incentives, Consequences, and Clawbacks Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2025, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance.  In this episode, we discuss how the Department of Justice (DOJ) has emphasized the importance of designing and implementing compliance-based compensation schemes. Financial incentives, such as deferred or escrowed compensation tied to conduct, play a critical role in fostering a culture of compliance. The episode also explores the necessary continuum of assessment, analysis, implementation, and monitoring that companies must follow for effective compliance incentive programs. Additionally, Tom covers the DOJ’s rigorous approach to consequence management, particularly concerning clawback provisions in executive contracts. The episode guides compliance professionals on the essential steps and analyses required to adhere to the enhanced DOJ expectations. Key takeaways include the importance of financial incentive analysis and the distinct yet related roles of clawbacks and consequence management within a compliance program. Key Highlights ·      Starting with Incentives and Consequences ·      Incentive Program Breakdown ·      Consequence Management Deep Dive Resources Listeners to this podcast can receive a 20% discount to The Compliance Handbook, 5th edition by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 02 Jan 2025 06:00:00 -0000 2024 ECCP on Incentives, Consequences, and Clawbacks bonus 5 2 Thomas Fox IN Day 2, the 2024 ECCP on Incentives, Consequences, and Clawbacks. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2025, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance.  In this episode, we discuss how the Department of Justice (DOJ) has emphasized the importance of designing and implementing compliance-based compensation schemes. Financial incentives, such as deferred or escrowed compensation tied to conduct, play a critical role in fostering a culture of compliance. The episode also explores the necessary continuum of assessment, analysis, implementation, and monitoring that companies must follow for effective compliance incentive programs. Additionally, Tom covers the DOJ’s rigorous approach to consequence management, particularly concerning clawback provisions in executive contracts. The episode guides compliance professionals on the essential steps and analyses required to adhere to the enhanced DOJ expectations. Key takeaways include the importance of financial incentive analysis and the distinct yet related roles of clawbacks and consequence management within a compliance program. Key Highlights ·      Starting with Incentives and Consequences ·      Incentive Program Breakdown ·      Consequence Management Deep Dive Resources Listeners to this podcast can receive a 20% discount to The Compliance Handbook, 5th edition by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2025, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance. 


In this episode, we discuss how the Department of Justice (DOJ) has emphasized the importance of designing and implementing compliance-based compensation schemes. Financial incentives, such as deferred or escrowed compensation tied to conduct, play a critical role in fostering a culture of compliance. The episode also explores the necessary continuum of assessment, analysis, implementation, and monitoring that companies must follow for effective compliance incentive programs. Additionally, Tom covers the DOJ’s rigorous approach to consequence management, particularly concerning clawback provisions in executive contracts. The episode guides compliance professionals on the essential steps and analyses required to adhere to the enhanced DOJ expectations. Key takeaways include the importance of financial incentive analysis and the distinct yet related roles of clawbacks and consequence management within a compliance program.

Key Highlights

·      Starting with Incentives and Consequences

·      Incentive Program Breakdown

·      Consequence Management Deep Dive


Resources

Listeners to this podcast can receive a 20% discount to The Compliance Handbook, 5th edition by clicking here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 486 no Day 1-Data Driven Compliance Day 1-Data-Driven Compliance Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2025, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance.  In the first episode of 'One Month to a More Effective Compliance Program', host Tom Fox, the Compliance Evangelist, emphasizes the increasing importance of data analytics and monitoring in the realm of compliance. Highlighting insights from the DOJ, this episode illustrates how data-driven compliance can significantly improve decision-making, business efficiency, and risk management. By leveraging technology and effective data analysis, companies can uncover hidden issues such as improper payments and improve overall corporate transparency. Tom Fox discusses the necessity for compliance programs to have quick and easy access to data to ensure informed decision-making and proactive compliance management. Key Highlights ·      Importance of Data Analytics in Compliance ·      Implementing Data-Driven Compliance ·      Challenges and Solutions in Data-Driven Compliance Resources Listeners to this podcast can receive a 20% discount to The Compliance Handbook, 5th edition by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 01 Jan 2025 23:14:00 -0000 Data Driven Compliance bonus 5 1 Thomas Fox We begin a one month series on 31 days to a more effective compliance program. Day 1-Data-Driven Compliance Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2025, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance.  In the first episode of 'One Month to a More Effective Compliance Program', host Tom Fox, the Compliance Evangelist, emphasizes the increasing importance of data analytics and monitoring in the realm of compliance. Highlighting insights from the DOJ, this episode illustrates how data-driven compliance can significantly improve decision-making, business efficiency, and risk management. By leveraging technology and effective data analysis, companies can uncover hidden issues such as improper payments and improve overall corporate transparency. Tom Fox discusses the necessity for compliance programs to have quick and easy access to data to ensure informed decision-making and proactive compliance management. Key Highlights ·      Importance of Data Analytics in Compliance ·      Implementing Data-Driven Compliance ·      Challenges and Solutions in Data-Driven Compliance Resources Listeners to this podcast can receive a 20% discount to The Compliance Handbook, 5th edition by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Day 1-Data-Driven Compliance


Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2025, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance. 


In the first episode of 'One Month to a More Effective Compliance Program', host Tom Fox, the Compliance Evangelist, emphasizes the increasing importance of data analytics and monitoring in the realm of compliance. Highlighting insights from the DOJ, this episode illustrates how data-driven compliance can significantly improve decision-making, business efficiency, and risk management. By leveraging technology and effective data analysis, companies can uncover hidden issues such as improper payments and improve overall corporate transparency. Tom Fox discusses the necessity for compliance programs to have quick and easy access to data to ensure informed decision-making and proactive compliance management.

Key Highlights

·      Importance of Data Analytics in Compliance

·      Implementing Data-Driven Compliance

·      Challenges and Solutions in Data-Driven Compliance


Resources

Listeners to this podcast can receive a 20% discount to The Compliance Handbook, 5th edition by clicking here. 




Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 340 no 31 Days to a More Effective Compliance Program: Day 31 - Using a Root Cause Analysis for Remediation The 2023 ECCP re-emphasized the need for both performing a root cause analysis but equally importantly using it to remediate your compliance program. It stated, “a hallmark of a compliance program that is working effectively in practice is the extent to which a company is able to conduct a thoughtful root cause analysis of misconduct and timely and appropriately remediate to address the root causes.” It went on to state, what additional steps the company has taken “that demonstrate recognition of the seriousness of the misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risk.”  When you step back and consider what the DOJ was trying to accomplish with its 2023 ECCP, it becomes clear what the DOJ expects from the compliance professional. Consider the structure of your compliance program and how it inter-relates to your company’s risk profile. When you have a compliance failure, use the root cause analysis to think about how each of the structural elements of your compliance program could impact how you manage and deal with that risk.  Three key takeaways: 1. The key to using a root cause analysis is objectivity and independence. 2. The critical element is how did you use the information you developed in the root cause analysis? 3. The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 31 Jan 2024 05:00:00 -0000 Day 31 - Using a Root Cause Analysis for Remediation full 31 Thomas Fox How can you utilize a root cause analysis for remediation? The 2023 ECCP re-emphasized the need for both performing a root cause analysis but equally importantly using it to remediate your compliance program. It stated, “a hallmark of a compliance program that is working effectively in practice is the extent to which a company is able to conduct a thoughtful root cause analysis of misconduct and timely and appropriately remediate to address the root causes.” It went on to state, what additional steps the company has taken “that demonstrate recognition of the seriousness of the misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risk.”  When you step back and consider what the DOJ was trying to accomplish with its 2023 ECCP, it becomes clear what the DOJ expects from the compliance professional. Consider the structure of your compliance program and how it inter-relates to your company’s risk profile. When you have a compliance failure, use the root cause analysis to think about how each of the structural elements of your compliance program could impact how you manage and deal with that risk.  Three key takeaways: 1. The key to using a root cause analysis is objectivity and independence. 2. The critical element is how did you use the information you developed in the root cause analysis? 3. The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2023 ECCP re-emphasized the need for both performing a root cause analysis but equally importantly using it to remediate your compliance program. It stated, “a hallmark of a compliance program that is working effectively in practice is the extent to which a company is able to conduct a thoughtful root cause analysis of misconduct and timely and appropriately remediate to address the root causes.” It went on to state, what additional steps the company has taken “that demonstrate recognition of the seriousness of the misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risk.” 

When you step back and consider what the DOJ was trying to accomplish with its 2023 ECCP, it becomes clear what the DOJ expects from the compliance professional. Consider the structure of your compliance program and how it inter-relates to your company’s risk profile. When you have a compliance failure, use the root cause analysis to think about how each of the structural elements of your compliance program could impact how you manage and deal with that risk.

 Three key takeaways:

1. The key to using a root cause analysis is objectivity and independence.

2. The critical element is how did you use the information you developed in the root cause analysis?

3. The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 488 no 31 Days to a More Effective Compliance Program: Day 30 - The Foreign Extortion Prevention Act The compliance community has long recognized the gaping hole in the FCPA. As a supply-side law, it criminalizes the payment of bribes, not the demand to pay a bribe or extortion. The gap was recently filled by the Foreign Extortion Prevention Act (FEPA), which extended crucial protections to Americans working abroad and provided the DOJ with a potent new tool. By criminalizing both the giving and demanding of foreign bribes, FEPA seeks to level the playing field for American workers while fostering ethical business practices globally. FEPA represents a promising solution to protect Americans working overseas, promote fair business competition, and combat corruption on a global scale. With its potential to bring about meaningful change, FEPA is a vital step in safeguarding American values and interests in the international arena. Sam Rubenfeld, cited Scott Greytak, the director of advocacy for Transparency International US, for the following: “FEPA is a landmark, bipartisan law that holds the potential to help root out foreign corruption at its source. It is arguably the most sweeping and consequential foreign bribery law in nearly half a century.” Three key takeaways: 1. FEPA changes the game for ABC. 2. Make sure your policies and procedures capture any extortion attempts made illegal under FEPA. 3. Determine your external reporting for FEPA violations. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 30 Jan 2024 05:00:00 -0000 Day 30 - The Foreign Extortion Prevention Act full 30 Thomas Fox What is FEPA? The compliance community has long recognized the gaping hole in the FCPA. As a supply-side law, it criminalizes the payment of bribes, not the demand to pay a bribe or extortion. The gap was recently filled by the Foreign Extortion Prevention Act (FEPA), which extended crucial protections to Americans working abroad and provided the DOJ with a potent new tool. By criminalizing both the giving and demanding of foreign bribes, FEPA seeks to level the playing field for American workers while fostering ethical business practices globally. FEPA represents a promising solution to protect Americans working overseas, promote fair business competition, and combat corruption on a global scale. With its potential to bring about meaningful change, FEPA is a vital step in safeguarding American values and interests in the international arena. Sam Rubenfeld, cited Scott Greytak, the director of advocacy for Transparency International US, for the following: “FEPA is a landmark, bipartisan law that holds the potential to help root out foreign corruption at its source. It is arguably the most sweeping and consequential foreign bribery law in nearly half a century.” Three key takeaways: 1. FEPA changes the game for ABC. 2. Make sure your policies and procedures capture any extortion attempts made illegal under FEPA. 3. Determine your external reporting for FEPA violations. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices The compliance community has long recognized the gaping hole in the FCPA. As a supply-side law, it criminalizes the payment of bribes, not the demand to pay a bribe or extortion. The gap was recently filled by the Foreign Extortion Prevention Act (FEPA), which extended crucial protections to Americans working abroad and provided the DOJ with a potent new tool. By criminalizing both the giving and demanding of foreign bribes, FEPA seeks to level the playing field for American workers while fostering ethical business practices globally. FEPA represents a promising solution to protect Americans working overseas, promote fair business competition, and combat corruption on a global scale. With its potential to bring about meaningful change, FEPA is a vital step in safeguarding American values and interests in the international arena.

Sam Rubenfeld, cited Scott Greytak, the director of advocacy for Transparency International US, for the following: “FEPA is a landmark, bipartisan law that holds the potential to help root out foreign corruption at its source. It is arguably the most sweeping and consequential foreign bribery law in nearly half a century.”


Three key takeaways:

1. FEPA changes the game for ABC.

2. Make sure your policies and procedures capture any extortion attempts made illegal under FEPA.

3. Determine your external reporting for FEPA violations.

For more information on Ethico and a free White Paper on top compliance issues in 2024, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 488 no 31 Days to a More Effective Compliance Program: Day 29 -Strategic Considerations for Implementing AI in Compliance Implementing AI in compliance requires strategic considerations and decision-making. Understanding the impact of AI, maintaining an inventory of tools, considering cost efficiency and risk avoidance, involving all business sectors, and utilizing AI for better data usage are key factors to consider. Balancing exploration and rules, as well as selecting the right AI tools, are challenges that need to be addressed. By carefully navigating these considerations and challenges, companies can leverage AI to enhance their compliance programs and stay ahead in an ever-evolving regulatory landscape.  Three key takeaways:  1. What are the key factors that impact these strategic considerations for implementing AI in compliance? 2. Compliance professionals need to stay updated with the latest AI developments and trends, which requires continuous learning and keeping abreast of industry news and insights. 3. Understanding the impact of AI, maintaining an inventory of tools, considering cost efficiency and risk avoidance, involving all business sectors, and utilizing AI for better data usage are key factors to consider. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 29 Jan 2024 05:00:00 -0000 Day 29 -Strategic Considerations for Implementing AI in Compliance full 29 Thomas Fox What should you think through for implementing AI into your compliance regime? Implementing AI in compliance requires strategic considerations and decision-making. Understanding the impact of AI, maintaining an inventory of tools, considering cost efficiency and risk avoidance, involving all business sectors, and utilizing AI for better data usage are key factors to consider. Balancing exploration and rules, as well as selecting the right AI tools, are challenges that need to be addressed. By carefully navigating these considerations and challenges, companies can leverage AI to enhance their compliance programs and stay ahead in an ever-evolving regulatory landscape.  Three key takeaways:  1. What are the key factors that impact these strategic considerations for implementing AI in compliance? 2. Compliance professionals need to stay updated with the latest AI developments and trends, which requires continuous learning and keeping abreast of industry news and insights. 3. Understanding the impact of AI, maintaining an inventory of tools, considering cost efficiency and risk avoidance, involving all business sectors, and utilizing AI for better data usage are key factors to consider. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Implementing AI in compliance requires strategic considerations and decision-making. Understanding the impact of AI, maintaining an inventory of tools, considering cost efficiency and risk avoidance, involving all business sectors, and utilizing AI for better data usage are key factors to consider. Balancing exploration and rules, as well as selecting the right AI tools, are challenges that need to be addressed. By carefully navigating these considerations and challenges, companies can leverage AI to enhance their compliance programs and stay ahead in an ever-evolving regulatory landscape.

 Three key takeaways: 

1. What are the key factors that impact these strategic considerations for implementing AI in compliance?

2. Compliance professionals need to stay updated with the latest AI developments and trends, which requires continuous learning and keeping abreast of industry news and insights.

3. Understanding the impact of AI, maintaining an inventory of tools, considering cost efficiency and risk avoidance, involving all business sectors, and utilizing AI for better data usage are key factors to consider.

For more information on Ethico and a free White Paper on top compliance issues in 2024, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 488 no 31 Days to a More Effective Compliance Program - Day 28 - Data-Driven Compliance – From Cutting Edge to Table Stakes Compliance programs play a crucial role in ensuring that companies adhere to legal and ethical standards. In today’s digital age, where data is abundant and easily accessible, the importance of data-driven compliance programs cannot be overstated. This message was driven home very forcefully in a speech in November by Nicole Argentieri, acting assistant attorney general for the Criminal Division. She stated, “I’d like to now turn to our use of data. In the Criminal Division, we too are going above and beyond in our effort to combat white collar crime. We are not just waiting for companies to self-report, or witnesses to come forward, or for anomalies to reveal themselves on a one-off basis. Let me be the first to tell you that we have proactively used data to generate FCPA cases, and we’ve only just gotten started.” Data-driven compliance programs have moved from cutting edge and are now seen as best practices. Soon, they will simply be table stakes for companies to effectively manage compliance risks. By actively monitoring and analyzing data, companies can identify potential compliance issues, mitigate risks, and maintain their reputation and integrity. Collaboration between different departments and a formal risk assessment are key factors in establishing a robust compliance program. As technology continues to advance, the role of data analytics and AI in compliance monitoring is expected to become even more significant. It is crucial for compliance professionals to stay informed, continuously learn, and adapt to the evolving landscape of data-driven compliance. Three key takeaways: 1. Nicole Argentieri, acting assistant attorney general for the Criminal Division, said, “Let me be the first to tell you that we have proactively used data to generate FCPA cases, and we’ve only just gotten started.” 2. . Compliance professionals must actively analyze the data for trends, anomalies, and potential compliance risks. 3. Data-driven compliance programs have moved from cutting edge and are now seen as best practices. Soon, they will simply be table stakes for companies to effectively manage compliance risks. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 28 Jan 2024 05:00:00 -0000 Day 28 - Data-Driven Compliance – From Cutting Edge to Table Stakes full 28 Thomas Fox How data analytics has evolved for compliance. Compliance programs play a crucial role in ensuring that companies adhere to legal and ethical standards. In today’s digital age, where data is abundant and easily accessible, the importance of data-driven compliance programs cannot be overstated. This message was driven home very forcefully in a speech in November by Nicole Argentieri, acting assistant attorney general for the Criminal Division. She stated, “I’d like to now turn to our use of data. In the Criminal Division, we too are going above and beyond in our effort to combat white collar crime. We are not just waiting for companies to self-report, or witnesses to come forward, or for anomalies to reveal themselves on a one-off basis. Let me be the first to tell you that we have proactively used data to generate FCPA cases, and we’ve only just gotten started.” Data-driven compliance programs have moved from cutting edge and are now seen as best practices. Soon, they will simply be table stakes for companies to effectively manage compliance risks. By actively monitoring and analyzing data, companies can identify potential compliance issues, mitigate risks, and maintain their reputation and integrity. Collaboration between different departments and a formal risk assessment are key factors in establishing a robust compliance program. As technology continues to advance, the role of data analytics and AI in compliance monitoring is expected to become even more significant. It is crucial for compliance professionals to stay informed, continuously learn, and adapt to the evolving landscape of data-driven compliance. Three key takeaways: 1. Nicole Argentieri, acting assistant attorney general for the Criminal Division, said, “Let me be the first to tell you that we have proactively used data to generate FCPA cases, and we’ve only just gotten started.” 2. . Compliance professionals must actively analyze the data for trends, anomalies, and potential compliance risks. 3. Data-driven compliance programs have moved from cutting edge and are now seen as best practices. Soon, they will simply be table stakes for companies to effectively manage compliance risks. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Compliance programs play a crucial role in ensuring that companies adhere to legal and ethical standards. In today’s digital age, where data is abundant and easily accessible, the importance of data-driven compliance programs cannot be overstated. This message was driven home very forcefully in a speech in November by Nicole Argentieri, acting assistant attorney general for the Criminal Division. She stated, “I’d like to now turn to our use of data. In the Criminal Division, we too are going above and beyond in our effort to combat white collar crime. We are not just waiting for companies to self-report, or witnesses to come forward, or for anomalies to reveal themselves on a one-off basis. Let me be the first to tell you that we have proactively used data to generate FCPA cases, and we’ve only just gotten started.”

Data-driven compliance programs have moved from cutting edge and are now seen as best practices. Soon, they will simply be table stakes for companies to effectively manage compliance risks. By actively monitoring and analyzing data, companies can identify potential compliance issues, mitigate risks, and maintain their reputation and integrity. Collaboration between different departments and a formal risk assessment are key factors in establishing a robust compliance program. As technology continues to advance, the role of data analytics and AI in compliance monitoring is expected to become even more significant. It is crucial for compliance professionals to stay informed, continuously learn, and adapt to the evolving landscape of data-driven compliance.


Three key takeaways:

1. Nicole Argentieri, acting assistant attorney general for the Criminal Division, said, “Let me be the first to tell you that we have proactively used data to generate FCPA cases, and we’ve only just gotten started.”

2. . Compliance professionals must actively analyze the data for trends, anomalies, and potential compliance risks.

3. Data-driven compliance programs have moved from cutting edge and are now seen as best practices. Soon, they will simply be table stakes for companies to effectively manage compliance risks.

For more information on Ethico and a free White Paper on top compliance issues in 2024, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 488 no 31 Days to a More Effective Compliance Program - Day 27 - Compliance Function in an Organization The role of the compliance professional and the compliance function in a corporation has steadily grown in stature and prestige over the years. When it came to the corporate compliance function, 2020 FCPA Resource Guide, 2nd edition, under the Hallmarks of an Effective Compliance Program, simply noted the government would “consider whether the company devoted adequate staffing and resources to the compliance program given the size, structure, and risk profile of the business.” This Hallmark was significantly expanded in both the original FCPA Corporate Enforcement Policy and 2023 ECCP. In the FCPA Corporate Enforcement Policy, the DOJ listed the following as factors relating to a corporate compliance function, that it would consider as indicia of an effective compliance and ethics program: 1) the resources the company has dedicated to compliance; 2) the quality and experience of the personnel involved in compliance, such that they can understand and identify the transactions and activities that pose a potential risk; 3) the authority and independence of the compliance function and the availability of compliance expertise to the board; 4) the compensation and promotion of the personnel involved in compliance, in view of their role, responsibilities, performance, and other appropriate factors; and 5) the reporting structure of any compliance personnel employed or contracted by the company. The 2023 ECCP and 2023 Update to the FCPA Corporate Enforcement Policy both demonstrate the continued evolution in the thinking of the DOJ around the corporate compliance function. Their articulated inquiries can only strengthen a corporate compliance function specifically; and the compliance profession more generally. The more the DOJ talks about the independence of the compliance function, coupled with resources being made available and authority concomitant with the corporate compliance function, the more corporations will see it is directly in their interest to provide the resources, authority and gravitas to compliance position in their organizations.  Three key takeaways: 1. How is compliance treated in the budget process? 2. Has your compliance function had any decisions over-ridden by senior management? 3. Beware outsourcing of compliance as any such contractor must have access to company documents and personnel. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 27 Jan 2024 05:00:00 -0000 Day 27 - Compliance Function in an Organization full 27 Thomas Fox Where and how does a compliance function sit in an organization. The role of the compliance professional and the compliance function in a corporation has steadily grown in stature and prestige over the years. When it came to the corporate compliance function, 2020 FCPA Resource Guide, 2nd edition, under the Hallmarks of an Effective Compliance Program, simply noted the government would “consider whether the company devoted adequate staffing and resources to the compliance program given the size, structure, and risk profile of the business.” This Hallmark was significantly expanded in both the original FCPA Corporate Enforcement Policy and 2023 ECCP. In the FCPA Corporate Enforcement Policy, the DOJ listed the following as factors relating to a corporate compliance function, that it would consider as indicia of an effective compliance and ethics program: 1) the resources the company has dedicated to compliance; 2) the quality and experience of the personnel involved in compliance, such that they can understand and identify the transactions and activities that pose a potential risk; 3) the authority and independence of the compliance function and the availability of compliance expertise to the board; 4) the compensation and promotion of the personnel involved in compliance, in view of their role, responsibilities, performance, and other appropriate factors; and 5) the reporting structure of any compliance personnel employed or contracted by the company. The 2023 ECCP and 2023 Update to the FCPA Corporate Enforcement Policy both demonstrate the continued evolution in the thinking of the DOJ around the corporate compliance function. Their articulated inquiries can only strengthen a corporate compliance function specifically; and the compliance profession more generally. The more the DOJ talks about the independence of the compliance function, coupled with resources being made available and authority concomitant with the corporate compliance function, the more corporations will see it is directly in their interest to provide the resources, authority and gravitas to compliance position in their organizations.  Three key takeaways: 1. How is compliance treated in the budget process? 2. Has your compliance function had any decisions over-ridden by senior management? 3. Beware outsourcing of compliance as any such contractor must have access to company documents and personnel. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices The role of the compliance professional and the compliance function in a corporation has steadily grown in stature and prestige over the years. When it came to the corporate compliance function, 2020 FCPA Resource Guide, 2nd edition, under the Hallmarks of an Effective Compliance Program, simply noted the government would “consider whether the company devoted adequate staffing and resources to the compliance program given the size, structure, and risk profile of the business.”

This Hallmark was significantly expanded in both the original FCPA Corporate Enforcement Policy and 2023 ECCP. In the FCPA Corporate Enforcement Policy, the DOJ listed the following as factors relating to a corporate compliance function, that it would consider as indicia of an effective compliance and ethics program: 1) the resources the company has dedicated to compliance; 2) the quality and experience of the personnel involved in compliance, such that they can understand and identify the transactions and activities that pose a potential risk; 3) the authority and independence of the compliance function and the availability of compliance expertise to the board; 4) the compensation and promotion of the personnel involved in compliance, in view of their role, responsibilities, performance, and other appropriate factors; and 5) the reporting structure of any compliance personnel employed or contracted by the company.

The 2023 ECCP and 2023 Update to the FCPA Corporate Enforcement Policy both demonstrate the continued evolution in the thinking of the DOJ around the corporate compliance function. Their articulated inquiries can only strengthen a corporate compliance function specifically; and the compliance profession more generally. The more the DOJ talks about the independence of the compliance function, coupled with resources being made available and authority concomitant with the corporate compliance function, the more corporations will see it is directly in their interest to provide the resources, authority and gravitas to compliance position in their organizations.

 Three key takeaways:

1. How is compliance treated in the budget process?

2. Has your compliance function had any decisions over-ridden by senior management?

3. Beware outsourcing of compliance as any such contractor must have access to company documents and personnel.

For more information on Ethico and a free White Paper on top compliance issues in 2024, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 488 no 31 Days to a More Effective Compliance Program - Day 26 - CCO Authority and Independence The role of the CCO has steadily grown in stature and prestige over the years. In the 2020 FCPA Resource Guide, 2nd edition, under the Hallmarks of an Effective Compliance Program, it focused on whether the CCO held senior management status and had a direct reporting line to the Board. In the 2023 Update to the FCPA Corporate Enforcement Policy, the DOJ lists these factors as follows: 1) The quality and experience of the CCO, such that they can understand and identify the transactions and activities that pose a potential risk; 2) The authority and independence of the CCO; 3) The compensation and promotion of the CCO, in view of their role, responsibilities, performance, and other appropriate factors; and 4) The reporting structure of any CCO employed or contracted by the company. All of these factors are enhanced by the CCO Certification requirement, as announced by Kenneth Polite back in 2022. A CCO must certify the effectiveness of a compliance program after a DPA or NPA has been concluded. This requirement will only become more important moving into 2023 and beyond. In addition to CCO Certification, the Delaware Court of Chancery’s decision in the case of McDonald’s Corporation and its former Executive Vice President and Global Chief People Officer of McDonald’s Corporation, David Fairhurst, formally recognized the oversight duties of officers of Delaware corporations for the first time. Three key takeaways: 1. How can you show the CCO really has a seat at the senior executive table? 2. What are the professional qualifications of your CCO? 3. Delaware says the CCO is Number 2 in an organization, behind the CEO. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 26 Jan 2024 05:00:00 -0000 Day 26 - CCO Authority and Independence full 26 Thomas Fox How do you show CCO authority and independence. The role of the CCO has steadily grown in stature and prestige over the years. In the 2020 FCPA Resource Guide, 2nd edition, under the Hallmarks of an Effective Compliance Program, it focused on whether the CCO held senior management status and had a direct reporting line to the Board. In the 2023 Update to the FCPA Corporate Enforcement Policy, the DOJ lists these factors as follows: 1) The quality and experience of the CCO, such that they can understand and identify the transactions and activities that pose a potential risk; 2) The authority and independence of the CCO; 3) The compensation and promotion of the CCO, in view of their role, responsibilities, performance, and other appropriate factors; and 4) The reporting structure of any CCO employed or contracted by the company. All of these factors are enhanced by the CCO Certification requirement, as announced by Kenneth Polite back in 2022. A CCO must certify the effectiveness of a compliance program after a DPA or NPA has been concluded. This requirement will only become more important moving into 2023 and beyond. In addition to CCO Certification, the Delaware Court of Chancery’s decision in the case of McDonald’s Corporation and its former Executive Vice President and Global Chief People Officer of McDonald’s Corporation, David Fairhurst, formally recognized the oversight duties of officers of Delaware corporations for the first time. Three key takeaways: 1. How can you show the CCO really has a seat at the senior executive table? 2. What are the professional qualifications of your CCO? 3. Delaware says the CCO is Number 2 in an organization, behind the CEO. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices The role of the CCO has steadily grown in stature and prestige over the years. In the 2020 FCPA Resource Guide, 2nd edition, under the Hallmarks of an Effective Compliance Program, it focused on whether the CCO held senior management status and had a direct reporting line to the Board.

In the 2023 Update to the FCPA Corporate Enforcement Policy, the DOJ lists these factors as follows:

1) The quality and experience of the CCO, such that they can understand and identify the transactions and activities that pose a potential risk; 2) The authority and independence of the CCO; 3) The compensation and promotion of the CCO, in view of their role, responsibilities, performance, and other appropriate factors; and 4) The reporting structure of any CCO employed or contracted by the company.

All of these factors are enhanced by the CCO Certification requirement, as announced by Kenneth Polite back in 2022. A CCO must certify the effectiveness of a compliance program after a DPA or NPA has been concluded. This requirement will only become more important moving into 2023 and beyond. In addition to CCO Certification, the Delaware Court of Chancery’s decision in the case of McDonald’s Corporation and its former Executive Vice President and Global Chief People Officer of McDonald’s Corporation, David Fairhurst, formally recognized the oversight duties of officers of Delaware corporations for the first time.

Three key takeaways:

1. How can you show the CCO really has a seat at the senior executive table?

2. What are the professional qualifications of your CCO?

3. Delaware says the CCO is Number 2 in an organization, behind the CEO.

For more information on Ethico and a free White Paper on top compliance issues in 2024, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 488 no 31 Days to a More Effective Compliance Program: Day 25 – Responding to Investigative Findings There is nothing like an internal whistleblower report about a compliance violation, the finding of such an issue, or (even worse) a subpoena from the DOJ or notice letter from the SEC to trigger the attention of the Board of Directors and senior management to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage, followed immediately by the proclamation, “We are an ethical company.” However, it may well be the time for a very serious reality check. You may find yourself in a position where you will have to have some very frank discussions about what to expect in terms of costs and time outlays. While much of these discussions will focus on the investigative process and those costs, these discussions will allow you to initiate the talk about remediation going forward and begin to explain why money must be budgeted for the remediation process. Finally, there should be a solid line of communication between the people who are doing the investigation and the people who are leading the remediation. Otherwise, you can only begin your remediation in the most general terms and you will not be able to deal with specific gaps in your compliance program or risks that need to be managed. Such an approach can also be a recipe for disaster. First and foremost, the DOJ will not give you credit and you may lose the types of benefits articulated in the FCPA Corporate Enforcement Policy. Moreover, the executive attention will have dissipated and you will have lost your momentum to clean things up through a thorough remediation. Three key takeaways: 1. A serious FCPA allegation gets the attention of the Board and senior management. Use this time to move the compliance program forward. 2. Be aware of how your investigation can impact and even inform your remediation efforts. 3. Be prepared to deal with the dreaded “where else” question. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 25 Jan 2024 05:00:00 -0000 Day 25 - Responding to Investigative Findings full 25 Thomas Fox How should you respond to investigative findings? There is nothing like an internal whistleblower report about a compliance violation, the finding of such an issue, or (even worse) a subpoena from the DOJ or notice letter from the SEC to trigger the attention of the Board of Directors and senior management to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage, followed immediately by the proclamation, “We are an ethical company.” However, it may well be the time for a very serious reality check. You may find yourself in a position where you will have to have some very frank discussions about what to expect in terms of costs and time outlays. While much of these discussions will focus on the investigative process and those costs, these discussions will allow you to initiate the talk about remediation going forward and begin to explain why money must be budgeted for the remediation process. Finally, there should be a solid line of communication between the people who are doing the investigation and the people who are leading the remediation. Otherwise, you can only begin your remediation in the most general terms and you will not be able to deal with specific gaps in your compliance program or risks that need to be managed. Such an approach can also be a recipe for disaster. First and foremost, the DOJ will not give you credit and you may lose the types of benefits articulated in the FCPA Corporate Enforcement Policy. Moreover, the executive attention will have dissipated and you will have lost your momentum to clean things up through a thorough remediation. Three key takeaways: 1. A serious FCPA allegation gets the attention of the Board and senior management. Use this time to move the compliance program forward. 2. Be aware of how your investigation can impact and even inform your remediation efforts. 3. Be prepared to deal with the dreaded “where else” question. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices There is nothing like an internal whistleblower report about a compliance violation, the finding of such an issue, or (even worse) a subpoena from the DOJ or notice letter from the SEC to trigger the attention of the Board of Directors and senior management to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage, followed immediately by the proclamation, “We are an ethical company.” However, it may well be the time for a very serious reality check.

You may find yourself in a position where you will have to have some very frank discussions about what to expect in terms of costs and time outlays. While much of these discussions will focus on the investigative process and those costs, these discussions will allow you to initiate the talk about remediation going forward and begin to explain why money must be budgeted for the remediation process.

Finally, there should be a solid line of communication between the people who are doing the investigation and the people who are leading the remediation. Otherwise, you can only begin your remediation in the most general terms and you will not be able to deal with specific gaps in your compliance program or risks that need to be managed. Such an approach can also be a recipe for disaster. First and foremost, the DOJ will not give you credit and you may lose the types of benefits articulated in the FCPA Corporate Enforcement Policy. Moreover, the executive attention will have dissipated and you will have lost your momentum to clean things up through a thorough remediation.

Three key takeaways:

1. A serious FCPA allegation gets the attention of the Board and senior management. Use this time to move the compliance program forward.

2. Be aware of how your investigation can impact and even inform your remediation efforts.

3. Be prepared to deal with the dreaded “where else” question.

For more information on Ethico and a free White Paper on top compliance issues in 2024, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 488 no 31 Days to a More Effective Compliance Program: Day 24 - Internal Reporting and Triaging of Claims The call, email, or tip comes into your office; an employee reports suspicious activity somewhere across the globe. That activity might well turn into an FCPA issue for your company. As the CCO, it will be up to you to begin the process, which will determine, in many instances, how the company will respond going forward. This system has become even more important after the 2022 announcement of the Monaco Memo. Further, as the 2022 ABB FCPA resolution made clear, self-disclosing to the DOJ is the vital first step for all discounts under the Corporate Enforcement Policy to begin. This scenario was driven home by the WPP Foreign Corrupt Practices enforcement action in 2021. Here, a whistleblower reported internally on allegations of bribery and corruption in the company’s India subsidiary. WPP turned over the investigation to an inexperienced accounting firm in India and then allowed the investigation to be controlled by the business unit management that was engaging in the bribery and corruption. The result, unsurprisingly, was no adverse findings. However, the whistleblower did not stop there and reported six more times (seven total) with an increasing amount of documentary support. Finally, the company took the allegations seriously and commissioned an internal investigation. Three key takeaways: 1. The DOJ and SEC put special emphasis on internal reporting lines. 2. Test your hotline on a regular basis to make sure it is working. 3. Every claim should be triaged before starting an investigation. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 24 Jan 2024 05:00:00 -0000 Day 24 - Internal Reporting and Triaging of Claims full 24 Thomas Fox Today we consider internal reporting and triaging of claims. The call, email, or tip comes into your office; an employee reports suspicious activity somewhere across the globe. That activity might well turn into an FCPA issue for your company. As the CCO, it will be up to you to begin the process, which will determine, in many instances, how the company will respond going forward. This system has become even more important after the 2022 announcement of the Monaco Memo. Further, as the 2022 ABB FCPA resolution made clear, self-disclosing to the DOJ is the vital first step for all discounts under the Corporate Enforcement Policy to begin. This scenario was driven home by the WPP Foreign Corrupt Practices enforcement action in 2021. Here, a whistleblower reported internally on allegations of bribery and corruption in the company’s India subsidiary. WPP turned over the investigation to an inexperienced accounting firm in India and then allowed the investigation to be controlled by the business unit management that was engaging in the bribery and corruption. The result, unsurprisingly, was no adverse findings. However, the whistleblower did not stop there and reported six more times (seven total) with an increasing amount of documentary support. Finally, the company took the allegations seriously and commissioned an internal investigation. Three key takeaways: 1. The DOJ and SEC put special emphasis on internal reporting lines. 2. Test your hotline on a regular basis to make sure it is working. 3. Every claim should be triaged before starting an investigation. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices The call, email, or tip comes into your office; an employee reports suspicious activity somewhere across the globe. That activity might well turn into an FCPA issue for your company. As the CCO, it will be up to you to begin the process, which will determine, in many instances, how the company will respond going forward. This system has become even more important after the 2022 announcement of the Monaco Memo. Further, as the 2022 ABB FCPA resolution made clear, self-disclosing to the DOJ is the vital first step for all discounts under the Corporate Enforcement Policy to begin.

This scenario was driven home by the WPP Foreign Corrupt Practices enforcement action in 2021. Here, a whistleblower reported internally on allegations of bribery and corruption in the company’s India subsidiary. WPP turned over the investigation to an inexperienced accounting firm in India and then allowed the investigation to be controlled by the business unit management that was engaging in the bribery and corruption. The result, unsurprisingly, was no adverse findings. However, the whistleblower did not stop there and reported six more times (seven total) with an increasing amount of documentary support. Finally, the company took the allegations seriously and commissioned an internal investigation.

Three key takeaways:

1. The DOJ and SEC put special emphasis on internal reporting lines.

2. Test your hotline on a regular basis to make sure it is working.

3. Every claim should be triaged before starting an investigation.

For more information on Ethico and a free White Paper on top compliance issues in 2024, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 488 no 31 Days to a More Effective Compliance Program: Day 23 – The Investigation Protocol Your company should have a detailed written procedure for handling any complaint or allegation of bribery or corruption, regardless of the means through which it is communicated. The mechanism could include the internal company hotline, anonymous tips, or a report directly from the business unit involved. You can make the decision on whether or not to investigate with consultation with other groups, such as the Audit Committee of the Board of Directors or the Legal Department. The head of the business unit in which the claim arose may also be notified that an allegation has been made and that the Compliance Department will be handling the matter on a go-forward basis. Through the use of such a detailed written procedure, you can work to ensure there is complete transparency on the rights and obligations of all parties once an allegation is made. This allows the compliance team to have not only the flexibility but also the responsibility to deal with such matters, from which it can best assess and then decide on how to manage the matter. Indeed, there are a variety of factors around giving credit to corporate investigations, including: Did management, the board, or committees consisting solely of outside directors oversee the review? Did company employees or outside parties perform the review? If outside persons, have they done other work for the company? If the review was conducted by outside counsel, had management previously engaged such counsel? How long ago was the firm’s last representation of the company? How often has the law firm represented the company? How much in legal fees has the company paid the firm?  Three key takeaways: 1. A written protocol, created before an investigation, is a key starting point. 2. Create specific steps to follow so there will be full transparency and documentation going forward. 3. Consistency in approach is critical. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 23 Jan 2024 05:00:00 -0000 Day 23 - The Investigation Protocol full 23 Thomas Fox What is your investigation protocol? Your company should have a detailed written procedure for handling any complaint or allegation of bribery or corruption, regardless of the means through which it is communicated. The mechanism could include the internal company hotline, anonymous tips, or a report directly from the business unit involved. You can make the decision on whether or not to investigate with consultation with other groups, such as the Audit Committee of the Board of Directors or the Legal Department. The head of the business unit in which the claim arose may also be notified that an allegation has been made and that the Compliance Department will be handling the matter on a go-forward basis. Through the use of such a detailed written procedure, you can work to ensure there is complete transparency on the rights and obligations of all parties once an allegation is made. This allows the compliance team to have not only the flexibility but also the responsibility to deal with such matters, from which it can best assess and then decide on how to manage the matter. Indeed, there are a variety of factors around giving credit to corporate investigations, including: Did management, the board, or committees consisting solely of outside directors oversee the review? Did company employees or outside parties perform the review? If outside persons, have they done other work for the company? If the review was conducted by outside counsel, had management previously engaged such counsel? How long ago was the firm’s last representation of the company? How often has the law firm represented the company? How much in legal fees has the company paid the firm?  Three key takeaways: 1. A written protocol, created before an investigation, is a key starting point. 2. Create specific steps to follow so there will be full transparency and documentation going forward. 3. Consistency in approach is critical. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Your company should have a detailed written procedure for handling any complaint or allegation of bribery or corruption, regardless of the means through which it is communicated. The mechanism could include the internal company hotline, anonymous tips, or a report directly from the business unit involved. You can make the decision on whether or not to investigate with consultation with other groups, such as the Audit Committee of the Board of Directors or the Legal Department. The head of the business unit in which the claim arose may also be notified that an allegation has been made and that the Compliance Department will be handling the matter on a go-forward basis. Through the use of such a detailed written procedure, you can work to ensure there is complete transparency on the rights and obligations of all parties once an allegation is made. This allows the compliance team to have not only the flexibility but also the responsibility to deal with such matters, from which it can best assess and then decide on how to manage the matter.

Indeed, there are a variety of factors around giving credit to corporate investigations, including: Did management, the board, or committees consisting solely of outside directors oversee the review? Did company employees or outside parties perform the review? If outside persons, have they done other work for the company? If the review was conducted by outside counsel, had management previously engaged such counsel? How long ago was the firm’s last representation of the company? How often has the law firm represented the company? How much in legal fees has the company paid the firm?


 Three key takeaways:

1. A written protocol, created before an investigation, is a key starting point.

2. Create specific steps to follow so there will be full transparency and documentation going forward.

3. Consistency in approach is critical.

For more information on Ethico and a free White Paper on top compliance issues in 2024, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 491 no 31 Days to a More Effective Compliance Program - Day 22 - Levels of Due Diligence Due diligence is generally recognized in three levels: Level I, Level II and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward. The 2023 ECCP stated, “A well-designed compliance program should apply risk-based due diligence to its third-party relationships. Although the need for, and degree of, appropriate due diligence may vary based on the size and nature of the company, transaction, and third party, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.” The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward. There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions into your program. The Level I, II and III trichotomy appears to have the greatest favor and one that you should be able to implement in a straightforward manner. But the key is that you must assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence. Three key takeaways: 1. A Level I due diligence should only be used when there is a low risk of corruption. 2. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared. 3. Level III due diligence is a deep-dive, boots-on-the-ground investigation. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 22 Jan 2024 12:14:00 -0000 Day 22 - Levels of Due Diligence full 22 Thomas Fox Today we consider the levels of due diligence. Due diligence is generally recognized in three levels: Level I, Level II and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward. The 2023 ECCP stated, “A well-designed compliance program should apply risk-based due diligence to its third-party relationships. Although the need for, and degree of, appropriate due diligence may vary based on the size and nature of the company, transaction, and third party, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.” The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward. There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions into your program. The Level I, II and III trichotomy appears to have the greatest favor and one that you should be able to implement in a straightforward manner. But the key is that you must assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence. Three key takeaways: 1. A Level I due diligence should only be used when there is a low risk of corruption. 2. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared. 3. Level III due diligence is a deep-dive, boots-on-the-ground investigation. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Due diligence is generally recognized in three levels: Level I, Level II and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward.

The 2023 ECCP stated, “A well-designed compliance program should apply risk-based due diligence to its third-party relationships. Although the need for, and degree of, appropriate due diligence may vary based on the size and nature of the company, transaction, and third party, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.”

The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward.

There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions into your program. The Level I, II and III trichotomy appears to have the greatest favor and one that you should be able to implement in a straightforward manner. But the key is that you must assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence.

Three key takeaways:

1. A Level I due diligence should only be used when there is a low risk of corruption.

2. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared.

3. Level III due diligence is a deep-dive, boots-on-the-ground investigation.

For more information on Ethico and a free White Paper on top compliance issues in 2024, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 503 no 31 Days to a More Effective Compliance Program: Day 21 - Managing Your Third Parties The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the life cycle management of third parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation and compliance terms and conditions in contracts. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also the one where the rubber meets the road of operationalizing compliance. It is also an area the DOJ specifically articulated in the 2023 ECCP that companies need to consider. Managing your third parties is where the rubber meets the road in your overall third-party risk manage program. You must execute on this task. Even if you successfully navigate the first four steps in your third-party risk management program, those are the easy steps. Managing the relationship is where the real work begins.  Three key takeaways: 1. Have a strategic approach to third-party risk management. 2. Rank third parties based upon a variety of factors including compliance and business performance, length of relationship, benchmarking metrics and KPIs for ongoing monitoring and auditing. 3. Managing the relationship is where the real work begins. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 21 Jan 2024 05:00:00 -0000 Day 21 - Managing Your Third Parties full 21 Thomas Fox Today we consider how to manage your third parties. The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the life cycle management of third parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation and compliance terms and conditions in contracts. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also the one where the rubber meets the road of operationalizing compliance. It is also an area the DOJ specifically articulated in the 2023 ECCP that companies need to consider. Managing your third parties is where the rubber meets the road in your overall third-party risk manage program. You must execute on this task. Even if you successfully navigate the first four steps in your third-party risk management program, those are the easy steps. Managing the relationship is where the real work begins.  Three key takeaways: 1. Have a strategic approach to third-party risk management. 2. Rank third parties based upon a variety of factors including compliance and business performance, length of relationship, benchmarking metrics and KPIs for ongoing monitoring and auditing. 3. Managing the relationship is where the real work begins. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the life cycle management of third parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation and compliance terms and conditions in contracts. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also the one where the rubber meets the road of operationalizing compliance. It is also an area the DOJ specifically articulated in the 2023 ECCP that companies need to consider.

Managing your third parties is where the rubber meets the road in your overall third-party risk manage program. You must execute on this task. Even if you successfully navigate the first four steps in your third-party risk management program, those are the easy steps. Managing the relationship is where the real work begins.

 Three key takeaways:

1. Have a strategic approach to third-party risk management.

2. Rank third parties based upon a variety of factors including compliance and business performance, length of relationship, benchmarking metrics and KPIs for ongoing monitoring and auditing.

3. Managing the relationship is where the real work begins.

For more information on Ethico and a free White Paper on top compliance issues in 2024, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 503 no 31 Days to a More Effective Compliance Program: Day 20 – The Third Party Risk Management Process The DOJ expects an integrated approach that is operationalized throughout the company. This means you must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party risk management that will fulfill the DOJ requirements as laid out in the 2023 FCPA Resource Guide, 2nd edition, and in the Hallmarks of an Effective Compliance Program. The five steps in the lifecycle of third-party management are: 1. Business Justification by the Business Sponsor. 2. Questionnaire to Third-party. 3. Due Diligence on the Third Party. 4. Compliance Terms and Conditions, including payment terms. 5. Management and Oversight of Third Parties After Contract Signing. Three key takeaways: 1. Use the full 5-step process for third-party management. 2. Make sure you have business development involvement and buy-in. 3. Operationalize all steps going forward by including business unit representatives. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 20 Jan 2024 05:00:00 -0000 Day 20 - The Third Party Risk Management Process full 20 Thomas Fox How should you think about managing your 3rd parties? The DOJ expects an integrated approach that is operationalized throughout the company. This means you must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party risk management that will fulfill the DOJ requirements as laid out in the 2023 FCPA Resource Guide, 2nd edition, and in the Hallmarks of an Effective Compliance Program. The five steps in the lifecycle of third-party management are: 1. Business Justification by the Business Sponsor. 2. Questionnaire to Third-party. 3. Due Diligence on the Third Party. 4. Compliance Terms and Conditions, including payment terms. 5. Management and Oversight of Third Parties After Contract Signing. Three key takeaways: 1. Use the full 5-step process for third-party management. 2. Make sure you have business development involvement and buy-in. 3. Operationalize all steps going forward by including business unit representatives. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices The DOJ expects an integrated approach that is operationalized throughout the company. This means you must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party risk management that will fulfill the DOJ requirements as laid out in the 2023 FCPA Resource Guide, 2nd edition, and in the Hallmarks of an Effective Compliance Program. The five steps in the lifecycle of third-party management are:

1. Business Justification by the Business Sponsor.

2. Questionnaire to Third-party.

3. Due Diligence on the Third Party.

4. Compliance Terms and Conditions, including payment terms.

5. Management and Oversight of Third Parties After Contract Signing.

Three key takeaways:

1. Use the full 5-step process for third-party management.

2. Make sure you have business development involvement and buy-in.

3. Operationalize all steps going forward by including business unit representatives.

For more information on Ethico and a free White Paper on top compliance issues in 2024, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 468 no 31 Days to a More Effective Compliance Program: Day 19 - Evaluating a Risk Assessment One way to evaluate risks as determined by the company’s risk assessment is through a risk matrix. Once risks are identified, they are then rated according to their significance and likelihood of occurring and then plotted on a heat map to determine their priority. The most significant risks with the greatest likelihood of occurring are deemed the priority risks, which become the focus of your remedial efforts or for continuous auditing. A variety of solutions and tools can be used to manage these risks going forward, but the key step is to evaluate and rate these risks. All your actions should flow from the risk ranking. The most significant risks with the greatest likelihood of occurring are deemed to be the priority risks. These become the focus of your most significant risk management efforts, coupled with audits and monitoring going forward. A variety of tools can be used to continuously monitor risk going forward. Consider providing employees with substantive training to guard against the most significant risks coming to pass and to keep the key messages fresh and top of mind. It is important to create a risk control summary that succinctly documents the nature of the risk and the actions taken to mitigate it. Finally, let this risk assessment and evaluation inform your compliance program, rather than letting the compliance program inform the risk assessment. Three key takeaways: 1. Even after you complete your risk assessment, you must evaluate those risks for your company. 2. The DOJ and SEC are looking for a well-reasoned approach to how you evaluate your risk. 3. Create a risk matrix and rank your risks; then remediate and monitor as appropriate. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 19 Jan 2024 18:54:00 -0000 Day 19 - Evaluating a Risk Assessment full 19 Thomas Fox Today we consider how to evaluate a risk assessment. One way to evaluate risks as determined by the company’s risk assessment is through a risk matrix. Once risks are identified, they are then rated according to their significance and likelihood of occurring and then plotted on a heat map to determine their priority. The most significant risks with the greatest likelihood of occurring are deemed the priority risks, which become the focus of your remedial efforts or for continuous auditing. A variety of solutions and tools can be used to manage these risks going forward, but the key step is to evaluate and rate these risks. All your actions should flow from the risk ranking. The most significant risks with the greatest likelihood of occurring are deemed to be the priority risks. These become the focus of your most significant risk management efforts, coupled with audits and monitoring going forward. A variety of tools can be used to continuously monitor risk going forward. Consider providing employees with substantive training to guard against the most significant risks coming to pass and to keep the key messages fresh and top of mind. It is important to create a risk control summary that succinctly documents the nature of the risk and the actions taken to mitigate it. Finally, let this risk assessment and evaluation inform your compliance program, rather than letting the compliance program inform the risk assessment. Three key takeaways: 1. Even after you complete your risk assessment, you must evaluate those risks for your company. 2. The DOJ and SEC are looking for a well-reasoned approach to how you evaluate your risk. 3. Create a risk matrix and rank your risks; then remediate and monitor as appropriate. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices One way to evaluate risks as determined by the company’s risk assessment is through a risk matrix. Once risks are identified, they are then rated according to their significance and likelihood of occurring and then plotted on a heat map to determine their priority. The most significant risks with the greatest likelihood of occurring are deemed the priority risks, which become the focus of your remedial efforts or for continuous auditing. A variety of solutions and tools can be used to manage these risks going forward, but the key step is to evaluate and rate these risks. All your actions should flow from the risk ranking.

The most significant risks with the greatest likelihood of occurring are deemed to be the priority risks. These become the focus of your most significant risk management efforts, coupled with audits and monitoring going forward. A variety of tools can be used to continuously monitor risk going forward. Consider providing employees with substantive training to guard against the most significant risks coming to pass and to keep the key messages fresh and top of mind. It is important to create a risk control summary that succinctly documents the nature of the risk and the actions taken to mitigate it. Finally, let this risk assessment and evaluation inform your compliance program, rather than letting the compliance program inform the risk assessment.

Three key takeaways:

1. Even after you complete your risk assessment, you must evaluate those risks for your company.

2. The DOJ and SEC are looking for a well-reasoned approach to how you evaluate your risk.

3. Create a risk matrix and rank your risks; then remediate and monitor as appropriate.

For more information on Ethico and a free White Paper on top compliance issues in 2024, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 495 no 31 Days to a More Effective Compliance Program - Day 18 - Risk Assessments One cannot really say enough about risk assessments in the context of anti-corruption programs. This is because every corporate compliance program should be based on a risk assessment, on an understanding of your organization’s business from a commercial perspective, on how your organization has identified, assessed, and defined its risk profile, and, finally, on the degree to which the program devotes appropriate scrutiny and resources to this range of risks. The 2023 ECCP added a new emphasis on the cadence of Risk Assessments, mandating that risk assessments should be done not less than annually, but in reality, they should be done each time your risk changes. Over the past couple of years, every company’s risks have changed from going to Work From Home to Return to the Office to the Hybrid Work environments of 2024. What about geopolitical issues, the supply chain, or even potential compliance risks in the 2024 election cycle? Have you assessed each of these new paradigms for risks from a compliance perspective? There are a number of ways you can slice and dice your basic inquiry. As with almost all FCPA compliance, it is important that your protocol be well thought out. If you use one, some, or all of the above as your basic inquiries for your risk analysis, it should be acceptable as your starting point.  Three key takeaways: 1. Since at least 1999, the DOJ has pointed to the risk assessment as the start of an effective compliance program. 2. The DOJ will now consider both your risk assessment methodology for identifying risks and the gathered evidence. 3. You should base your compliance program on your risk assessment. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 18 Jan 2024 05:00:00 -0000 Day 18 - Risk Assessments full 18 Thomas Fox Today, we take up risk assessments. One cannot really say enough about risk assessments in the context of anti-corruption programs. This is because every corporate compliance program should be based on a risk assessment, on an understanding of your organization’s business from a commercial perspective, on how your organization has identified, assessed, and defined its risk profile, and, finally, on the degree to which the program devotes appropriate scrutiny and resources to this range of risks. The 2023 ECCP added a new emphasis on the cadence of Risk Assessments, mandating that risk assessments should be done not less than annually, but in reality, they should be done each time your risk changes. Over the past couple of years, every company’s risks have changed from going to Work From Home to Return to the Office to the Hybrid Work environments of 2024. What about geopolitical issues, the supply chain, or even potential compliance risks in the 2024 election cycle? Have you assessed each of these new paradigms for risks from a compliance perspective? There are a number of ways you can slice and dice your basic inquiry. As with almost all FCPA compliance, it is important that your protocol be well thought out. If you use one, some, or all of the above as your basic inquiries for your risk analysis, it should be acceptable as your starting point.  Three key takeaways: 1. Since at least 1999, the DOJ has pointed to the risk assessment as the start of an effective compliance program. 2. The DOJ will now consider both your risk assessment methodology for identifying risks and the gathered evidence. 3. You should base your compliance program on your risk assessment. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices One cannot really say enough about risk assessments in the context of anti-corruption programs. This is because every corporate compliance program should be based on a risk assessment, on an understanding of your organization’s business from a commercial perspective, on how your organization has identified, assessed, and defined its risk profile, and, finally, on the degree to which the program devotes appropriate scrutiny and resources to this range of risks. The 2023 ECCP added a new emphasis on the cadence of Risk Assessments, mandating that risk assessments should be done not less than annually, but in reality, they should be done each time your risk changes. Over the past couple of years, every company’s risks have changed from going to Work From Home to Return to the Office to the Hybrid Work environments of 2024. What about geopolitical issues, the supply chain, or even potential compliance risks in the 2024 election cycle? Have you assessed each of these new paradigms for risks from a compliance perspective?

There are a number of ways you can slice and dice your basic inquiry. As with almost all FCPA compliance, it is important that your protocol be well thought out. If you use one, some, or all of the above as your basic inquiries for your risk analysis, it should be acceptable as your starting point.

 Three key takeaways:

1. Since at least 1999, the DOJ has pointed to the risk assessment as the start of an effective compliance program.

2. The DOJ will now consider both your risk assessment methodology for identifying risks and the gathered evidence.

3. You should base your compliance program on your risk assessment.

For more information on Ethico and a free White Paper on top compliance issues in 2024, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 537 no 31 Days to a More Effective Compliance Program - Day 17 - Podcasts for Compliance Training and Corporate Culture One of the biggest benefits of podcasting is that it allows a compliance function to connect with their audience on a more personal level. Unlike traditional forms of advertising, which often come across as impersonal and sales-driven, podcasts enable businesses to build a loyal following by offering valuable and engaging content. This can include interviews with industry experts, behind-the-scenes glimpses of the business, and informative discussions on relevant topics. Now take these same concepts of audience engagement and apply them internally to an organization. What do you potentially have? A mechanism to engage your employees, to engender trust, and to improve your overall corporate culture. Do you think this is a crazy way to improve culture? Think again about all the advantages podcasting has in place already. A major US consumer product company started a podcast and had corporate executives on it. Who were the biggest fans of the podcast? It turned out it was the company employees, many of whom had never met their corporate executives. This allowed the executives to be humanized in a way no number of town hall meetings or other similar corporate events could ever achieve. Since you are only limited by your imagination in compliance, why not use some of that imagination to be creative in your compliance training and communications? Three key takeaways: 1. Using podcast storytelling to tell longer, more involved stories about compliance. 2. You can use compliance department-branded podcasts to have ongoing communications about compliance. 3. A Daily Compliance News show will drive engagement. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 17 Jan 2024 05:00:00 -0000 Day 17 - Podcasts for Compliance Training and Corporate Culture full 17 Thomas Fox How can to use podcasts to facilitate compliance training and improve corporate culture. One of the biggest benefits of podcasting is that it allows a compliance function to connect with their audience on a more personal level. Unlike traditional forms of advertising, which often come across as impersonal and sales-driven, podcasts enable businesses to build a loyal following by offering valuable and engaging content. This can include interviews with industry experts, behind-the-scenes glimpses of the business, and informative discussions on relevant topics. Now take these same concepts of audience engagement and apply them internally to an organization. What do you potentially have? A mechanism to engage your employees, to engender trust, and to improve your overall corporate culture. Do you think this is a crazy way to improve culture? Think again about all the advantages podcasting has in place already. A major US consumer product company started a podcast and had corporate executives on it. Who were the biggest fans of the podcast? It turned out it was the company employees, many of whom had never met their corporate executives. This allowed the executives to be humanized in a way no number of town hall meetings or other similar corporate events could ever achieve. Since you are only limited by your imagination in compliance, why not use some of that imagination to be creative in your compliance training and communications? Three key takeaways: 1. Using podcast storytelling to tell longer, more involved stories about compliance. 2. You can use compliance department-branded podcasts to have ongoing communications about compliance. 3. A Daily Compliance News show will drive engagement. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the biggest benefits of podcasting is that it allows a compliance function to connect with their audience on a more personal level. Unlike traditional forms of advertising, which often come across as impersonal and sales-driven, podcasts enable businesses to build a loyal following by offering valuable and engaging content. This can include interviews with industry experts, behind-the-scenes glimpses of the business, and informative discussions on relevant topics.

Now take these same concepts of audience engagement and apply them internally to an organization. What do you potentially have? A mechanism to engage your employees, to engender trust, and to improve your overall corporate culture. Do you think this is a crazy way to improve culture? Think again about all the advantages podcasting has in place already.

A major US consumer product company started a podcast and had corporate executives on it. Who were the biggest fans of the podcast? It turned out it was the company employees, many of whom had never met their corporate executives. This allowed the executives to be humanized in a way no number of town hall meetings or other similar corporate events could ever achieve.

Since you are only limited by your imagination in compliance, why not use some of that imagination to be creative in your compliance training and communications?

Three key takeaways:

1. Using podcast storytelling to tell longer, more involved stories about compliance.

2. You can use compliance department-branded podcasts to have ongoing communications about compliance.

3. A Daily Compliance News show will drive engagement.

For more information on Ethico and a free White Paper on top compliance issues in 2024, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 580 no 31 Days to a More Effective Compliance Program: Day 16 - Tailored and Effective Compliance Training One of the key goals of any compliance program is to train employees in awareness and understanding of the FCPA, your specific company compliance program, and to create and foster a culture of compliance. While it seems axiomatic that compliance training is the mainstay of any best practices compliance program, the conversation around training has evolved over the years. The importance of determining the effectiveness of your compliance program has been enshrined by the DOJ. The 2023 Update confirmed that the DOJ wants to see evidence of the effectiveness of your compliance program. This is something that many CCOs and compliance professionals still struggle to determine. Both the simple guidelines suggested herein and the more robust assessment and results provide you with a start to fulfilling the precepts set out by the DOJ, as you will eventually need to demonstrate the effectiveness of your compliance training going forward. Three key takeaways: 1. How and why have you tailored your compliance training and how do you determine its effectiveness? 2. Try an “espresso” shot of training 3. Present your training in both local languages and a variety of media. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 16 Jan 2024 05:00:00 -0000 Day 16 - Tailored and Effective Compliance Training full 16 Thomas Fox How to tailor your compliance training for effectiveness. One of the key goals of any compliance program is to train employees in awareness and understanding of the FCPA, your specific company compliance program, and to create and foster a culture of compliance. While it seems axiomatic that compliance training is the mainstay of any best practices compliance program, the conversation around training has evolved over the years. The importance of determining the effectiveness of your compliance program has been enshrined by the DOJ. The 2023 Update confirmed that the DOJ wants to see evidence of the effectiveness of your compliance program. This is something that many CCOs and compliance professionals still struggle to determine. Both the simple guidelines suggested herein and the more robust assessment and results provide you with a start to fulfilling the precepts set out by the DOJ, as you will eventually need to demonstrate the effectiveness of your compliance training going forward. Three key takeaways: 1. How and why have you tailored your compliance training and how do you determine its effectiveness? 2. Try an “espresso” shot of training 3. Present your training in both local languages and a variety of media. For more information on Ethico and a free White Paper on top compliance issues in 2024, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the key goals of any compliance program is to train employees in awareness and understanding of the FCPA, your specific company compliance program, and to create and foster a culture of compliance. While it seems axiomatic that compliance training is the mainstay of any best practices compliance program, the conversation around training has evolved over the years.

The importance of determining the effectiveness of your compliance program has been enshrined by the DOJ. The 2023 Update confirmed that the DOJ wants to see evidence of the effectiveness of your compliance program. This is something that many CCOs and compliance professionals still struggle to determine. Both the simple guidelines suggested herein and the more robust assessment and results provide you with a start to fulfilling the precepts set out by the DOJ, as you will eventually need to demonstrate the effectiveness of your compliance training going forward.


Three key takeaways:

1. How and why have you tailored your compliance training and how do you determine its effectiveness?

2. Try an “espresso” shot of training

3. Present your training in both local languages and a variety of media.

For more information on Ethico and a free White Paper on top compliance issues in 2024, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 556 no 31 Days to a More Effective Compliance Program: Day 15 - Monitoring and Improvement of Internal Controls What happens when controls are continually overridden? Does that necessarily mean that companies are engaging in activities that violate the FCPA or some other law, such as Sarbanes-Oxley (SOX)? Cristina Revelo said she would start out with some basic questions, such as “How often would something be manually approved? How often are controls skipped? What are the levels of approvals that you have and what is your documentation? What are the reasons? And are you documenting how often a certain department is requiring those overrides?” While it could indicate that a company lacks a culture of compliance or that everything is an emergency, it might mean something else. It might mean that your internal controls need to be evaluated and then recalibrated. The Department of Justice calls this continuous monitoring leading to continuous improvement. Joe Oringel, co-founder of Visual Risk IQ, calls it continuous control monitoring. However, many compliance professionals, and particularly lawyers, think once a control is in place, it’s set in stone, and it’s there forever. This derives from the unfortunate fact that, once again, many compliance professionals and most lawyers do not understand internal controls. Yet, internal controls, much like the rest of a compliance program, can and should be continually monitored and improved based on information about such things as the number of overrides. Such a review can be evidence of a management problem or a culture of non-compliance at the organization. However, it could be that perhaps the controls need to be adjusted. Revelo emphasized that it is not simply identifying the issues but remedying them as well, “because that actually might look worse if you identify a lot of issues, but do not fix them. You are better off by remediating everything you are identifying.” From there, you can conduct a root cause analysis as to why there was failure in a control or violation of a compliance procedure. Revelo concluded, “You need to really do that in an in-depth manner and then remediate.”  Three key takeaways: 1. An internal control override is not necessarily a bad thing if proper procedure is followed. 2. Internal controls are not set in stone. 3. The key is to have a process for monitoring the controls and taking input, literally from each line of defense. To obtain a free White Paper from our sponsor, Ethico on key compliance issues from 2023, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 15 Jan 2024 12:51:00 -0000 Day 15 - Monitoring and Improvement of Internal Controls full 15 Thomas Fox Today, how to monitor and improve internal controls. What happens when controls are continually overridden? Does that necessarily mean that companies are engaging in activities that violate the FCPA or some other law, such as Sarbanes-Oxley (SOX)? Cristina Revelo said she would start out with some basic questions, such as “How often would something be manually approved? How often are controls skipped? What are the levels of approvals that you have and what is your documentation? What are the reasons? And are you documenting how often a certain department is requiring those overrides?” While it could indicate that a company lacks a culture of compliance or that everything is an emergency, it might mean something else. It might mean that your internal controls need to be evaluated and then recalibrated. The Department of Justice calls this continuous monitoring leading to continuous improvement. Joe Oringel, co-founder of Visual Risk IQ, calls it continuous control monitoring. However, many compliance professionals, and particularly lawyers, think once a control is in place, it’s set in stone, and it’s there forever. This derives from the unfortunate fact that, once again, many compliance professionals and most lawyers do not understand internal controls. Yet, internal controls, much like the rest of a compliance program, can and should be continually monitored and improved based on information about such things as the number of overrides. Such a review can be evidence of a management problem or a culture of non-compliance at the organization. However, it could be that perhaps the controls need to be adjusted. Revelo emphasized that it is not simply identifying the issues but remedying them as well, “because that actually might look worse if you identify a lot of issues, but do not fix them. You are better off by remediating everything you are identifying.” From there, you can conduct a root cause analysis as to why there was failure in a control or violation of a compliance procedure. Revelo concluded, “You need to really do that in an in-depth manner and then remediate.”  Three key takeaways: 1. An internal control override is not necessarily a bad thing if proper procedure is followed. 2. Internal controls are not set in stone. 3. The key is to have a process for monitoring the controls and taking input, literally from each line of defense. To obtain a free White Paper from our sponsor, Ethico on key compliance issues from 2023, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices What happens when controls are continually overridden? Does that necessarily mean that companies are engaging in activities that violate the FCPA or some other law, such as Sarbanes-Oxley (SOX)? Cristina Revelo said she would start out with some basic questions, such as “How often would something be manually approved? How often are controls skipped? What are the levels of approvals that you have and what is your documentation? What are the reasons? And are you documenting how often a certain department is requiring those overrides?” While it could indicate that a company lacks a culture of compliance or that everything is an emergency, it might mean something else. It might mean that your internal controls need to be evaluated and then recalibrated. The Department of Justice calls this continuous monitoring leading to continuous improvement. Joe Oringel, co-founder of Visual Risk IQ, calls it continuous control monitoring.

However, many compliance professionals, and particularly lawyers, think once a control is in place, it’s set in stone, and it’s there forever. This derives from the unfortunate fact that, once again, many compliance professionals and most lawyers do not understand internal controls. Yet, internal controls, much like the rest of a compliance program, can and should be continually monitored and improved based on information about such things as the number of overrides. Such a review can be evidence of a management problem or a culture of non-compliance at the organization. However, it could be that perhaps the controls need to be adjusted.

Revelo emphasized that it is not simply identifying the issues but remedying them as well, “because that actually might look worse if you identify a lot of issues, but do not fix them. You are better off by remediating everything you are identifying.” From there, you can conduct a root cause analysis as to why there was failure in a control or violation of a compliance procedure. Revelo concluded, “You need to really do that in an in-depth manner and then remediate.”

 Three key takeaways:

1. An internal control override is not necessarily a bad thing if proper procedure is followed.

2. Internal controls are not set in stone.

3. The key is to have a process for monitoring the controls and taking input, literally from each line of defense.


To obtain a free White Paper from our sponsor, Ethico on key compliance issues from 2023, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 489 no 31 Days to a More Effective Compliance Program: Day 14 - Internal Controls What are internal controls? The best definition I have come across is from Jonathan Marks, partner at BDO, who defined internal controls as: An internal control is an action or process of interlocking activities designed to support the policies and procedures detailing the specific preventative, detective, corrective, directive, and corroborative actions required to achieve the desired process outcomes or objectives. This, along with continuous auditing, continuous monitoring, and training, reasonably assures: • The achievement of the process objectives linked to the organization’s objectives; • Operational effectiveness and efficiency; • Reliable (complete and accurate) books and records (financial reporting); • Compliance with laws, regulations and policies; and • The reduction of risk fraud, waste, and abuse, which aids in the decline of process and policy variation, leading to more predictive outcomes. The bottom line is that internal controls are just good financial controls. The internal controls that detail requirements for third-party representatives in the compliance context will help to detect fraud, which could well lead to bribery and corruption. As an exercise, map your existing internal controls to the Hallmarks of an Effective Compliance Program or some other well-known anti-corruption regime to see where gaps may exist. This will help you determine whether adequate internal compliance controls are present in your company. From there, you can move on to see if they are working in practice.   Three key takeaways: 1. Effective internal controls are required under the FCPA 2. Internal controls are a critical part of any best practices compliance program 3. There are four significant controls for the compliance practitioner to implement initially. (a) Delegation of authority (DOA); (b) Maintenance of the vendor master file; (c) Contracts with third parties; and (d) Movement of cash or currency Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 14 Jan 2024 05:00:00 -0000 Day 14 - Internal Controls full 14 Thomas Fox Today we begin a review of internal controls. What are internal controls? The best definition I have come across is from Jonathan Marks, partner at BDO, who defined internal controls as: An internal control is an action or process of interlocking activities designed to support the policies and procedures detailing the specific preventative, detective, corrective, directive, and corroborative actions required to achieve the desired process outcomes or objectives. This, along with continuous auditing, continuous monitoring, and training, reasonably assures: • The achievement of the process objectives linked to the organization’s objectives; • Operational effectiveness and efficiency; • Reliable (complete and accurate) books and records (financial reporting); • Compliance with laws, regulations and policies; and • The reduction of risk fraud, waste, and abuse, which aids in the decline of process and policy variation, leading to more predictive outcomes. The bottom line is that internal controls are just good financial controls. The internal controls that detail requirements for third-party representatives in the compliance context will help to detect fraud, which could well lead to bribery and corruption. As an exercise, map your existing internal controls to the Hallmarks of an Effective Compliance Program or some other well-known anti-corruption regime to see where gaps may exist. This will help you determine whether adequate internal compliance controls are present in your company. From there, you can move on to see if they are working in practice.   Three key takeaways: 1. Effective internal controls are required under the FCPA 2. Internal controls are a critical part of any best practices compliance program 3. There are four significant controls for the compliance practitioner to implement initially. (a) Delegation of authority (DOA); (b) Maintenance of the vendor master file; (c) Contracts with third parties; and (d) Movement of cash or currency Learn more about your ad choices. Visit megaphone.fm/adchoices What are internal controls? The best definition I have come across is from Jonathan Marks, partner at BDO, who defined internal controls as:

An internal control is an action or process of interlocking activities designed to support the policies and procedures detailing the specific preventative, detective, corrective, directive, and corroborative actions required to achieve the desired process outcomes or objectives. This, along with continuous auditing, continuous monitoring, and training, reasonably assures:

• The achievement of the process objectives linked to the organization’s objectives;

• Operational effectiveness and efficiency;

• Reliable (complete and accurate) books and records (financial reporting);

• Compliance with laws, regulations and policies; and

• The reduction of risk fraud, waste, and abuse, which aids in the decline of process and policy variation, leading to more predictive outcomes.

The bottom line is that internal controls are just good financial controls. The internal controls that detail requirements for third-party representatives in the compliance context will help to detect fraud, which could well lead to bribery and corruption. As an exercise, map your existing internal controls to the Hallmarks of an Effective Compliance Program or some other well-known anti-corruption regime to see where gaps may exist. This will help you determine whether adequate internal compliance controls are present in your company. From there, you can move on to see if they are working in practice.

 

Three key takeaways:

1. Effective internal controls are required under the FCPA

2. Internal controls are a critical part of any best practices compliance program

3. There are four significant controls for the compliance practitioner to implement initially. (a) Delegation of authority (DOA); (b) Maintenance of the vendor master file; (c) Contracts with third parties; and (d) Movement of cash or currency

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 507 no Day 31 to a More Effective Compliance Program: Day 13-Policies and Procedures There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2023 ECCP made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as part of its risk assessment process.” This statement made clear that the regulators will take a strong view against a company that does not have well thought out and articulated policies and procedures against bribery and corruption; all of which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital layer of communication and acts as an internal control. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to policies and procedures in anti-corruption compliance.  Three key takeaways: 1. Written compliance policies and procedures, together the Code of Conduct, with form the backbone of your compliance program. 2. The DOJ and SEC expect a well-thought out and articulated set of compliance policies and procedures and that they be adequately communicated throughout your organization. 3. Institutional fairness for the application of policies and procedures demands consistent application of your policies and procedures across the globe. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 13 Jan 2024 05:00:00 -0000 Day 13 - Policies and Procedures full 13 Thomas Fox Today we consider the role of policies and procedures. There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2023 ECCP made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as part of its risk assessment process.” This statement made clear that the regulators will take a strong view against a company that does not have well thought out and articulated policies and procedures against bribery and corruption; all of which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital layer of communication and acts as an internal control. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to policies and procedures in anti-corruption compliance.  Three key takeaways: 1. Written compliance policies and procedures, together the Code of Conduct, with form the backbone of your compliance program. 2. The DOJ and SEC expect a well-thought out and articulated set of compliance policies and procedures and that they be adequately communicated throughout your organization. 3. Institutional fairness for the application of policies and procedures demands consistent application of your policies and procedures across the globe. Learn more about your ad choices. Visit megaphone.fm/adchoices There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2023 ECCP made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as part of its risk assessment process.” This statement made clear that the regulators will take a strong view against a company that does not have well thought out and articulated policies and procedures against bribery and corruption; all of which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital layer of communication and acts as an internal control. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to policies and procedures in anti-corruption compliance.

 Three key takeaways:

1. Written compliance policies and procedures, together the Code of Conduct, with form the backbone of your compliance program.

2. The DOJ and SEC expect a well-thought out and articulated set of compliance policies and procedures and that they be adequately communicated throughout your organization.

3. Institutional fairness for the application of policies and procedures demands consistent application of your policies and procedures across the globe.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 503 no 31 Days to a More Effective Compliance Program: Day 12 - Your Code of Conduct What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in a regulator’s face during an enforcement action as proof of ethical overall behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal of the creation of your company’s Code of Conduct? How important is the Code of Conduct? Consider the 2016 SEC enforcement action involving United Airlines, Inc., which turned on a violation of the company’s Code of Conduct. The breach of the Code of Conduct was determined to be an FCPA internal control violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity that has authority over, among other things, United’s operations at the company’s huge east coast hub in Newark, NJ.  Three key takeaways: 1. A Code of Conduct is a foundational document in any compliance regime. 2. The substance of your Code of Conduct should be tailored to the company’s culture, to its industry, and to its corporate identity. 3. “Document, Document, and Document” your training and communication efforts regarding your Code of Conduct. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 12 Jan 2024 05:00:00 -0000 Day 12 - Your Code of Conduct full 12 Thomas Fox Today we consider the Code of Conduct. What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in a regulator’s face during an enforcement action as proof of ethical overall behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal of the creation of your company’s Code of Conduct? How important is the Code of Conduct? Consider the 2016 SEC enforcement action involving United Airlines, Inc., which turned on a violation of the company’s Code of Conduct. The breach of the Code of Conduct was determined to be an FCPA internal control violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity that has authority over, among other things, United’s operations at the company’s huge east coast hub in Newark, NJ.  Three key takeaways: 1. A Code of Conduct is a foundational document in any compliance regime. 2. The substance of your Code of Conduct should be tailored to the company’s culture, to its industry, and to its corporate identity. 3. “Document, Document, and Document” your training and communication efforts regarding your Code of Conduct. Learn more about your ad choices. Visit megaphone.fm/adchoices What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in a regulator’s face during an enforcement action as proof of ethical overall behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal of the creation of your company’s Code of Conduct?

How important is the Code of Conduct? Consider the 2016 SEC enforcement action involving United Airlines, Inc., which turned on a violation of the company’s Code of Conduct. The breach of the Code of Conduct was determined to be an FCPA internal control violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity that has authority over, among other things, United’s operations at the company’s huge east coast hub in Newark, NJ.

 Three key takeaways:

1. A Code of Conduct is a foundational document in any compliance regime.

2. The substance of your Code of Conduct should be tailored to the company’s culture, to its industry, and to its corporate identity.

3. “Document, Document, and Document” your training and communication efforts regarding your Code of Conduct.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 503 no 31 Days to a More Effective Compliance Program: Day 11 - Moving Compliance Tone Down Through an Organization The 2023 ECCP made clear a company must have more than simply good ‘Tone-at-the-Top’; it must move down through the organization from senior management to middle management and into its lower ranks. It stated, “Beyond compliance structures, policies, and procedures, it is important for a company to create and foster a culture of ethics and compliance with the law at all levels of the company. The effectiveness of a compliance program requires a high-level commitment by company leadership to implement a culture of compliance from the middle and the top.” Employees often look to their direct supervisor to determine what the tone of an organization is and will be going forward. Many employees of large, multi-national organizations may never have direct contact with the CEO or even senior management. By moving the values of compliance through an organization into the middle, you will be in a much better position to inculcate these values and operationalizing compliance with them.  Three key takeaways: 1. Tone at the top—direct supervisors become the most important influence on people in the company 2. Give your middle managers a Tool Kit around compliance so they can fully operationalize compliance 3. Organizational justice is an additional way to help operationalize compliance Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 11 Jan 2024 05:00:00 -0000 Day 11 - Moving Compliance Tone Down Through an Organization full 11 Thomas Fox The importance of moving compliance tone down through an organization. The 2023 ECCP made clear a company must have more than simply good ‘Tone-at-the-Top’; it must move down through the organization from senior management to middle management and into its lower ranks. It stated, “Beyond compliance structures, policies, and procedures, it is important for a company to create and foster a culture of ethics and compliance with the law at all levels of the company. The effectiveness of a compliance program requires a high-level commitment by company leadership to implement a culture of compliance from the middle and the top.” Employees often look to their direct supervisor to determine what the tone of an organization is and will be going forward. Many employees of large, multi-national organizations may never have direct contact with the CEO or even senior management. By moving the values of compliance through an organization into the middle, you will be in a much better position to inculcate these values and operationalizing compliance with them.  Three key takeaways: 1. Tone at the top—direct supervisors become the most important influence on people in the company 2. Give your middle managers a Tool Kit around compliance so they can fully operationalize compliance 3. Organizational justice is an additional way to help operationalize compliance Learn more about your ad choices. Visit megaphone.fm/adchoices The 2023 ECCP made clear a company must have more than simply good ‘Tone-at-the-Top’; it must move down through the organization from senior management to middle management and into its lower ranks. It stated, “Beyond compliance structures, policies, and procedures, it is important for a company to create and foster a culture of ethics and compliance with the law at all levels of the company. The effectiveness of a compliance program requires a high-level commitment by company leadership to implement a culture of compliance from the middle and the top.”

Employees often look to their direct supervisor to determine what the tone of an organization is and will be going forward. Many employees of large, multi-national organizations may never have direct contact with the CEO or even senior management. By moving the values of compliance through an organization into the middle, you will be in a much better position to inculcate these values and operationalizing compliance with them.

 Three key takeaways:

1. Tone at the top—direct supervisors become the most important influence on people in the company

2. Give your middle managers a Tool Kit around compliance so they can fully operationalize compliance

3. Organizational justice is an additional way to help operationalize compliance

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 323 no 31 Days to a More Effective Compliance Program: Day 10 - Leadership's Conduct at The Top The 2022 Monaco Memo emphasized the basic point that the key to every company is culture. The bottom line is that corporate culture matters, and corporate culture that fails to hold individuals accountable or fails to invest in compliance—or worse, that thumbs its nose at compliance—leads to bad results. To assist companies in understanding this requirement, the 2023 ECCP sets out inquiries demonstrating that DOJ requirements are more than simply the ubiquitous “tone-at-the-top,” as they focus on the conduct of senior management. The DOJ wants to see a company’s senior leadership actually doing compliance. The DOJ asks if company leadership has, through their words and concrete actions, brought the right message of doing business ethically and in compliance to the organization. How does senior management model its behavior based on a company’s values and finally, how is such conduct monitored in an organization?  Three key takeaways: 1. Senior management must actually do compliance—not simply talk the talk of compliance but also walk the walk. 2. The DOJ is now actively assessing corporate culture during investigations. 3. Your CEO is a Compliance Ambassador. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 10 Jan 2024 12:22:00 -0000 Day 10 - Leadership's Conduct at the Top full 10 Thomas Fox What is the role of leadership's conduct at the top? The 2022 Monaco Memo emphasized the basic point that the key to every company is culture. The bottom line is that corporate culture matters, and corporate culture that fails to hold individuals accountable or fails to invest in compliance—or worse, that thumbs its nose at compliance—leads to bad results. To assist companies in understanding this requirement, the 2023 ECCP sets out inquiries demonstrating that DOJ requirements are more than simply the ubiquitous “tone-at-the-top,” as they focus on the conduct of senior management. The DOJ wants to see a company’s senior leadership actually doing compliance. The DOJ asks if company leadership has, through their words and concrete actions, brought the right message of doing business ethically and in compliance to the organization. How does senior management model its behavior based on a company’s values and finally, how is such conduct monitored in an organization?  Three key takeaways: 1. Senior management must actually do compliance—not simply talk the talk of compliance but also walk the walk. 2. The DOJ is now actively assessing corporate culture during investigations. 3. Your CEO is a Compliance Ambassador. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2022 Monaco Memo emphasized the basic point that the key to every company is culture. The bottom line is that corporate culture matters, and corporate culture that fails to hold individuals accountable or fails to invest in compliance—or worse, that thumbs its nose at compliance—leads to bad results.

To assist companies in understanding this requirement, the 2023 ECCP sets out inquiries demonstrating that DOJ requirements are more than simply the ubiquitous “tone-at-the-top,” as they focus on the conduct of senior management. The DOJ wants to see a company’s senior leadership actually doing compliance. The DOJ asks if company leadership has, through their words and concrete actions, brought the right message of doing business ethically and in compliance to the organization. How does senior management model its behavior based on a company’s values and finally, how is such conduct monitored in an organization?

 Three key takeaways:

1. Senior management must actually do compliance—not simply talk the talk of compliance but also walk the walk.

2. The DOJ is now actively assessing corporate culture during investigations.

3. Your CEO is a Compliance Ambassador.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 488 no 31 Days to a More Effective Compliance Program: Day 9 - Continuous Monitoring and Continuous Improvement Continuous monitoring and continuous improvement are two of the most important phrases for any compliance program. These twin concepts were further enshrined in the 2023 Update to the Evaluation of Corporate Compliance Programs (2023 ECCP). In 2023, all companies’ risks changed as we moved from Working From Home to Return To Office and, now, a hybrid model. In addition to this straight-forward change in risk due to working locations, new risks in the form of geopolitical, supply chain, and export control, as well as increased risk due to social media, continue to impact compliance programs.  Your compliance program must be ready to respond to whatever those risks might be going forward. Continuous improvement runs the gamut in a best practices compliance program, from risk assessments to policies and procedures to periodic testing and review. Three key takeaways: 1. How have your company’s risks changed over the past year, and how will they change in 2024? 2. What is your process for continuous monitoring and improvement? 3. What sources of information do you use that come from outside your organization? Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 09 Jan 2024 05:00:00 -0000 Day 9 - Continuous Monitoring and Continuous Improvement full 9 Thomas Fox The importance of continuous monitoring and continuous review. Continuous monitoring and continuous improvement are two of the most important phrases for any compliance program. These twin concepts were further enshrined in the 2023 Update to the Evaluation of Corporate Compliance Programs (2023 ECCP). In 2023, all companies’ risks changed as we moved from Working From Home to Return To Office and, now, a hybrid model. In addition to this straight-forward change in risk due to working locations, new risks in the form of geopolitical, supply chain, and export control, as well as increased risk due to social media, continue to impact compliance programs.  Your compliance program must be ready to respond to whatever those risks might be going forward. Continuous improvement runs the gamut in a best practices compliance program, from risk assessments to policies and procedures to periodic testing and review. Three key takeaways: 1. How have your company’s risks changed over the past year, and how will they change in 2024? 2. What is your process for continuous monitoring and improvement? 3. What sources of information do you use that come from outside your organization? Learn more about your ad choices. Visit megaphone.fm/adchoices Continuous monitoring and continuous improvement are two of the most important phrases for any compliance program. These twin concepts were further enshrined in the 2023 Update to the Evaluation of Corporate Compliance Programs (2023 ECCP). In 2023, all companies’ risks changed as we moved from Working From Home to Return To Office and, now, a hybrid model. In addition to this straight-forward change in risk due to working locations, new risks in the form of geopolitical, supply chain, and export control, as well as increased risk due to social media, continue to impact compliance programs.  Your compliance program must be ready to respond to whatever those risks might be going forward.

Continuous improvement runs the gamut in a best practices compliance program, from risk assessments to policies and procedures to periodic testing and review.


Three key takeaways:

1. How have your company’s risks changed over the past year, and how will they change in 2024?

2. What is your process for continuous monitoring and improvement?

3. What sources of information do you use that come from outside your organization?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 503 no 31 Days to a More Effective Compliance Program: Day 8 - Operationalizing Compliance Through Payroll One of the areas articulated in the 2023 ECCP was around payments and payroll. For both the compliance professional and the corporate payroll function, there is a significant role to play in the operationalization of a corporate compliance program. The 2023 ECCP was replete with references to payment and its critical nature to any best practices compliance program. This includes references to payments to foreign officials, payments to third parties, and hiding bribes in payments to distributors. The 2023 ECCP begins with an admonition to stop wasting time on low-hanging fruit when there are much higher risks in your business operations. The role of payroll in compliance is not often considered in operationalizing your compliance program, yet the monies to fund bribes must come from somewhere. Unfortunately, one of those places is out of payroll. All CCOs need to sit down with their head of payroll, have them explain the role of payroll, and then review the internal controls in place to see how they facilitate compliance goals. From that review, you can then determine how to use payroll to help operationalize your compliance program. The DOJ has now provided its clearest statement on how it expects a company to actually comply going forward. Long gone are the days where the DOJ simply considered the inputs of a written program as sufficient to protect companies from compliance violations. Yet the mandate to operationalize a corporate compliance program drives home the concept that compliance is a business process that should be administered by the appropriate business unit with the requisite SME. When it comes to following the money, payroll is the most well-suited corporate discipline to provide this first level of oversight and control. Three key takeaways: Payroll can be a key to preventing and detecting control The 2020 Update specified the tie between the corporate compliance function and the corporate payroll function. Offshore payments remain a key indicator of a red flag. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 08 Jan 2024 16:18:00 -0000 Day 8 - Operationalizing Compliance Through Payroll full 8 Thomas Fox How to operationalize compliance though payroll. One of the areas articulated in the 2023 ECCP was around payments and payroll. For both the compliance professional and the corporate payroll function, there is a significant role to play in the operationalization of a corporate compliance program. The 2023 ECCP was replete with references to payment and its critical nature to any best practices compliance program. This includes references to payments to foreign officials, payments to third parties, and hiding bribes in payments to distributors. The 2023 ECCP begins with an admonition to stop wasting time on low-hanging fruit when there are much higher risks in your business operations. The role of payroll in compliance is not often considered in operationalizing your compliance program, yet the monies to fund bribes must come from somewhere. Unfortunately, one of those places is out of payroll. All CCOs need to sit down with their head of payroll, have them explain the role of payroll, and then review the internal controls in place to see how they facilitate compliance goals. From that review, you can then determine how to use payroll to help operationalize your compliance program. The DOJ has now provided its clearest statement on how it expects a company to actually comply going forward. Long gone are the days where the DOJ simply considered the inputs of a written program as sufficient to protect companies from compliance violations. Yet the mandate to operationalize a corporate compliance program drives home the concept that compliance is a business process that should be administered by the appropriate business unit with the requisite SME. When it comes to following the money, payroll is the most well-suited corporate discipline to provide this first level of oversight and control. Three key takeaways: Payroll can be a key to preventing and detecting control The 2020 Update specified the tie between the corporate compliance function and the corporate payroll function. Offshore payments remain a key indicator of a red flag. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the areas articulated in the 2023 ECCP was around payments and payroll. For both the compliance professional and the corporate payroll function, there is a significant role to play in the operationalization of a corporate compliance program. The 2023 ECCP was replete with references to payment and its critical nature to any best practices compliance program. This includes references to payments to foreign officials, payments to third parties, and hiding bribes in payments to distributors. The 2023 ECCP begins with an admonition to stop wasting time on low-hanging fruit when there are much higher risks in your business operations.

The role of payroll in compliance is not often considered in operationalizing your compliance program, yet the monies to fund bribes must come from somewhere. Unfortunately, one of those places is out of payroll. All CCOs need to sit down with their head of payroll, have them explain the role of payroll, and then review the internal controls in place to see how they facilitate compliance goals. From that review, you can then determine how to use payroll to help operationalize your compliance program.

The DOJ has now provided its clearest statement on how it expects a company to actually comply going forward. Long gone are the days where the DOJ simply considered the inputs of a written program as sufficient to protect companies from compliance violations. Yet the mandate to operationalize a corporate compliance program drives home the concept that compliance is a business process that should be administered by the appropriate business unit with the requisite SME. When it comes to following the money, payroll is the most well-suited corporate discipline to provide this first level of oversight and control.

Three key takeaways:

  1. Payroll can be a key to preventing and detecting control
  2. The 2020 Update specified the tie between the corporate compliance function and the corporate payroll function.
  3. Offshore payments remain a key indicator of a red flag.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 471 no 31 Days to a More Effective Compliance Program: Day 7-Compliance Program Use of Data Analytics Matt Galvin, Counsel, Compliance & Data Analytics at the DOJ and one of the experts leading the DOJ's data analytics initiative, highlighted in another talk, the proactive use of data to generate cases related to the FCPA and emphasized that this is just the beginning. The DOJ expects companies to adopt a similar data-driven approach to compliance. In her speech, Argentieri speech she stated, "just as we are upping our game when it comes to data analytics, we expect companies to do the same." This expectation extends beyond simply tracking trainings, policies, and investigations. The DOJ's focus is on monitoring third parties throughout the lifespan of the relationship, not just during the onboarding process. The DOJ's increasing use of data analytics for proactive enforcement signifies a significant shift in their approach to combating white-collar crime. Companies must embrace this data-driven approach to compliance, continuously monitor high-risk transactions, and invest in the necessary resources and technology. By doing so, they can demonstrate effective compliance programs, uncover hidden financial irregularities, and improve overall efficiency.  Three key takeaways: 1. This also means that data analytics in the compliance function has moved from cutting edge to best practice. It soon may simply mean table stakes for compliance. 2. The DOJ is seeking to incentivize an acquiring company to timely disclose misconduct uncovered during the M&A process. 3. The DOJ has made clear that under this new Mergers & Acquisition Safe Harbor Policy organizations that do not perform effective due diligence or self-disclose misconduct at an acquired entity will be subject to full successor liability. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 07 Jan 2024 05:00:00 -0000 Day 7-Compliance Program Use of Data Analytics full 7 Thomas Fox Today we look at DOJ remarks on how compliance should use data analytics. Matt Galvin, Counsel, Compliance & Data Analytics at the DOJ and one of the experts leading the DOJ's data analytics initiative, highlighted in another talk, the proactive use of data to generate cases related to the FCPA and emphasized that this is just the beginning. The DOJ expects companies to adopt a similar data-driven approach to compliance. In her speech, Argentieri speech she stated, "just as we are upping our game when it comes to data analytics, we expect companies to do the same." This expectation extends beyond simply tracking trainings, policies, and investigations. The DOJ's focus is on monitoring third parties throughout the lifespan of the relationship, not just during the onboarding process. The DOJ's increasing use of data analytics for proactive enforcement signifies a significant shift in their approach to combating white-collar crime. Companies must embrace this data-driven approach to compliance, continuously monitor high-risk transactions, and invest in the necessary resources and technology. By doing so, they can demonstrate effective compliance programs, uncover hidden financial irregularities, and improve overall efficiency.  Three key takeaways: 1. This also means that data analytics in the compliance function has moved from cutting edge to best practice. It soon may simply mean table stakes for compliance. 2. The DOJ is seeking to incentivize an acquiring company to timely disclose misconduct uncovered during the M&A process. 3. The DOJ has made clear that under this new Mergers & Acquisition Safe Harbor Policy organizations that do not perform effective due diligence or self-disclose misconduct at an acquired entity will be subject to full successor liability. Learn more about your ad choices. Visit megaphone.fm/adchoices Matt Galvin, Counsel, Compliance & Data Analytics at the DOJ and one of the experts leading the DOJ's data analytics initiative, highlighted in another talk, the proactive use of data to generate cases related to the FCPA and emphasized that this is just the beginning. The DOJ expects companies to adopt a similar data-driven approach to compliance. In her speech, Argentieri speech she stated, "just as we are upping our game when it comes to data analytics, we expect companies to do the same." This expectation extends beyond simply tracking trainings, policies, and investigations. The DOJ's focus is on monitoring third parties throughout the lifespan of the relationship, not just during the onboarding process.

The DOJ's increasing use of data analytics for proactive enforcement signifies a significant shift in their approach to combating white-collar crime. Companies must embrace this data-driven approach to compliance, continuously monitor high-risk transactions, and invest in the necessary resources and technology. By doing so, they can demonstrate effective compliance programs, uncover hidden financial irregularities, and improve overall efficiency.

 Three key takeaways:

1. This also means that data analytics in the compliance function has moved from cutting edge to best practice. It soon may simply mean table stakes for compliance.

2. The DOJ is seeking to incentivize an acquiring company to timely disclose misconduct uncovered during the M&A process.

3. The DOJ has made clear that under this new Mergers & Acquisition Safe Harbor Policy organizations that do not perform effective due diligence or self-disclose misconduct at an acquired entity will be subject to full successor liability.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 504 no 31 Days to a More Effective Compliance Program: Day 6 - DOJ M&A Safe Harbor In October 2023, Deputy Attorney General Lisa Monaco announced a new policy regarding M&A. It is a Mergers & Acquisitions Safe Harbor policy that encourages companies to self-disclose criminal misconduct discovered by an acquiring company during the acquisition of a target company. Under the policy, the acquiring party will receive a presumption of criminal declination if it promptly and voluntarily discloses criminal misconduct, cooperates with any ensuing investigation, and engages in appropriate remediation, restitution and disgorgement. Under this new Mergers & Acquisitions Safe Harbor, which applies across the Department of Justice, companies that promptly and voluntarily disclose criminal misconduct with the Safe Harbor period, and then cooperate with the resulting investigation, engage in timely and appropriate remediation and pay applicable restitution and disgorgement, will receive a presumption of a declination. Once again, the key deadlines are as follows: Companies must disclose misconduct discovered (whether pre-or post-acquisition) at the acquired entity within six (6) months from the date of closing. Companies will then have one year from the date of closing to fully remediate the misconduct. The 6 month and one-year deadlines are subject to modification depending on the specific circumstances and complexity of the transaction. The acquired company can also qualify under the Mergers & Acquisition Safe Harbor Policy for voluntary self-disclosure benefits. Interestingly, DOJ clarified that any misconduct disclosed under the Safe Harbor Policy will not implicate or be counted in any future potential recidivist analysis.   Three key takeaways: 1. The DOJ Mergers & Acquisitions Safe Harbor policy encourages companies to self-disclose criminal misconduct discovered by an acquiring company during the acquisition of a target company. 2. The DOJ is seeking to incentivize an acquiring company to timely disclose misconduct uncovered during the M&A process. 3. The DOJ has made clear that under this new Mergers & Acquisition Safe Harbor Policy organizations that do not perform effective due diligence or self-disclose misconduct at an acquired entity will be subject to full successor liability. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 06 Jan 2024 05:00:00 -0000 Day 6 - DOJ M&A Safe Harbor full 6 Thomas Fox Today we consider the new DOJ M&A Safe Harbor. In October 2023, Deputy Attorney General Lisa Monaco announced a new policy regarding M&A. It is a Mergers & Acquisitions Safe Harbor policy that encourages companies to self-disclose criminal misconduct discovered by an acquiring company during the acquisition of a target company. Under the policy, the acquiring party will receive a presumption of criminal declination if it promptly and voluntarily discloses criminal misconduct, cooperates with any ensuing investigation, and engages in appropriate remediation, restitution and disgorgement. Under this new Mergers & Acquisitions Safe Harbor, which applies across the Department of Justice, companies that promptly and voluntarily disclose criminal misconduct with the Safe Harbor period, and then cooperate with the resulting investigation, engage in timely and appropriate remediation and pay applicable restitution and disgorgement, will receive a presumption of a declination. Once again, the key deadlines are as follows: Companies must disclose misconduct discovered (whether pre-or post-acquisition) at the acquired entity within six (6) months from the date of closing. Companies will then have one year from the date of closing to fully remediate the misconduct. The 6 month and one-year deadlines are subject to modification depending on the specific circumstances and complexity of the transaction. The acquired company can also qualify under the Mergers & Acquisition Safe Harbor Policy for voluntary self-disclosure benefits. Interestingly, DOJ clarified that any misconduct disclosed under the Safe Harbor Policy will not implicate or be counted in any future potential recidivist analysis.   Three key takeaways: 1. The DOJ Mergers & Acquisitions Safe Harbor policy encourages companies to self-disclose criminal misconduct discovered by an acquiring company during the acquisition of a target company. 2. The DOJ is seeking to incentivize an acquiring company to timely disclose misconduct uncovered during the M&A process. 3. The DOJ has made clear that under this new Mergers & Acquisition Safe Harbor Policy organizations that do not perform effective due diligence or self-disclose misconduct at an acquired entity will be subject to full successor liability. Learn more about your ad choices. Visit megaphone.fm/adchoices In October 2023, Deputy Attorney General Lisa Monaco announced a new policy regarding M&A. It is a Mergers & Acquisitions Safe Harbor policy that encourages companies to self-disclose criminal misconduct discovered by an acquiring company during the acquisition of a target company. Under the policy, the acquiring party will receive a presumption of criminal declination if it promptly and voluntarily discloses criminal misconduct, cooperates with any ensuing investigation, and engages in appropriate remediation, restitution and disgorgement.

Under this new Mergers & Acquisitions Safe Harbor, which applies across the Department of Justice, companies that promptly and voluntarily disclose criminal misconduct with the Safe Harbor period, and then cooperate with the resulting investigation, engage in timely and appropriate remediation and pay applicable restitution and disgorgement, will receive a presumption of a declination. Once again, the key deadlines are as follows:

  • Companies must disclose misconduct discovered (whether pre-or post-acquisition) at the acquired entity within six (6) months from the date of closing.
  • Companies will then have one year from the date of closing to fully remediate the misconduct.


The 6 month and one-year deadlines are subject to modification depending on the specific circumstances and complexity of the transaction. The acquired company can also qualify under the Mergers & Acquisition Safe Harbor Policy for voluntary self-disclosure benefits. Interestingly, DOJ clarified that any misconduct disclosed under the Safe Harbor Policy will not implicate or be counted in any future potential recidivist analysis. 

 Three key takeaways:

1. The DOJ Mergers & Acquisitions Safe Harbor policy encourages companies to self-disclose criminal misconduct discovered by an acquiring company during the acquisition of a target company.

2. The DOJ is seeking to incentivize an acquiring company to timely disclose misconduct uncovered during the M&A process.

3. The DOJ has made clear that under this new Mergers & Acquisition Safe Harbor Policy organizations that do not perform effective due diligence or self-disclose misconduct at an acquired entity will be subject to full successor liability.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 503 no 31 Days to a More Effective Compliance Program: Day 5 - Kenneth Polite on Clawbacks Assistant Attorney General Kenneth A. Polite Jr. began his speech on the clawback policy developed by the DOJ to promote “innovative approaches to compensation,” which would “shift the burden of corporate malfeasance away from uninvolved shareholders onto those more directly responsible.” She believes “Companies should ensure that executives and employees are personally invested in promoting compliance,” as “nothing grabs attention or demands personal investment like having skin in the game, through direct and tangible financial incentives.” This led the Criminal Division to “develop guidance, guidance on how to reward corporations with compliance-promoting compensation programs.” The clawback initiative has two parts. “First, every corporate resolution involving the Criminal Division will now include a requirement that the resolving company develop compliance-promoting criteria within its compensation and bonus system. Second is the creation of a 3-year pilot program under which the “Criminal Division will provide fine reductions to companies who seek to claw back compensation from corporate wrongdoers.”  Three key takeaways: 1. The clawback policy was developed to promote “innovative approaches to compensation. 2. Clawbacks will include those who had supervisory authority over the employees or business area engaged in the misconduct and knew of, or were willfully blind to, the misconduct. 3. How far will the DOJ push companies to move for clawbacks, and how far down the chain will it go? Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 05 Jan 2024 05:00:00 -0000 Day 5 - Kenneth Polite on Clawbacks full 5 Thomas Fox Today we review the March 2023, Kenneth Polite Speech on clawbacks. Assistant Attorney General Kenneth A. Polite Jr. began his speech on the clawback policy developed by the DOJ to promote “innovative approaches to compensation,” which would “shift the burden of corporate malfeasance away from uninvolved shareholders onto those more directly responsible.” She believes “Companies should ensure that executives and employees are personally invested in promoting compliance,” as “nothing grabs attention or demands personal investment like having skin in the game, through direct and tangible financial incentives.” This led the Criminal Division to “develop guidance, guidance on how to reward corporations with compliance-promoting compensation programs.” The clawback initiative has two parts. “First, every corporate resolution involving the Criminal Division will now include a requirement that the resolving company develop compliance-promoting criteria within its compensation and bonus system. Second is the creation of a 3-year pilot program under which the “Criminal Division will provide fine reductions to companies who seek to claw back compensation from corporate wrongdoers.”  Three key takeaways: 1. The clawback policy was developed to promote “innovative approaches to compensation. 2. Clawbacks will include those who had supervisory authority over the employees or business area engaged in the misconduct and knew of, or were willfully blind to, the misconduct. 3. How far will the DOJ push companies to move for clawbacks, and how far down the chain will it go? Learn more about your ad choices. Visit megaphone.fm/adchoices Assistant Attorney General Kenneth A. Polite Jr. began his speech on the clawback policy developed by the DOJ to promote “innovative approaches to compensation,” which would “shift the burden of corporate malfeasance away from uninvolved shareholders onto those more directly responsible.” She believes “Companies should ensure that executives and employees are personally invested in promoting compliance,” as “nothing grabs attention or demands personal investment like having skin in the game, through direct and tangible financial incentives.” This led the Criminal Division to “develop guidance, guidance on how to reward corporations with compliance-promoting compensation programs.”

The clawback initiative has two parts. “First, every corporate resolution involving the Criminal Division will now include a requirement that the resolving company develop compliance-promoting criteria within its compensation and bonus system. Second is the creation of a 3-year pilot program under which the “Criminal Division will provide fine reductions to companies who seek to claw back compensation from corporate wrongdoers.”


 Three key takeaways:

1. The clawback policy was developed to promote “innovative approaches to compensation.

2. Clawbacks will include those who had supervisory authority over the employees or business area engaged in the misconduct and knew of, or were willfully blind to, the misconduct.

3. How far will the DOJ push companies to move for clawbacks, and how far down the chain will it go?



Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 517 no 31 Days to a More Effective Compliance Program: Day 4 - The March 2023 Monaco Speech In March, Deputy Attorney General (DAG) Lisa Monaco reviewed a number of initiatives by the DOJ that every compliance professional needs to study in some detail. These new initiatives included: (1) The Criminal Division's Pilot Program Regarding Compensation Incentives and Clawbacks; (2) Evaluation of Corporate Compliance Programs; and (3) Revised Memorandum on Selection of Monitors in Criminal Division Matters. Monaco set the tone for the week by identifying five general areas of DOJ focus. (1) Inspiring a Culture of Compliance; (2) Voluntary Self-Disclosure Programs; (3) Promoting Compliance through Compensation and Clawback Programs; (4) Resource Commitments to Corporate Criminal Enforcement; and (5 ) Individual Accountability.  Three key takeaways: 1. A culture of compliance continues to be the most important component of DOJ review.   2. Self-disclosure will be the number one factor for reducing a potential fine and penalty.  3. Expect more individual accountability.    Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 04 Jan 2024 05:00:00 -0000 Day 4 - The March 2023 Monaco Speech full 4 Thomas Fox Today, we consider the impact of the March 2023 Speech by DAG Lisa Monaco. In March, Deputy Attorney General (DAG) Lisa Monaco reviewed a number of initiatives by the DOJ that every compliance professional needs to study in some detail. These new initiatives included: (1) The Criminal Division's Pilot Program Regarding Compensation Incentives and Clawbacks; (2) Evaluation of Corporate Compliance Programs; and (3) Revised Memorandum on Selection of Monitors in Criminal Division Matters. Monaco set the tone for the week by identifying five general areas of DOJ focus. (1) Inspiring a Culture of Compliance; (2) Voluntary Self-Disclosure Programs; (3) Promoting Compliance through Compensation and Clawback Programs; (4) Resource Commitments to Corporate Criminal Enforcement; and (5 ) Individual Accountability.  Three key takeaways: 1. A culture of compliance continues to be the most important component of DOJ review.   2. Self-disclosure will be the number one factor for reducing a potential fine and penalty.  3. Expect more individual accountability.    Learn more about your ad choices. Visit megaphone.fm/adchoices In March, Deputy Attorney General (DAG) Lisa Monaco reviewed a number of initiatives by the DOJ that every compliance professional needs to study in some detail. These new initiatives included: (1) The Criminal Division's Pilot Program Regarding Compensation Incentives and Clawbacks; (2) Evaluation of Corporate Compliance Programs; and (3) Revised Memorandum on Selection of Monitors in Criminal Division Matters.

Monaco set the tone for the week by identifying five general areas of DOJ focus. (1) Inspiring a Culture of Compliance; (2) Voluntary Self-Disclosure Programs; (3) Promoting Compliance through Compensation and Clawback Programs; (4) Resource Commitments to Corporate Criminal Enforcement; and (5 ) Individual Accountability. 

Three key takeaways:

1. A culture of compliance continues to be the most important component of DOJ review.  

2. Self-disclosure will be the number one factor for reducing a potential fine and penalty. 

3. Expect more individual accountability.   

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 562 no 31 Days to a More Effective Compliance Program: Day 3 - 2023 Evaluation of Compliance Programs: Messaging Apps, Internal Controls and Adequate Compensation Messaging Apps There was a significant addition to the language around messaging apps. The ECCP opened this section by noting, “Messaging applications have become ubiquitous in many markets and offer important platforms for companies to achieve growth and facilitate communication.” For any company under investigation or in a FCPA enforcement action, the DOJ will evaluate its “policies and mechanisms for identifying, reporting, investigating, and remediating potential misconduct and violations of law governing the use of personal devices, communications platforms, and messaging applications, including ephemeral messaging applications.” Internal Compliance Controls Under Section II, entitled Is the Corporation’s Compliance Program Adequately Resourced and Empowered to Function Effectively?  We find the new language, “In this regard, prosecutors should evaluate a corporation’s method for assessing and addressing applicable risks and designing appropriate controls to manage these risks.” This simple sentence packs quite a punch as it requires both appropriate internal compliance controls and then monitoring of those controls to see if they are managing the risks identified in the risk assessment. Adequate Compensation and Salary/Bonus Review for Compliance Under Section III, there is a significant new addition to the ECCP. It forces a company to adequately compensate those employees who investigate and pass judgment on misconduct. But it is more than simply adequate compensation, as it also requires a company not to retaliate via low salaries, limited raises, or other compensation for doing their jobs as compliance officers. In other words, if the CEO is being investigated by compliance, that same CEO should not be setting or reviewing the salary of the CCO or those doing the investigation. This mandates that the DOJ review the entire corporate organization on these issues. Three key takeaways: 1. Communications compliance will be a key issue for compliance professionals going forward in 2024. 2. You must have both appropriate internal controls and ensure they are functioning. 3. In addition to adequate resources, a compliance function must be shown to adequately pay, promote, and protect those involved in compliance investigations. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 03 Jan 2024 05:00:00 -0000 2023 Evaluation of Compliance Programs: Messaging Apps, Internal Controls and Adequate Compensation full 3 Thomas Fox Today we look at the 2023 ECCP on Messaging Apps, Internal Controls and Adequate Compensation. Messaging Apps There was a significant addition to the language around messaging apps. The ECCP opened this section by noting, “Messaging applications have become ubiquitous in many markets and offer important platforms for companies to achieve growth and facilitate communication.” For any company under investigation or in a FCPA enforcement action, the DOJ will evaluate its “policies and mechanisms for identifying, reporting, investigating, and remediating potential misconduct and violations of law governing the use of personal devices, communications platforms, and messaging applications, including ephemeral messaging applications.” Internal Compliance Controls Under Section II, entitled Is the Corporation’s Compliance Program Adequately Resourced and Empowered to Function Effectively?  We find the new language, “In this regard, prosecutors should evaluate a corporation’s method for assessing and addressing applicable risks and designing appropriate controls to manage these risks.” This simple sentence packs quite a punch as it requires both appropriate internal compliance controls and then monitoring of those controls to see if they are managing the risks identified in the risk assessment. Adequate Compensation and Salary/Bonus Review for Compliance Under Section III, there is a significant new addition to the ECCP. It forces a company to adequately compensate those employees who investigate and pass judgment on misconduct. But it is more than simply adequate compensation, as it also requires a company not to retaliate via low salaries, limited raises, or other compensation for doing their jobs as compliance officers. In other words, if the CEO is being investigated by compliance, that same CEO should not be setting or reviewing the salary of the CCO or those doing the investigation. This mandates that the DOJ review the entire corporate organization on these issues. Three key takeaways: 1. Communications compliance will be a key issue for compliance professionals going forward in 2024. 2. You must have both appropriate internal controls and ensure they are functioning. 3. In addition to adequate resources, a compliance function must be shown to adequately pay, promote, and protect those involved in compliance investigations. Learn more about your ad choices. Visit megaphone.fm/adchoices Messaging Apps

There was a significant addition to the language around messaging apps. The ECCP opened this section by noting, “Messaging applications have become ubiquitous in many markets and offer important platforms for companies to achieve growth and facilitate communication.” For any company under investigation or in a FCPA enforcement action, the DOJ will evaluate its “policies and mechanisms for identifying, reporting, investigating, and remediating potential misconduct and violations of law governing the use of personal devices, communications platforms, and messaging applications, including ephemeral messaging applications.”


Internal Compliance Controls

Under Section II, entitled Is the Corporation’s Compliance Program Adequately Resourced and Empowered to Function Effectively?  We find the new language, “In this regard, prosecutors should evaluate a corporation’s method for assessing and addressing applicable risks and designing appropriate controls to manage these risks.” This simple sentence packs quite a punch as it requires both appropriate internal compliance controls and then monitoring of those controls to see if they are managing the risks identified in the risk assessment.


Adequate Compensation and Salary/Bonus Review for Compliance

Under Section III, there is a significant new addition to the ECCP. It forces a company to adequately compensate those employees who investigate and pass judgment on misconduct. But it is more than simply adequate compensation, as it also requires a company not to retaliate via low salaries, limited raises, or other compensation for doing their jobs as compliance officers. In other words, if the CEO is being investigated by compliance, that same CEO should not be setting or reviewing the salary of the CCO or those doing the investigation. This mandates that the DOJ review the entire corporate organization on these issues.


Three key takeaways:

1. Communications compliance will be a key issue for compliance professionals going forward in 2024.

2. You must have both appropriate internal controls and ensure they are functioning.

3. In addition to adequate resources, a compliance function must be shown to adequately pay, promote, and protect those involved in compliance investigations.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 464 no 31 Days to a More Effective Compliance Program: Day 2 - 2023 Evaluation of Compliance Programs: Incentives and Consequences The 2023 ECCP had significant changes regarding compliance-based incentives, both financial and non-financial; consequence management; messaging apps; and ancillary matters. I.               Incentives This section begins with a new introduction that makes clear the seriousness in which the DOJ views incentives, both financial and other types of incentives. The ECCP states, “The design and implementation of compensation schemes play an important role in fostering a compliance culture." The ECCP also added a new section on financial incentives, which directs prosecutors to specifically evaluate how a company designs and applies financial incentives. These four questions basically breakdown into the following continuum: (1) Assessment, (2) Analysis, (3) Implementation; and (4) Monitoring. II.             Consequence Management The DOJ has been talking about clawbacks for some time now. However, the revised language of the ECCP puts more rigor into what the DOJ is now mandating.  a.         Clawbacks The DOJ has made it clear that companies need to seek to recover amounts paid out to executives that were illegally received as corporate compensation. This could include both salary, stock options, similar payments, or discretionary bonuses. All of this means every compliance program will need to analyze each of these components as set out. b.         Consequence Management The DOJ also mandated that compliance programs take a deeper dive into their entire financial incentive program—both incentives and disincentives. While there is some overlap with the clawback language, there is quite a bit of newness in these areas. The DOJ's hotline and speak-up reports directly relate to a company’s culture of compliance. Three key takeaways: 1. The 2023 EECP brought significant changes to both financial incentives and negative consequences as well. 2. The new financial incentives analysis is: (1) Assessment, (2) Analysis, (3) Implementation; and (4) Monitoring. 3. Clawbacks and Consequence Manage are related but separate parts of a best practices compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 02 Jan 2024 05:00:00 -0000 Day 2 - 2023 Evaluation of Compliance Programs: Incentives and Consequences full Thomas Fox What did the DOJ say about clawbacks and incentives? The 2023 ECCP had significant changes regarding compliance-based incentives, both financial and non-financial; consequence management; messaging apps; and ancillary matters. I.               Incentives This section begins with a new introduction that makes clear the seriousness in which the DOJ views incentives, both financial and other types of incentives. The ECCP states, “The design and implementation of compensation schemes play an important role in fostering a compliance culture." The ECCP also added a new section on financial incentives, which directs prosecutors to specifically evaluate how a company designs and applies financial incentives. These four questions basically breakdown into the following continuum: (1) Assessment, (2) Analysis, (3) Implementation; and (4) Monitoring. II.             Consequence Management The DOJ has been talking about clawbacks for some time now. However, the revised language of the ECCP puts more rigor into what the DOJ is now mandating.  a.         Clawbacks The DOJ has made it clear that companies need to seek to recover amounts paid out to executives that were illegally received as corporate compensation. This could include both salary, stock options, similar payments, or discretionary bonuses. All of this means every compliance program will need to analyze each of these components as set out. b.         Consequence Management The DOJ also mandated that compliance programs take a deeper dive into their entire financial incentive program—both incentives and disincentives. While there is some overlap with the clawback language, there is quite a bit of newness in these areas. The DOJ's hotline and speak-up reports directly relate to a company’s culture of compliance. Three key takeaways: 1. The 2023 EECP brought significant changes to both financial incentives and negative consequences as well. 2. The new financial incentives analysis is: (1) Assessment, (2) Analysis, (3) Implementation; and (4) Monitoring. 3. Clawbacks and Consequence Manage are related but separate parts of a best practices compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2023 ECCP had significant changes regarding compliance-based incentives, both financial and non-financial; consequence management; messaging apps; and ancillary matters.

I.               Incentives

This section begins with a new introduction that makes clear the seriousness in which the DOJ views incentives, both financial and other types of incentives. The ECCP states, “The design and implementation of compensation schemes play an important role in fostering a compliance culture."

The ECCP also added a new section on financial incentives, which directs prosecutors to specifically evaluate how a company designs and applies financial incentives. These four questions basically breakdown into the following continuum: (1) Assessment, (2) Analysis, (3) Implementation; and (4) Monitoring.

II.             Consequence Management

The DOJ has been talking about clawbacks for some time now. However, the revised language of the ECCP puts more rigor into what the DOJ is now mandating.

 a.         Clawbacks

The DOJ has made it clear that companies need to seek to recover amounts paid out to executives that were illegally received as corporate compensation. This could include both salary, stock options, similar payments, or discretionary bonuses. All of this means every compliance program will need to analyze each of these components as set out.

b.         Consequence Management

The DOJ also mandated that compliance programs take a deeper dive into their entire financial incentive program—both incentives and disincentives. While there is some overlap with the clawback language, there is quite a bit of newness in these areas. The DOJ's hotline and speak-up reports directly relate to a company’s culture of compliance.


Three key takeaways:

1. The 2023 EECP brought significant changes to both financial incentives and negative consequences as well.

2. The new financial incentives analysis is: (1) Assessment, (2) Analysis, (3) Implementation; and (4) Monitoring.

3. Clawbacks and Consequence Manage are related but separate parts of a best practices compliance program.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 522 no 31 Days to a More Effective Compliance Program: Day 1 - What 2023 Brought to Compliance 2023 was a very significant year for every compliance practitioner and compliance program. While there was a paucity of corporate enforcement actions under the Foreign Corrupt Practices Act (FCPA), there were significant announcements from the Department of Justice (DOJ) that directly impacted compliance professionals and compliance programs. The first came in January, and it was an update to the Evaluation of Corporate Compliance Programs (2023 ECCP). Next, we heard speeches about the increased focus on clawbacks and other areas of consequence management. In October, Deputy Attorney General (DAG) Lisa Monaco introduced a new Mergers & Acquisitions Safe Harbor Policy in October. Finally, in late November, Acting Principal Deputy Assistant Attorney General Nicole M. Argentieri Delivered remarks at the 39th International Conference on the Foreign Corrupt Practices Act (FCPA) on the use of data analytics in a compliance program and DOJ expectations going forward. The 2023 ECCP brought forward several new initiatives laid out in the 2020 Update to the Evaluation of Corporate Compliance Programs, including additions and deletions. In October 2023, Deputy Attorney General Lisa Monaco announced a new policy regarding M&A. It is a Mergers & Acquisitions Safe Harbor policy that encourages companies to self-disclose criminal misconduct discovered by an acquiring company during the acquisition of a target company. In November, Nicole Argentieri, Acting Assistant Attorney General for the Criminal Division, speaking at the ACI National FCPA, reported that the DOJ is stepping up its own use of data analytics to identify instances of corporate misconduct and will boost its cooperation with overseas law enforcement to bring more anti-corruption cases as well. The DOJ and SEC are increasingly focusing on data analytics for corporate compliance, signaling higher expectations for larger companies. Both agencies have successfully utilized data analytics in various areas, such as securities and healthcare fraud, and are actively improving their own capabilities in this field. She made several important points for all compliance professionals, which will be significant going forward into 2024 and beyond. Three key takeaways: 1. 2023 was a key year for the DOJ's evolution in its views on compliance programs. 2. Clawbacks, incentives, and consequence management have become more important. 3. The new DOJ safe harbor initiative for M&A raises many questions. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 01 Jan 2024 17:39:00 -0000 Day 1 - What 2023 Brought to Compliance full 1 Thomas Fox What did 2023 mean for compliance? 2023 was a very significant year for every compliance practitioner and compliance program. While there was a paucity of corporate enforcement actions under the Foreign Corrupt Practices Act (FCPA), there were significant announcements from the Department of Justice (DOJ) that directly impacted compliance professionals and compliance programs. The first came in January, and it was an update to the Evaluation of Corporate Compliance Programs (2023 ECCP). Next, we heard speeches about the increased focus on clawbacks and other areas of consequence management. In October, Deputy Attorney General (DAG) Lisa Monaco introduced a new Mergers & Acquisitions Safe Harbor Policy in October. Finally, in late November, Acting Principal Deputy Assistant Attorney General Nicole M. Argentieri Delivered remarks at the 39th International Conference on the Foreign Corrupt Practices Act (FCPA) on the use of data analytics in a compliance program and DOJ expectations going forward. The 2023 ECCP brought forward several new initiatives laid out in the 2020 Update to the Evaluation of Corporate Compliance Programs, including additions and deletions. In October 2023, Deputy Attorney General Lisa Monaco announced a new policy regarding M&A. It is a Mergers & Acquisitions Safe Harbor policy that encourages companies to self-disclose criminal misconduct discovered by an acquiring company during the acquisition of a target company. In November, Nicole Argentieri, Acting Assistant Attorney General for the Criminal Division, speaking at the ACI National FCPA, reported that the DOJ is stepping up its own use of data analytics to identify instances of corporate misconduct and will boost its cooperation with overseas law enforcement to bring more anti-corruption cases as well. The DOJ and SEC are increasingly focusing on data analytics for corporate compliance, signaling higher expectations for larger companies. Both agencies have successfully utilized data analytics in various areas, such as securities and healthcare fraud, and are actively improving their own capabilities in this field. She made several important points for all compliance professionals, which will be significant going forward into 2024 and beyond. Three key takeaways: 1. 2023 was a key year for the DOJ's evolution in its views on compliance programs. 2. Clawbacks, incentives, and consequence management have become more important. 3. The new DOJ safe harbor initiative for M&A raises many questions. Learn more about your ad choices. Visit megaphone.fm/adchoices 2023 was a very significant year for every compliance practitioner and compliance program. While there was a paucity of corporate enforcement actions under the Foreign Corrupt Practices Act (FCPA), there were significant announcements from the Department of Justice (DOJ) that directly impacted compliance professionals and compliance programs.

The first came in January, and it was an update to the Evaluation of Corporate Compliance Programs (2023 ECCP). Next, we heard speeches about the increased focus on clawbacks and other areas of consequence management. In October, Deputy Attorney General (DAG) Lisa Monaco introduced a new Mergers & Acquisitions Safe Harbor Policy in October. Finally, in late November, Acting Principal Deputy Assistant Attorney General Nicole M. Argentieri Delivered remarks at the 39th International Conference on the Foreign Corrupt Practices Act (FCPA) on the use of data analytics in a compliance program and DOJ expectations going forward.

The 2023 ECCP brought forward several new initiatives laid out in the 2020 Update to the Evaluation of Corporate Compliance Programs, including additions and deletions.

In October 2023, Deputy Attorney General Lisa Monaco announced a new policy regarding M&A. It is a Mergers & Acquisitions Safe Harbor policy that encourages companies to self-disclose criminal misconduct discovered by an acquiring company during the acquisition of a target company.

In November, Nicole Argentieri, Acting Assistant Attorney General for the Criminal Division, speaking at the ACI National FCPA, reported that the DOJ is stepping up its own use of data analytics to identify instances of corporate misconduct and will boost its cooperation with overseas law enforcement to bring more anti-corruption cases as well. The DOJ and SEC are increasingly focusing on data analytics for corporate compliance, signaling higher expectations for larger companies. Both agencies have successfully utilized data analytics in various areas, such as securities and healthcare fraud, and are actively improving their own capabilities in this field. She made several important points for all compliance professionals, which will be significant going forward into 2024 and beyond.


Three key takeaways:

1. 2023 was a key year for the DOJ's evolution in its views on compliance programs.

2. Clawbacks, incentives, and consequence management have become more important.

3. The new DOJ safe harbor initiative for M&A raises many questions.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 474 no One Month to a More Effective Compliance Program: Day 18-Strategic Considerations for Implementing AI in Compliance What are the key factors that impact these strategic considerations for implementing AI in compliance, exploring the tradeoffs, challenges, and importance of considering the impact on decision-making. Key Considerations 1.     Understand the impact of AI on the company.  2.     Maintain an inventory of all tools used.  3.     Understand the tools for cost efficiency and risk avoidance.  4.     Involve all business sectors in AI discussions.  5.     Utilize AI for better data usage in compliance. While implementing AI in compliance brings numerous benefits, there are tradeoffs and challenges to consider. One tradeoff is the need to balance exploration and innovation with rules and regulations. Another challenge is the selection of AI tools.  Implementing AI in compliance requires strategic considerations and decision-making. Understanding the impact of AI, maintaining an inventory of tools, considering cost efficiency and risk avoidance, involving all business sectors, and utilizing AI for better data usage are key factors to consider. Balancing exploration and rules, as well as selecting the right AI tools, are challenges that need to be addressed. By carefully navigating these considerations and challenges, companies can leverage AI to enhance their compliance programs and stay ahead in an ever-evolving regulatory landscape.  Three key takeaways: 1. What are the key factors that impact these strategic considerations for implementing AI in compliance? 2. Compliance professionals need to stay updated with the latest AI developments and trends, which requires continuous learning and keeping abreast of industry news and insights. 3. Understanding the impact of AI, maintaining an inventory of tools, considering cost efficiency and risk avoidance, involving all business sectors, and utilizing AI for better data usage are key factors to consider. For More information on KonaAI, click here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 29 Dec 2023 05:00:00 -0000 Day 18-Strategic Considerations for Implementing AI in Compliance full 18 Thomas Fox We conclude this month by looking at key strategic considerations for implementing AI. What are the key factors that impact these strategic considerations for implementing AI in compliance, exploring the tradeoffs, challenges, and importance of considering the impact on decision-making. Key Considerations 1.     Understand the impact of AI on the company.  2.     Maintain an inventory of all tools used.  3.     Understand the tools for cost efficiency and risk avoidance.  4.     Involve all business sectors in AI discussions.  5.     Utilize AI for better data usage in compliance. While implementing AI in compliance brings numerous benefits, there are tradeoffs and challenges to consider. One tradeoff is the need to balance exploration and innovation with rules and regulations. Another challenge is the selection of AI tools.  Implementing AI in compliance requires strategic considerations and decision-making. Understanding the impact of AI, maintaining an inventory of tools, considering cost efficiency and risk avoidance, involving all business sectors, and utilizing AI for better data usage are key factors to consider. Balancing exploration and rules, as well as selecting the right AI tools, are challenges that need to be addressed. By carefully navigating these considerations and challenges, companies can leverage AI to enhance their compliance programs and stay ahead in an ever-evolving regulatory landscape.  Three key takeaways: 1. What are the key factors that impact these strategic considerations for implementing AI in compliance? 2. Compliance professionals need to stay updated with the latest AI developments and trends, which requires continuous learning and keeping abreast of industry news and insights. 3. Understanding the impact of AI, maintaining an inventory of tools, considering cost efficiency and risk avoidance, involving all business sectors, and utilizing AI for better data usage are key factors to consider. For More information on KonaAI, click here.  Learn more about your ad choices. Visit megaphone.fm/adchoices What are the key factors that impact these strategic considerations for implementing AI in compliance, exploring the tradeoffs, challenges, and importance of considering the impact on decision-making.

Key Considerations

1.     Understand the impact of AI on the company. 

2.     Maintain an inventory of all tools used. 

3.     Understand the tools for cost efficiency and risk avoidance. 

4.     Involve all business sectors in AI discussions. 

5.     Utilize AI for better data usage in compliance.

While implementing AI in compliance brings numerous benefits, there are tradeoffs and challenges to consider. One tradeoff is the need to balance exploration and innovation with rules and regulations. Another challenge is the selection of AI tools. 

Implementing AI in compliance requires strategic considerations and decision-making. Understanding the impact of AI, maintaining an inventory of tools, considering cost efficiency and risk avoidance, involving all business sectors, and utilizing AI for better data usage are key factors to consider. Balancing exploration and rules, as well as selecting the right AI tools, are challenges that need to be addressed. By carefully navigating these considerations and challenges, companies can leverage AI to enhance their compliance programs and stay ahead in an ever-evolving regulatory landscape.


 Three key takeaways:

1. What are the key factors that impact these strategic considerations for implementing AI in compliance?

2. Compliance professionals need to stay updated with the latest AI developments and trends, which requires continuous learning and keeping abreast of industry news and insights.

3. Understanding the impact of AI, maintaining an inventory of tools, considering cost efficiency and risk avoidance, involving all business sectors, and utilizing AI for better data usage are key factors to consider.

For More information on KonaAI, click here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 434 no One Month to a More Effective Compliance Program Through Data Analytics: Day 17-Adapting Compliance Programs for Cloud Technologies As organizations transition to remote work and embrace cloud technologies, it is crucial to adapt compliance programs to ensure regulatory obligations are met.  Companies are shifting away from traditional tools like Excel or SharePoint towards centralized systems that facilitate compliance monitoring. Compliance teams can no longer rely on face-to-face collaboration and need systems to manage communication, investigations, and case management. This shift towards virtual platforms for communication has also increased the need to capture and record voice data for compliance purposes. Adapting compliance programs for remote work and cloud technologies is essential in the current business landscape. Compliance program visibility, capturing and recording communication data, leveraging cloud technologies, and embracing AI-driven compliance monitoring are key factors to consider. By balancing these factors and focusing on risk-based approaches, organizations can ensure they meet their regulatory obligations while enabling their compliance teams to focus on their core responsibilities. The future holds even more advancements in cloud technologies and AI, promising increased defensibility and improved compliance monitoring capabilities.  Three key takeaways: 1. Companies are shifting away from traditional tools like Excel or SharePoint towards centralized systems that facilitate compliance monitoring. 2. You must focus on the explainability  and defensibility of your AI models. 3. By focusing on risk-based approaches, organizations can ensure they meet their regulatory obligations while enabling their compliance teams to focus on their core responsibilities. For more information on KonaAI, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 28 Dec 2023 13:16:00 -0000 Day 17-Adapting Compliance Programs for Cloud Technologies full 17 Thomas Fox We next consider the role of compliance in cloud technologies. As organizations transition to remote work and embrace cloud technologies, it is crucial to adapt compliance programs to ensure regulatory obligations are met.  Companies are shifting away from traditional tools like Excel or SharePoint towards centralized systems that facilitate compliance monitoring. Compliance teams can no longer rely on face-to-face collaboration and need systems to manage communication, investigations, and case management. This shift towards virtual platforms for communication has also increased the need to capture and record voice data for compliance purposes. Adapting compliance programs for remote work and cloud technologies is essential in the current business landscape. Compliance program visibility, capturing and recording communication data, leveraging cloud technologies, and embracing AI-driven compliance monitoring are key factors to consider. By balancing these factors and focusing on risk-based approaches, organizations can ensure they meet their regulatory obligations while enabling their compliance teams to focus on their core responsibilities. The future holds even more advancements in cloud technologies and AI, promising increased defensibility and improved compliance monitoring capabilities.  Three key takeaways: 1. Companies are shifting away from traditional tools like Excel or SharePoint towards centralized systems that facilitate compliance monitoring. 2. You must focus on the explainability  and defensibility of your AI models. 3. By focusing on risk-based approaches, organizations can ensure they meet their regulatory obligations while enabling their compliance teams to focus on their core responsibilities. For more information on KonaAI, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices As organizations transition to remote work and embrace cloud technologies, it is crucial to adapt compliance programs to ensure regulatory obligations are met. 

Companies are shifting away from traditional tools like Excel or SharePoint towards centralized systems that facilitate compliance monitoring. Compliance teams can no longer rely on face-to-face collaboration and need systems to manage communication, investigations, and case management. This shift towards virtual platforms for communication has also increased the need to capture and record voice data for compliance purposes.

Adapting compliance programs for remote work and cloud technologies is essential in the current business landscape. Compliance program visibility, capturing and recording communication data, leveraging cloud technologies, and embracing AI-driven compliance monitoring are key factors to consider. By balancing these factors and focusing on risk-based approaches, organizations can ensure they meet their regulatory obligations while enabling their compliance teams to focus on their core responsibilities. The future holds even more advancements in cloud technologies and AI, promising increased defensibility and improved compliance monitoring capabilities.

 Three key takeaways:

1. Companies are shifting away from traditional tools like Excel or SharePoint towards centralized systems that facilitate compliance monitoring.

2. You must focus on the explainability  and defensibility of your AI models.

3. By focusing on risk-based approaches, organizations can ensure they meet their regulatory obligations while enabling their compliance teams to focus on their core responsibilities.

For more information on KonaAI, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 434 no One Month to a More Effective Compliance Program Through Data Analytics: Day 16 - AI and Data Driven Compliance for Remote Work To address this challenge, AI-powered data cleansing capabilities have been developed. These capabilities sift through content and focus on relevant and risky information while minimizing false positives. By removing duplicative content, obvious junk, and non-human generated text, compliance teams can efficiently focus on the content that is potentially risky. This targeted approach significantly reduces false positives in the alerts generated by the system. The Covid-19 brought changes that are still being felt today in the business world. Some changes were temporary, but some have become permanent and remote work is one of them. It is clearly here to stay. The change has underscored the importance of AI and data in compliance across various industries. The shift to remote work has resulted in an increased amount of data that compliance teams must proactively monitor. AI-powered data cleansing capabilities help sift through content and focus on relevant and risky information, while AI algorithms and machine learning models aid in risk detection. By leveraging AI and data, compliance teams can enhance their prevention, detection, and remediation efforts, ultimately promoting a culture of ethical behavior and ensuring compliance with data protection laws.  Three key takeaways: The pandemic changed the corporate world in many ways. One of the permanent ones was moving to remote work. Remote work generates much more data because messaging apps and online communication tools require new and innovative compliance solutions. AI and data-driven compliance around data generated from remote work can move a company from detection to prevention. For more information on KonaAI, click here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 28 Dec 2023 12:58:00 -0000 Day 16- Data Driven Compliance for Remote Work full 16 Thomas Fox How has remote work benefitted from data-driven compliance. To address this challenge, AI-powered data cleansing capabilities have been developed. These capabilities sift through content and focus on relevant and risky information while minimizing false positives. By removing duplicative content, obvious junk, and non-human generated text, compliance teams can efficiently focus on the content that is potentially risky. This targeted approach significantly reduces false positives in the alerts generated by the system. The Covid-19 brought changes that are still being felt today in the business world. Some changes were temporary, but some have become permanent and remote work is one of them. It is clearly here to stay. The change has underscored the importance of AI and data in compliance across various industries. The shift to remote work has resulted in an increased amount of data that compliance teams must proactively monitor. AI-powered data cleansing capabilities help sift through content and focus on relevant and risky information, while AI algorithms and machine learning models aid in risk detection. By leveraging AI and data, compliance teams can enhance their prevention, detection, and remediation efforts, ultimately promoting a culture of ethical behavior and ensuring compliance with data protection laws.  Three key takeaways: The pandemic changed the corporate world in many ways. One of the permanent ones was moving to remote work. Remote work generates much more data because messaging apps and online communication tools require new and innovative compliance solutions. AI and data-driven compliance around data generated from remote work can move a company from detection to prevention. For more information on KonaAI, click here.  Learn more about your ad choices. Visit megaphone.fm/adchoices To address this challenge, AI-powered data cleansing capabilities have been developed. These capabilities sift through content and focus on relevant and risky information while minimizing false positives. By removing duplicative content, obvious junk, and non-human generated text, compliance teams can efficiently focus on the content that is potentially risky. This targeted approach significantly reduces false positives in the alerts generated by the system.

The Covid-19 brought changes that are still being felt today in the business world. Some changes were temporary, but some have become permanent and remote work is one of them. It is clearly here to stay. The change has underscored the importance of AI and data in compliance across various industries. The shift to remote work has resulted in an increased amount of data that compliance teams must proactively monitor. AI-powered data cleansing capabilities help sift through content and focus on relevant and risky information, while AI algorithms and machine learning models aid in risk detection. By leveraging AI and data, compliance teams can enhance their prevention, detection, and remediation efforts, ultimately promoting a culture of ethical behavior and ensuring compliance with data protection laws.

 Three key takeaways:

  1. The pandemic changed the corporate world in many ways. One of the permanent ones was moving to remote work.
  2. Remote work generates much more data because messaging apps and online communication tools require new and innovative compliance solutions.
  3. AI and data-driven compliance around data generated from remote work can move a company from detection to prevention.


For more information on KonaAI, click here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 434 no One Month to a More Effective Compliance Program Through Data Analytics - Day 15: Data Analytics - Fuel that Powers Both Law and Compliance Data analytics is revolutionizing the field of law and compliance, providing valuable insights and enhancing effectiveness. Data analytics is often referred to as the fuel that moves the compliance engine. It provides the necessary insights to make informed decisions and drive compliance programs effectively. By analyzing data, compliance professionals can gain a deeper understanding of their organization, such as the number of employees per region, which can inform communication strategies and training initiatives. Simply put, to become a better compliance professional, you must become a better businessperson.  This underscores the importance of understanding the business context and using data analytics as a tool to drive compliance efforts. Data analytics is of utmost importance in the field of law and compliance. It provides valuable insights, enhances effectiveness, and drives compliance programs. Compliance professionals must strive to become better businesspeople and understand the role of data analytics as the fuel that moves the compliance engine. By leveraging data analytics, law firms like Thinkeen can offer innovative solutions for complex transactions. However, education and awareness about the importance of data analytics are still needed to fully harness its potential. Balancing tradeoffs and addressing challenges associated with data analytics are crucial for successful implementation. Ultimately, data analytics is a powerful tool that can transform the way laws and compliance are approached, leading to more effective and efficient outcomes.  Three key takeaways: 1. Data analytics is often referred to as the fuel that moves the compliance engine. 2. We need more education and awareness about the importance of understanding data so that you can extract the right information 3. Data analytics is a powerful tool that can transform the way law and compliance are approached, leading to more effective and efficient outcomes. For more information on KonaAI, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 21 Dec 2023 13:32:00 -0000 Day 15: Data Analytics - Fuel that Powers Both Law and Compliance full 15 Thomas Fox How data analytics fuels both compliance and law. Data analytics is revolutionizing the field of law and compliance, providing valuable insights and enhancing effectiveness. Data analytics is often referred to as the fuel that moves the compliance engine. It provides the necessary insights to make informed decisions and drive compliance programs effectively. By analyzing data, compliance professionals can gain a deeper understanding of their organization, such as the number of employees per region, which can inform communication strategies and training initiatives. Simply put, to become a better compliance professional, you must become a better businessperson.  This underscores the importance of understanding the business context and using data analytics as a tool to drive compliance efforts. Data analytics is of utmost importance in the field of law and compliance. It provides valuable insights, enhances effectiveness, and drives compliance programs. Compliance professionals must strive to become better businesspeople and understand the role of data analytics as the fuel that moves the compliance engine. By leveraging data analytics, law firms like Thinkeen can offer innovative solutions for complex transactions. However, education and awareness about the importance of data analytics are still needed to fully harness its potential. Balancing tradeoffs and addressing challenges associated with data analytics are crucial for successful implementation. Ultimately, data analytics is a powerful tool that can transform the way laws and compliance are approached, leading to more effective and efficient outcomes.  Three key takeaways: 1. Data analytics is often referred to as the fuel that moves the compliance engine. 2. We need more education and awareness about the importance of understanding data so that you can extract the right information 3. Data analytics is a powerful tool that can transform the way law and compliance are approached, leading to more effective and efficient outcomes. For more information on KonaAI, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Data analytics is revolutionizing the field of law and compliance, providing valuable insights and enhancing effectiveness. Data analytics is often referred to as the fuel that moves the compliance engine. It provides the necessary insights to make informed decisions and drive compliance programs effectively. By analyzing data, compliance professionals can gain a deeper understanding of their organization, such as the number of employees per region, which can inform communication strategies and training initiatives. Simply put, to become a better compliance professional, you must become a better businessperson.  This underscores the importance of understanding the business context and using data analytics as a tool to drive compliance efforts.

Data analytics is of utmost importance in the field of law and compliance. It provides valuable insights, enhances effectiveness, and drives compliance programs. Compliance professionals must strive to become better businesspeople and understand the role of data analytics as the fuel that moves the compliance engine. By leveraging data analytics, law firms like Thinkeen can offer innovative solutions for complex transactions. However, education and awareness about the importance of data analytics are still needed to fully harness its potential. Balancing tradeoffs and addressing challenges associated with data analytics are crucial for successful implementation. Ultimately, data analytics is a powerful tool that can transform the way laws and compliance are approached, leading to more effective and efficient outcomes.

 Three key takeaways:

1. Data analytics is often referred to as the fuel that moves the compliance engine.

2. We need more education and awareness about the importance of understanding data so that you can extract the right information

3. Data analytics is a powerful tool that can transform the way law and compliance are approached, leading to more effective and efficient outcomes.

For more information on KonaAI, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 434 no One Month to a More Effective Compliance Program Through Data Analytics: Day 14 - Continuous Converged Compliance How can you integrate compliance, risk management, and your security framework? Igor Volovich, Vice President, Compliance Strategy at Qmulos, introduced the innovative concept to this discussion: Converged Continuous Compliance. This approach aims to reunite compliance, security, and risk management, which have historically operated independently. One of the key requirements impacting this new approach is the need to bridge the gap between these functions from both a data and human perspective. These concepts serve as a translator, helping organizations navigate the complex landscape of compliance, security, and risk management. By speaking the language of these three functions, Converged Continuous Compliance brings them together and facilitates collaboration. Corporate compliance needs to promote new approaches to compliance and risk management by challenging misconceptions, reuniting compliance, security, and risk management, emphasizing data governance oversight, and advocating for automation. These approaches aim to enhance efficiency, increase trust in compliance reports, and ultimately drive a greater return on investment. As organizations navigate the ever-evolving landscape of compliance, it is crucial to consider the impact of new approaches and strike a balance between different factors to achieve effective compliance and risk management.  Three key takeaways: The DOJ has stated that a chief compliance officer and a corporate compliance function must have visibility across all data sets in an organization. Converged Continuous Compliance aligns with this message. The bottom line is that we have accepted certain models of how compliance is done, what compliance means, what it delivers to the enterprise, and what it fails to deliver to the enterprise. It is crucial to consider the impact of new approaches and strike a balance between different factors to achieve effective compliance and risk management. For more information on KonaAI, click here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 20 Dec 2023 05:00:00 -0000 Day 14 - Continuous Converged Compliance full 14 Thomas Fox Today, we consider the concept of Continuous Converged Compliance. How can you integrate compliance, risk management, and your security framework? Igor Volovich, Vice President, Compliance Strategy at Qmulos, introduced the innovative concept to this discussion: Converged Continuous Compliance. This approach aims to reunite compliance, security, and risk management, which have historically operated independently. One of the key requirements impacting this new approach is the need to bridge the gap between these functions from both a data and human perspective. These concepts serve as a translator, helping organizations navigate the complex landscape of compliance, security, and risk management. By speaking the language of these three functions, Converged Continuous Compliance brings them together and facilitates collaboration. Corporate compliance needs to promote new approaches to compliance and risk management by challenging misconceptions, reuniting compliance, security, and risk management, emphasizing data governance oversight, and advocating for automation. These approaches aim to enhance efficiency, increase trust in compliance reports, and ultimately drive a greater return on investment. As organizations navigate the ever-evolving landscape of compliance, it is crucial to consider the impact of new approaches and strike a balance between different factors to achieve effective compliance and risk management.  Three key takeaways: The DOJ has stated that a chief compliance officer and a corporate compliance function must have visibility across all data sets in an organization. Converged Continuous Compliance aligns with this message. The bottom line is that we have accepted certain models of how compliance is done, what compliance means, what it delivers to the enterprise, and what it fails to deliver to the enterprise. It is crucial to consider the impact of new approaches and strike a balance between different factors to achieve effective compliance and risk management. For more information on KonaAI, click here.  Learn more about your ad choices. Visit megaphone.fm/adchoices How can you integrate compliance, risk management, and your security framework? Igor Volovich, Vice President, Compliance Strategy at Qmulos, introduced the innovative concept to this discussion: Converged Continuous Compliance. This approach aims to reunite compliance, security, and risk management, which have historically operated independently.

One of the key requirements impacting this new approach is the need to bridge the gap between these functions from both a data and human perspective. These concepts serve as a translator, helping organizations navigate the complex landscape of compliance, security, and risk management. By speaking the language of these three functions, Converged Continuous Compliance brings them together and facilitates collaboration.

Corporate compliance needs to promote new approaches to compliance and risk management by challenging misconceptions, reuniting compliance, security, and risk management, emphasizing data governance oversight, and advocating for automation. These approaches aim to enhance efficiency, increase trust in compliance reports, and ultimately drive a greater return on investment. As organizations navigate the ever-evolving landscape of compliance, it is crucial to consider the impact of new approaches and strike a balance between different factors to achieve effective compliance and risk management.

 Three key takeaways:

  1. The DOJ has stated that a chief compliance officer and a corporate compliance function must have visibility across all data sets in an organization. Converged Continuous Compliance aligns with this message.
  2. The bottom line is that we have accepted certain models of how compliance is done, what compliance means, what it delivers to the enterprise, and what it fails to deliver to the enterprise.
  3. It is crucial to consider the impact of new approaches and strike a balance between different factors to achieve effective compliance and risk management.


For more information on KonaAI, click here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 434 no One Month to a More Effective Compliance Program Through Data Analytics: Day 13 - Data Management Automation Data automation not only streamlines the compliance process but also provides transparency and visibility into the decision-making process. There is a clear importance to connecting people, data, process systems, and tools in one place. This eliminates the need for compliance officers to navigate multiple systems and tools, allowing them to focus on risk-based due diligence. By having a clear understanding of the decision tree and the ability to adjust the automation process, organizations can trust the automation while maintaining control and oversight. The importance of automation for data analysis in compliance programs cannot be overstated. Organizations need to have visibility into their data at their fingertips to ensure regulatory compliance and mitigate risks. Automation streamlines the compliance process, provides transparency, and allows for adaptability in the face of evolving regulations and risks. By leveraging data analysis, organizations can identify deviations, improve cycle times, enhance training effectiveness, and make informed decisions. Board-level involvement is crucial in overseeing the automation and data analysis process, recognizing its strategic value, and ensuring its effective implementation. With the advent of AI and intelligent approaches, organizations that do not embrace automation and data analysis may suffer in the long run. Trust but verify, and always prioritize visibility and transparency in compliance programs.  Three key takeaways: Automation not only streamlines the compliance process but also provides transparency and visibility into the decision-making process. There is a need for board-level involvement in overseeing the automation and data analysis processes. Through analyzing deviations from the expected path, compliance officers can identify areas that require additional process controls or adjustments. Check out KonaAI here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 19 Dec 2023 10:58:00 -0000 Day 13 - Data Management Automation full 13 Thomas Fox Today we consider the use of data automation. Data automation not only streamlines the compliance process but also provides transparency and visibility into the decision-making process. There is a clear importance to connecting people, data, process systems, and tools in one place. This eliminates the need for compliance officers to navigate multiple systems and tools, allowing them to focus on risk-based due diligence. By having a clear understanding of the decision tree and the ability to adjust the automation process, organizations can trust the automation while maintaining control and oversight. The importance of automation for data analysis in compliance programs cannot be overstated. Organizations need to have visibility into their data at their fingertips to ensure regulatory compliance and mitigate risks. Automation streamlines the compliance process, provides transparency, and allows for adaptability in the face of evolving regulations and risks. By leveraging data analysis, organizations can identify deviations, improve cycle times, enhance training effectiveness, and make informed decisions. Board-level involvement is crucial in overseeing the automation and data analysis process, recognizing its strategic value, and ensuring its effective implementation. With the advent of AI and intelligent approaches, organizations that do not embrace automation and data analysis may suffer in the long run. Trust but verify, and always prioritize visibility and transparency in compliance programs.  Three key takeaways: Automation not only streamlines the compliance process but also provides transparency and visibility into the decision-making process. There is a need for board-level involvement in overseeing the automation and data analysis processes. Through analyzing deviations from the expected path, compliance officers can identify areas that require additional process controls or adjustments. Check out KonaAI here. Learn more about your ad choices. Visit megaphone.fm/adchoices Data automation not only streamlines the compliance process but also provides transparency and visibility into the decision-making process. There is a clear importance to connecting people, data, process systems, and tools in one place. This eliminates the need for compliance officers to navigate multiple systems and tools, allowing them to focus on risk-based due diligence. By having a clear understanding of the decision tree and the ability to adjust the automation process, organizations can trust the automation while maintaining control and oversight.

The importance of automation for data analysis in compliance programs cannot be overstated. Organizations need to have visibility into their data at their fingertips to ensure regulatory compliance and mitigate risks. Automation streamlines the compliance process, provides transparency, and allows for adaptability in the face of evolving regulations and risks. By leveraging data analysis, organizations can identify deviations, improve cycle times, enhance training effectiveness, and make informed decisions. Board-level involvement is crucial in overseeing the automation and data analysis process, recognizing its strategic value, and ensuring its effective implementation. With the advent of AI and intelligent approaches, organizations that do not embrace automation and data analysis may suffer in the long run. Trust but verify, and always prioritize visibility and transparency in compliance programs.

 Three key takeaways:


  2. Automation not only streamlines the compliance process but also provides transparency and visibility into the decision-making process.

  4. There is a need for board-level involvement in overseeing the automation and data analysis processes.

  6. Through analyzing deviations from the expected path, compliance officers can identify areas that require additional process controls or adjustments.


Check out KonaAI here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 434 no One Month to a More Effective Compliance Program Through Data Analytics: Day 12- The Master Data Plan As with all other components of a best practices compliance program, robust policies and procedures in data governance need to be in place to effectively address privacy concerns. This is even more true with the shift from breach data protection to data privacy as a regulatory focus. This shift is gaining momentum, especially in the EU under GDPR, where data privacy is a significant concern for companies doing business globally. It is important to have a Master Data Plan in place with acts to provide a centralized and consistent view of data. A Master Data Plan also enables organizations to have a holistic understanding of their data, leading to better decision-making and improved business efficiency. This Master Data Plan will help drive good data governance, which plays a vital role in compliance program visibility and effective data management. A Master Data Plan involves establishing policies, procedures, and controls to ensure data quality, accuracy, consistency, and trustworthiness. Data quality is essential for data to be fit for purpose and used efficiently in business operations and analytics. Three key takeaways: Companies should implement a Master Data Plan in place to effectively manage data going forward. A Master Data Plan involves establishing policies, procedures, and controls to ensure data quality, accuracy, consistency, and trustworthiness By embracing data-driven practices and addressing privacy concerns, businesses can enhance compliance programs, drive efficiency, and achieve better ROI. For more information on KonaAI click here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 18 Dec 2023 13:20:00 -0000 Day 12- The Master Data Plan full 12 Thomas Fox Why you need a Master Data Plan. As with all other components of a best practices compliance program, robust policies and procedures in data governance need to be in place to effectively address privacy concerns. This is even more true with the shift from breach data protection to data privacy as a regulatory focus. This shift is gaining momentum, especially in the EU under GDPR, where data privacy is a significant concern for companies doing business globally. It is important to have a Master Data Plan in place with acts to provide a centralized and consistent view of data. A Master Data Plan also enables organizations to have a holistic understanding of their data, leading to better decision-making and improved business efficiency. This Master Data Plan will help drive good data governance, which plays a vital role in compliance program visibility and effective data management. A Master Data Plan involves establishing policies, procedures, and controls to ensure data quality, accuracy, consistency, and trustworthiness. Data quality is essential for data to be fit for purpose and used efficiently in business operations and analytics. Three key takeaways: Companies should implement a Master Data Plan in place to effectively manage data going forward. A Master Data Plan involves establishing policies, procedures, and controls to ensure data quality, accuracy, consistency, and trustworthiness By embracing data-driven practices and addressing privacy concerns, businesses can enhance compliance programs, drive efficiency, and achieve better ROI. For more information on KonaAI click here.  Learn more about your ad choices. Visit megaphone.fm/adchoices As with all other components of a best practices compliance program, robust policies and procedures in data governance need to be in place to effectively address privacy concerns. This is even more true with the shift from breach data protection to data privacy as a regulatory focus. This shift is gaining momentum, especially in the EU under GDPR, where data privacy is a significant concern for companies doing business globally.

It is important to have a Master Data Plan in place with acts to provide a centralized and consistent view of data. A Master Data Plan also enables organizations to have a holistic understanding of their data, leading to better decision-making and improved business efficiency. This Master Data Plan will help drive good data governance, which plays a vital role in compliance program visibility and effective data management. A Master Data Plan involves establishing policies, procedures, and controls to ensure data quality, accuracy, consistency, and trustworthiness. Data quality is essential for data to be fit for purpose and used efficiently in business operations and analytics.

Three key takeaways:

  1. Companies should implement a Master Data Plan in place to effectively manage data going forward.
  2. A Master Data Plan involves establishing policies, procedures, and controls to ensure data quality, accuracy, consistency, and trustworthiness
  3. By embracing data-driven practices and addressing privacy concerns, businesses can enhance compliance programs, drive efficiency, and achieve better ROI.

For more information on KonaAI click here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 434 no One Month to a More Effective Compliance Program Through Data Analytics: Day 11 - The Importance of Data Governance In today's digital landscape, compliance, data governance, and cybersecurity have become crucial aspects of running a successful business. The convergence of these three disciplines is a growing trend, emphasizing the need for collaboration and breaking down silos within organizations. The key factor that impacts the importance of compliance, data governance, and cybersecurity in business is data governance. Data governance involves managing and organizing data for accuracy, accessibility, and compliance. With the increasing amount of data being generated for compliance and other corporate functions, it has become crucial for organizations to have effective data governance and legal technology services in place to ensure compliance with regulatory obligations. It plays a significant role in both the business and legal aspects of an organization. CCOs and compliance professionals rely on data to make informed decisions, analyze trends, and measure key performance indicators. From a legal perspective, data governance is essential for providing legal advice and meeting regulatory obligations.  Three key takeaways: 1. Data preservation and credibility are crucial for effective compliance representation if a regulator comes knocking. 2. Compliance, data governance, and cybersecurity are intertwined in today's business landscape. 3. As the digital landscape continues to evolve, organizations must prioritize data governance and stay compliant and competitive in the business world. For more information on KonaAI, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 15 Dec 2023 05:00:00 -0000 Day 11 - The Importance of Data Governance full 11 Thomas Fox Today we consider the importance of data governance for data-driven compliance. In today's digital landscape, compliance, data governance, and cybersecurity have become crucial aspects of running a successful business. The convergence of these three disciplines is a growing trend, emphasizing the need for collaboration and breaking down silos within organizations. The key factor that impacts the importance of compliance, data governance, and cybersecurity in business is data governance. Data governance involves managing and organizing data for accuracy, accessibility, and compliance. With the increasing amount of data being generated for compliance and other corporate functions, it has become crucial for organizations to have effective data governance and legal technology services in place to ensure compliance with regulatory obligations. It plays a significant role in both the business and legal aspects of an organization. CCOs and compliance professionals rely on data to make informed decisions, analyze trends, and measure key performance indicators. From a legal perspective, data governance is essential for providing legal advice and meeting regulatory obligations.  Three key takeaways: 1. Data preservation and credibility are crucial for effective compliance representation if a regulator comes knocking. 2. Compliance, data governance, and cybersecurity are intertwined in today's business landscape. 3. As the digital landscape continues to evolve, organizations must prioritize data governance and stay compliant and competitive in the business world. For more information on KonaAI, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices In today's digital landscape, compliance, data governance, and cybersecurity have become crucial aspects of running a successful business. The convergence of these three disciplines is a growing trend, emphasizing the need for collaboration and breaking down silos within organizations. The key factor that impacts the importance of compliance, data governance, and cybersecurity in business is data governance.

Data governance involves managing and organizing data for accuracy, accessibility, and compliance. With the increasing amount of data being generated for compliance and other corporate functions, it has become crucial for organizations to have effective data governance and legal technology services in place to ensure compliance with regulatory obligations. It plays a significant role in both the business and legal aspects of an organization. CCOs and compliance professionals rely on data to make informed decisions, analyze trends, and measure key performance indicators. From a legal perspective, data governance is essential for providing legal advice and meeting regulatory obligations.

 Three key takeaways:

1. Data preservation and credibility are crucial for effective compliance representation if a regulator comes knocking.

2. Compliance, data governance, and cybersecurity are intertwined in today's business landscape.

3. As the digital landscape continues to evolve, organizations must prioritize data governance and stay compliant and competitive in the business world.

For more information on KonaAI, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 434 no One Month to a More Effective Compliance Program Through Data Analytics: Day 10 - The Impact of Privacy Regulations on Compliance  What is the impact of privacy regulations on data-driven compliance? Every CCO must be aware of the importance of privacy in data-driven compliance and the challenges and tradeoffs involved in implementing effective compliance strategies. A key mandate is for CCOs and compliance professionals to have a compliance program that provides visibility into their data. This emphasizes the importance of having efficient and effective compliance solutions in place or as I have previously noted CCOs must have access to their compliance data literally at their fingertips. This is one of the drivers for key trends shaping compliance technology in 2025 and beyond. The RegTech market is growing rapidly, and there is increased regulatory focus on cryptocurrency activities, ESG, and information security and cybersecurity. These trends indicate the evolving landscape of compliance and the need for organizations to stay updated and adapt their compliance strategies accordingly. By embracing connected compliance and leveraging technology, organizations can navigate the complex regulatory landscape and ensure compliance with privacy regulations while driving business efficiency.  Three key takeaways: CCOs and compliance professionals must have a compliance program that provides visibility into their data. ESG regulations affect not only regulated industries but also any company holding private customer data or involved in large supply chains. By embracing connected compliance and leveraging technology, organizations can navigate the complex regulatory landscape and ensure compliance with privacy regulations while driving business efficiency. For more on KonaAI, click here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 14 Dec 2023 12:21:00 -0000 Day 10 - The Impact of Privacy Regulations on Compliance full 10 Thomas Fox Today we consider the impact of data privacy regulations on data driven compliance.  What is the impact of privacy regulations on data-driven compliance? Every CCO must be aware of the importance of privacy in data-driven compliance and the challenges and tradeoffs involved in implementing effective compliance strategies. A key mandate is for CCOs and compliance professionals to have a compliance program that provides visibility into their data. This emphasizes the importance of having efficient and effective compliance solutions in place or as I have previously noted CCOs must have access to their compliance data literally at their fingertips. This is one of the drivers for key trends shaping compliance technology in 2025 and beyond. The RegTech market is growing rapidly, and there is increased regulatory focus on cryptocurrency activities, ESG, and information security and cybersecurity. These trends indicate the evolving landscape of compliance and the need for organizations to stay updated and adapt their compliance strategies accordingly. By embracing connected compliance and leveraging technology, organizations can navigate the complex regulatory landscape and ensure compliance with privacy regulations while driving business efficiency.  Three key takeaways: CCOs and compliance professionals must have a compliance program that provides visibility into their data. ESG regulations affect not only regulated industries but also any company holding private customer data or involved in large supply chains. By embracing connected compliance and leveraging technology, organizations can navigate the complex regulatory landscape and ensure compliance with privacy regulations while driving business efficiency. For more on KonaAI, click here.  Learn more about your ad choices. Visit megaphone.fm/adchoices  What is the impact of privacy regulations on data-driven compliance? Every CCO must be aware of the importance of privacy in data-driven compliance and the challenges and tradeoffs involved in implementing effective compliance strategies. A key mandate is for CCOs and compliance professionals to have a compliance program that provides visibility into their data. This emphasizes the importance of having efficient and effective compliance solutions in place or as I have previously noted CCOs must have access to their compliance data literally at their fingertips.

This is one of the drivers for key trends shaping compliance technology in 2025 and beyond. The RegTech market is growing rapidly, and there is increased regulatory focus on cryptocurrency activities, ESG, and information security and cybersecurity. These trends indicate the evolving landscape of compliance and the need for organizations to stay updated and adapt their compliance strategies accordingly. By embracing connected compliance and leveraging technology, organizations can navigate the complex regulatory landscape and ensure compliance with privacy regulations while driving business efficiency.

 Three key takeaways:


  2. CCOs and compliance professionals must have a compliance program that provides visibility into their data.

  4. ESG regulations affect not only regulated industries but also any company holding private customer data or involved in large supply chains.

  6. By embracing connected compliance and leveraging technology, organizations can navigate the complex regulatory landscape and ensure compliance with privacy regulations while driving business efficiency.

For more on KonaAI, click here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 434 no One Month to a More Effective Compliance Program Through Data Analytics: Day 9 - Enhancing Compliance Through Automation “Reg Ops" or Regulatory Operations has the potential to revolutionize compliance. Reg Ops focuses on automating software development and compliance artifact creation, making it easier for compliance professionals to create it and for employees and other stakeholders to consume compliance content through automation and user-friendly interfaces. This approach aims to leverage the best of both worlds - the capabilities of machines and the expertise of humans - to enhance compliance programs. Or as Carsten Tams continually reminds us, it is all about the user experience. The goal is to integrate existing security and compliance tools to gather evidence in near real-time, automate the creation of compliance gap tickets, generate real-time reports, and provide a comprehensive view of an organization's compliance state. By leveraging the power of APIs and customer-centric design, the compliance process can be more effective and efficient.  Three key takeaways:  Three key takeaways: 1. Enhancing compliance programs through automation is a critical step for compliance functions and businesses to improve decision-making, efficiency, and overall compliance effectiveness. 2. Automation can help compliance functions meet the need for near real-time reporting for a variety of different stakeholders. 3. Balancing the need for real-time reporting with data accuracy and security is crucial. For more information on our sponsor, KonaAI, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 13 Dec 2023 13:10:00 -0000 Day 9 - Enhancing Compliance Through Automation full Thomas Fox Today we consider how to enhance compliance through automation. “Reg Ops" or Regulatory Operations has the potential to revolutionize compliance. Reg Ops focuses on automating software development and compliance artifact creation, making it easier for compliance professionals to create it and for employees and other stakeholders to consume compliance content through automation and user-friendly interfaces. This approach aims to leverage the best of both worlds - the capabilities of machines and the expertise of humans - to enhance compliance programs. Or as Carsten Tams continually reminds us, it is all about the user experience. The goal is to integrate existing security and compliance tools to gather evidence in near real-time, automate the creation of compliance gap tickets, generate real-time reports, and provide a comprehensive view of an organization's compliance state. By leveraging the power of APIs and customer-centric design, the compliance process can be more effective and efficient.  Three key takeaways:  Three key takeaways: 1. Enhancing compliance programs through automation is a critical step for compliance functions and businesses to improve decision-making, efficiency, and overall compliance effectiveness. 2. Automation can help compliance functions meet the need for near real-time reporting for a variety of different stakeholders. 3. Balancing the need for real-time reporting with data accuracy and security is crucial. For more information on our sponsor, KonaAI, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices “Reg Ops" or Regulatory Operations has the potential to revolutionize compliance. Reg Ops focuses on automating software development and compliance artifact creation, making it easier for compliance professionals to create it and for employees and other stakeholders to consume compliance content through automation and user-friendly interfaces. This approach aims to leverage the best of both worlds - the capabilities of machines and the expertise of humans - to enhance compliance programs. Or as Carsten Tams continually reminds us, it is all about the user experience.

The goal is to integrate existing security and compliance tools to gather evidence in near real-time, automate the creation of compliance gap tickets, generate real-time reports, and provide a comprehensive view of an organization's compliance state. By leveraging the power of APIs and customer-centric design, the compliance process can be more effective and efficient.

 Three key takeaways:

 Three key takeaways:

1. Enhancing compliance programs through automation is a critical step for compliance functions and businesses to improve decision-making, efficiency, and overall compliance effectiveness.

2. Automation can help compliance functions meet the need for near real-time reporting for a variety of different stakeholders.

3. Balancing the need for real-time reporting with data accuracy and security is crucial.

For more information on our sponsor, KonaAI, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 434 no One Month to a More Effective Compliance Program Through Data Analytics - Day 8 - Data Democratization In the world of compliance, data analysis plays a crucial role in identifying risks, making informed decisions, and ensuring legal and regulatory compliance. It enables companies to make fact-based decisions and mitigate risks effectively. By leveraging AI, organizations can identify high-risk payments and reduce investigation costs. This not only saves time and resources but also ensures that compliance teams can present risk in a timely and data-driven manner. We previously noted that it is not simply about having the data but also accessing it and then using it. A key in this process is the implementation of data warehouses and cloud data warehousing solutions. The goal is to eliminate data silos and enable easy data access and analysis. By implementing a modern data stack, companies centralize their data, making it compliance-friendly as mandated by the DOJ (in the 2020 Evaluation of Corporate Compliance Programs) and more generally accessible to employees across the organization. AI-driven data analysis and compliance solutions are revolutionizing the way organizations approach compliance and data utilization. By leveraging AI technology, these companies enable businesses to make fact-based decisions, identify risks, and ensure regulatory compliance. Investing in data governance and business intelligence tools is crucial for extracting value from data and driving business success. With the democratization of data access, organizations can empower employees to be data-informed and achieve greater efficiency.   Three key takeaways: Data analysis is not simply about having the data but also accessing it and then using it. Data democratization recognizes that effective data utilization is linked to compliance and good business practices. With the democratization of data access, organizations can empower employees to be data-informed and achieve greater business efficiencies. For more on KonaAI, click here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 12 Dec 2023 12:48:00 -0000 Day 8 - Data Democratization full Thomas Fox Today we consider Data Democratization. In the world of compliance, data analysis plays a crucial role in identifying risks, making informed decisions, and ensuring legal and regulatory compliance. It enables companies to make fact-based decisions and mitigate risks effectively. By leveraging AI, organizations can identify high-risk payments and reduce investigation costs. This not only saves time and resources but also ensures that compliance teams can present risk in a timely and data-driven manner. We previously noted that it is not simply about having the data but also accessing it and then using it. A key in this process is the implementation of data warehouses and cloud data warehousing solutions. The goal is to eliminate data silos and enable easy data access and analysis. By implementing a modern data stack, companies centralize their data, making it compliance-friendly as mandated by the DOJ (in the 2020 Evaluation of Corporate Compliance Programs) and more generally accessible to employees across the organization. AI-driven data analysis and compliance solutions are revolutionizing the way organizations approach compliance and data utilization. By leveraging AI technology, these companies enable businesses to make fact-based decisions, identify risks, and ensure regulatory compliance. Investing in data governance and business intelligence tools is crucial for extracting value from data and driving business success. With the democratization of data access, organizations can empower employees to be data-informed and achieve greater efficiency.   Three key takeaways: Data analysis is not simply about having the data but also accessing it and then using it. Data democratization recognizes that effective data utilization is linked to compliance and good business practices. With the democratization of data access, organizations can empower employees to be data-informed and achieve greater business efficiencies. For more on KonaAI, click here.  Learn more about your ad choices. Visit megaphone.fm/adchoices In the world of compliance, data analysis plays a crucial role in identifying risks, making informed decisions, and ensuring legal and regulatory compliance. It enables companies to make fact-based decisions and mitigate risks effectively. By leveraging AI, organizations can identify high-risk payments and reduce investigation costs. This not only saves time and resources but also ensures that compliance teams can present risk in a timely and data-driven manner. We previously noted that it is not simply about having the data but also accessing it and then using it.

A key in this process is the implementation of data warehouses and cloud data warehousing solutions. The goal is to eliminate data silos and enable easy data access and analysis. By implementing a modern data stack, companies centralize their data, making it compliance-friendly as mandated by the DOJ (in the 2020 Evaluation of Corporate Compliance Programs) and more generally accessible to employees across the organization.

AI-driven data analysis and compliance solutions are revolutionizing the way organizations approach compliance and data utilization. By leveraging AI technology, these companies enable businesses to make fact-based decisions, identify risks, and ensure regulatory compliance. Investing in data governance and business intelligence tools is crucial for extracting value from data and driving business success. With the democratization of data access, organizations can empower employees to be data-informed and achieve greater efficiency. 

 Three key takeaways:

  1. Data analysis is not simply about having the data but also accessing it and then using it.
  2. Data democratization recognizes that effective data utilization is linked to compliance and good business practices.
  3. With the democratization of data access, organizations can empower employees to be data-informed and achieve greater business efficiencies.


For more on KonaAI, click here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 442 no One Month to a More Effective Compliance Program Through Data Analytics: Day 7 - From Cutting Edge to Table Stakes Compliance programs play a crucial role in ensuring that companies adhere to legal and ethical standards. In today’s digital age, where data is abundant and easily accessible, the importance of data-driven compliance programs cannot be overstated. This message was driven home very forcefully in a speech in November by Nicole Argentieri, acting assistant attorney general for the Criminal Division. Anselmo Guevara, manager at VMware, has emphasized the need for companies to have a compliance program that provides visibility into their data at their fingertips. It is no longer sufficient to simply collect data and have someone review and reconcile it. Compliance professionals must actively analyze the data for trends, anomalies, and potential compliance risks. This proactive approach allows companies to identify and address compliance issues before they escalate. Data-driven compliance programs have moved from cutting-edge and are now seen as best practices. Soon they will simply be table stakes for companies to effectively manage compliance risks. By actively monitoring and analyzing data, companies can identify potential compliance issues, mitigate risks, and maintain their reputation and integrity. Collaboration between different departments and a formal risk assessment are key factors in establishing a robust compliance program. As technology continues to advance, the role of data analytics and AI in compliance monitoring is expected to become even more significant. Compliance professionals must stay informed, continuously learn, and adapt to the evolving landscape of data-driven compliance.  Three key takeaways: 1. Nicole Argentieri, acting assistant attorney general for the Criminal Division, said,  “Let me be the first to tell you that we have proactively used data to generate FCPA cases, and we’ve only just gotten started.”  2. . Compliance professionals must actively analyze the data for trends, anomalies, and potential compliance risks. 3. Data-driven compliance programs have moved from cutting-edge and are now seen as best practices. Soon they will simply be table stakes for companies to effectively manage compliance risks. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 11 Dec 2023 13:11:00 -0000 Day 7 - From Cutting Edge to Table Stakes full 7 Thomas Fox How data-driven compliance has moved into the mainstream. Compliance programs play a crucial role in ensuring that companies adhere to legal and ethical standards. In today’s digital age, where data is abundant and easily accessible, the importance of data-driven compliance programs cannot be overstated. This message was driven home very forcefully in a speech in November by Nicole Argentieri, acting assistant attorney general for the Criminal Division. Anselmo Guevara, manager at VMware, has emphasized the need for companies to have a compliance program that provides visibility into their data at their fingertips. It is no longer sufficient to simply collect data and have someone review and reconcile it. Compliance professionals must actively analyze the data for trends, anomalies, and potential compliance risks. This proactive approach allows companies to identify and address compliance issues before they escalate. Data-driven compliance programs have moved from cutting-edge and are now seen as best practices. Soon they will simply be table stakes for companies to effectively manage compliance risks. By actively monitoring and analyzing data, companies can identify potential compliance issues, mitigate risks, and maintain their reputation and integrity. Collaboration between different departments and a formal risk assessment are key factors in establishing a robust compliance program. As technology continues to advance, the role of data analytics and AI in compliance monitoring is expected to become even more significant. Compliance professionals must stay informed, continuously learn, and adapt to the evolving landscape of data-driven compliance.  Three key takeaways: 1. Nicole Argentieri, acting assistant attorney general for the Criminal Division, said,  “Let me be the first to tell you that we have proactively used data to generate FCPA cases, and we’ve only just gotten started.”  2. . Compliance professionals must actively analyze the data for trends, anomalies, and potential compliance risks. 3. Data-driven compliance programs have moved from cutting-edge and are now seen as best practices. Soon they will simply be table stakes for companies to effectively manage compliance risks. Learn more about your ad choices. Visit megaphone.fm/adchoices Compliance programs play a crucial role in ensuring that companies adhere to legal and ethical standards. In today’s digital age, where data is abundant and easily accessible, the importance of data-driven compliance programs cannot be overstated. This message was driven home very forcefully in a speech in November by Nicole Argentieri, acting assistant attorney general for the Criminal Division.

Anselmo Guevara, manager at VMware, has emphasized the need for companies to have a compliance program that provides visibility into their data at their fingertips. It is no longer sufficient to simply collect data and have someone review and reconcile it. Compliance professionals must actively analyze the data for trends, anomalies, and potential compliance risks. This proactive approach allows companies to identify and address compliance issues before they escalate.

Data-driven compliance programs have moved from cutting-edge and are now seen as best practices. Soon they will simply be table stakes for companies to effectively manage compliance risks. By actively monitoring and analyzing data, companies can identify potential compliance issues, mitigate risks, and maintain their reputation and integrity. Collaboration between different departments and a formal risk assessment are key factors in establishing a robust compliance program. As technology continues to advance, the role of data analytics and AI in compliance monitoring is expected to become even more significant. Compliance professionals must stay informed, continuously learn, and adapt to the evolving landscape of data-driven compliance.

 Three key takeaways:

1. Nicole Argentieri, acting assistant attorney general for the Criminal Division, said,  “Let me be the first to tell you that we have proactively used data to generate FCPA cases, and we’ve only just gotten started.” 

2. . Compliance professionals must actively analyze the data for trends, anomalies, and potential compliance risks.

3. Data-driven compliance programs have moved from cutting-edge and are now seen as best practices. Soon they will simply be table stakes for companies to effectively manage compliance risks.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 442 no One Month to a More Effective Compliance Program Through Data Analytics: Day 6 - Data Analytics and Business Decisions In today's rapidly evolving business landscape, compliance, enterprise performance management (EPM) systems, and data analytics play crucial roles in driving informed decision-making. Compliance program visibility and proper documentation are essential for managing data and ensuring regulatory compliance across companies of all sizes. EPM systems, also known as Enterprise Resource Planning (ERP) systems, are vital tools for financial planning and analysis. These systems go beyond basic accounting functions and offer features such as budgeting, forecasting, and strategic long-range planning. By using EPM systems, organizations can operate at a higher level, enabling medium to long-range planning and supporting informed decision-making. The importance of compliance, EPM systems, and data analytics in business decision-making cannot be overstated. Compliance program visibility and documentation are crucial for managing data and ensuring regulatory compliance. EPM systems provide the tools for financial planning and analysis, supporting strategic long-range planning and informed decision-making. Data analytics allows businesses to uncover patterns and gain insights, but overcoming data silos is necessary to maximize its potential. By adopting cloud-based solutions and integrating systems, organizations can make the most of their data and drive informed decision-making. Balancing different factors and considering the impact on decision-making processes is key to successfully leveraging compliance, EPM systems, and data analytics in business.  Three key takeaways: 1. Compliance program visibility and proper documentation are essential for managing data and ensuring regulatory compliance across companies of all sizes. 2. Having data is important, it is equally crucial to focus on how that data is being used.  3. Overcoming data silos is key to maximizing the potential of data analytics. For more information on KonaAI, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 08 Dec 2023 14:05:00 -0000 Day 6 - Data Analytics and Business Decisions full 6 Thomas Fox Today we consider the use of data analytics in business decisions. In today's rapidly evolving business landscape, compliance, enterprise performance management (EPM) systems, and data analytics play crucial roles in driving informed decision-making. Compliance program visibility and proper documentation are essential for managing data and ensuring regulatory compliance across companies of all sizes. EPM systems, also known as Enterprise Resource Planning (ERP) systems, are vital tools for financial planning and analysis. These systems go beyond basic accounting functions and offer features such as budgeting, forecasting, and strategic long-range planning. By using EPM systems, organizations can operate at a higher level, enabling medium to long-range planning and supporting informed decision-making. The importance of compliance, EPM systems, and data analytics in business decision-making cannot be overstated. Compliance program visibility and documentation are crucial for managing data and ensuring regulatory compliance. EPM systems provide the tools for financial planning and analysis, supporting strategic long-range planning and informed decision-making. Data analytics allows businesses to uncover patterns and gain insights, but overcoming data silos is necessary to maximize its potential. By adopting cloud-based solutions and integrating systems, organizations can make the most of their data and drive informed decision-making. Balancing different factors and considering the impact on decision-making processes is key to successfully leveraging compliance, EPM systems, and data analytics in business.  Three key takeaways: 1. Compliance program visibility and proper documentation are essential for managing data and ensuring regulatory compliance across companies of all sizes. 2. Having data is important, it is equally crucial to focus on how that data is being used.  3. Overcoming data silos is key to maximizing the potential of data analytics. For more information on KonaAI, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices In today's rapidly evolving business landscape, compliance, enterprise performance management (EPM) systems, and data analytics play crucial roles in driving informed decision-making. Compliance program visibility and proper documentation are essential for managing data and ensuring regulatory compliance across companies of all sizes. EPM systems, also known as Enterprise Resource Planning (ERP) systems, are vital tools for financial planning and analysis. These systems go beyond basic accounting functions and offer features such as budgeting, forecasting, and strategic long-range planning. By using EPM systems, organizations can operate at a higher level, enabling medium to long-range planning and supporting informed decision-making.

The importance of compliance, EPM systems, and data analytics in business decision-making cannot be overstated. Compliance program visibility and documentation are crucial for managing data and ensuring regulatory compliance. EPM systems provide the tools for financial planning and analysis, supporting strategic long-range planning and informed decision-making. Data analytics allows businesses to uncover patterns and gain insights, but overcoming data silos is necessary to maximize its potential. By adopting cloud-based solutions and integrating systems, organizations can make the most of their data and drive informed decision-making. Balancing different factors and considering the impact on decision-making processes is key to successfully leveraging compliance, EPM systems, and data analytics in business.

 Three key takeaways:

1. Compliance program visibility and proper documentation are essential for managing data and ensuring regulatory compliance across companies of all sizes.

2. Having data is important, it is equally crucial to focus on how that data is being used. 

3. Overcoming data silos is key to maximizing the potential of data analytics.

For more information on KonaAI, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 442 no One Month to a More Effective Compliance Program Through Data Analytics: Day 5 - Data Driven Compliance and ESG Integration ESG integration focuses on incorporating environmental, social, and governance considerations into business processes. This broader overview allows organizations to gain a comprehensive understanding of their impact, save costs, improve efficiency, and increase profitability. However, it is important to note that ESG initiatives often come with additional costs, as environmentally sound products may be more expensive than traditional alternatives. This is a tradeoff that companies must carefully consider when implementing ESG practices. ESG integration in business processes is crucial for organizations aiming to enhance their compliance programs and make informed decisions. By leveraging data analytics, companies can identify and address ESG risks and opportunities more effectively. Collaboration and information sharing among companies also play a significant role in improving compliance efforts. As the compliance landscape continues to evolve, staying informed and adapting to new evaluation processes will be key for compliance professionals. Three key takeaways: ESG integration in business processes is crucial for organizations aiming to enhance their compliance programs and make informed decisions. By leveraging data analytics, companies can identify and address ESG risks and opportunities more effectively. Collaboration and information sharing among companies also play a significant role in improving compliance efforts. For more information on KonaAI, check out their website here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 07 Dec 2023 11:57:00 -0000 Day 5 - Data Driven Compliance and ESG Integration full 5 Thomas Fox Today we consider the intersection of data-driven compliance and ESG. ESG integration focuses on incorporating environmental, social, and governance considerations into business processes. This broader overview allows organizations to gain a comprehensive understanding of their impact, save costs, improve efficiency, and increase profitability. However, it is important to note that ESG initiatives often come with additional costs, as environmentally sound products may be more expensive than traditional alternatives. This is a tradeoff that companies must carefully consider when implementing ESG practices. ESG integration in business processes is crucial for organizations aiming to enhance their compliance programs and make informed decisions. By leveraging data analytics, companies can identify and address ESG risks and opportunities more effectively. Collaboration and information sharing among companies also play a significant role in improving compliance efforts. As the compliance landscape continues to evolve, staying informed and adapting to new evaluation processes will be key for compliance professionals. Three key takeaways: ESG integration in business processes is crucial for organizations aiming to enhance their compliance programs and make informed decisions. By leveraging data analytics, companies can identify and address ESG risks and opportunities more effectively. Collaboration and information sharing among companies also play a significant role in improving compliance efforts. For more information on KonaAI, check out their website here. Learn more about your ad choices. Visit megaphone.fm/adchoices ESG integration focuses on incorporating environmental, social, and governance considerations into business processes. This broader overview allows organizations to gain a comprehensive understanding of their impact, save costs, improve efficiency, and increase profitability. However, it is important to note that ESG initiatives often come with additional costs, as environmentally sound products may be more expensive than traditional alternatives. This is a tradeoff that companies must carefully consider when implementing ESG practices.

ESG integration in business processes is crucial for organizations aiming to enhance their compliance programs and make informed decisions. By leveraging data analytics, companies can identify and address ESG risks and opportunities more effectively. Collaboration and information sharing among companies also play a significant role in improving compliance efforts. As the compliance landscape continues to evolve, staying informed and adapting to new evaluation processes will be key for compliance professionals.

Three key takeaways:

  1. ESG integration in business processes is crucial for organizations aiming to enhance their compliance programs and make informed decisions.
  2. By leveraging data analytics, companies can identify and address ESG risks and opportunities more effectively.
  3. Collaboration and information sharing among companies also play a significant role in improving compliance efforts.


For more information on KonaAI, check out their website here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 442 no One Month to a More Effective Compliance Program Through Data Analytics - Day 4 - AI Driven Risk Management and Fraud Prevention Through leveraging AI-driven solutions, companies can collect and analyze survey data to identify patterns and trends that may indicate potential risks. This empowers organizations to take proactive measures to mitigate these risks and foster a culture of trust and transparency. Another area of significance is mapping risks to controls. This allows a compliance professional or risk manager to know where risks are occurring within an organization and then map them to corresponding controls. This permits compliance functions to assess the effectiveness of their controls and identify areas that require improvement. By leveraging AI-driven solutions, organizations can gain a comprehensive understanding of their risk landscape and make data-driven decisions to strengthen their control environment. AI-driven solutions have the potential to revolutionize risk assessment and fraud prevention. By leveraging these solutions, companies can enhance their compliance efforts, improve efficiency, and make data-driven decisions. However, it is crucial to balance automation with human expertise and address challenges related to data availability and quality. Ultimately, the successful implementation of AI-driven solutions requires a holistic approach that considers the impact on employees, fosters a culture of trust and transparency, and aligns with the organization's risk management objectives. Three key takeaways: Data visibility allows organizations to effectively manage their compliance efforts and make data-driven decisions. By leveraging AI-driven solutions, compliance functions can generate dashboards and analytics that provide real-time insights into their risk landscape. This not only improves efficiency but also enables auditors to focus on understanding the data and identifying potential risks. For more information on this month's sponsor check out KonaAI.com. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 06 Dec 2023 05:00:00 -0000 Day 4 - AI Driven Risk Management and Fraud Prevention full 5 Thomas Fox Today we consider AI and risk management and fraud prevention. Through leveraging AI-driven solutions, companies can collect and analyze survey data to identify patterns and trends that may indicate potential risks. This empowers organizations to take proactive measures to mitigate these risks and foster a culture of trust and transparency. Another area of significance is mapping risks to controls. This allows a compliance professional or risk manager to know where risks are occurring within an organization and then map them to corresponding controls. This permits compliance functions to assess the effectiveness of their controls and identify areas that require improvement. By leveraging AI-driven solutions, organizations can gain a comprehensive understanding of their risk landscape and make data-driven decisions to strengthen their control environment. AI-driven solutions have the potential to revolutionize risk assessment and fraud prevention. By leveraging these solutions, companies can enhance their compliance efforts, improve efficiency, and make data-driven decisions. However, it is crucial to balance automation with human expertise and address challenges related to data availability and quality. Ultimately, the successful implementation of AI-driven solutions requires a holistic approach that considers the impact on employees, fosters a culture of trust and transparency, and aligns with the organization's risk management objectives. Three key takeaways: Data visibility allows organizations to effectively manage their compliance efforts and make data-driven decisions. By leveraging AI-driven solutions, compliance functions can generate dashboards and analytics that provide real-time insights into their risk landscape. This not only improves efficiency but also enables auditors to focus on understanding the data and identifying potential risks. For more information on this month's sponsor check out KonaAI.com. Learn more about your ad choices. Visit megaphone.fm/adchoices Through leveraging AI-driven solutions, companies can collect and analyze survey data to identify patterns and trends that may indicate potential risks. This empowers organizations to take proactive measures to mitigate these risks and foster a culture of trust and transparency.

Another area of significance is mapping risks to controls. This allows a compliance professional or risk manager to know where risks are occurring within an organization and then map them to corresponding controls. This permits compliance functions to assess the effectiveness of their controls and identify areas that require improvement. By leveraging AI-driven solutions, organizations can gain a comprehensive understanding of their risk landscape and make data-driven decisions to strengthen their control environment.

AI-driven solutions have the potential to revolutionize risk assessment and fraud prevention. By leveraging these solutions, companies can enhance their compliance efforts, improve efficiency, and make data-driven decisions. However, it is crucial to balance automation with human expertise and address challenges related to data availability and quality. Ultimately, the successful implementation of AI-driven solutions requires a holistic approach that considers the impact on employees, fosters a culture of trust and transparency, and aligns with the organization's risk management objectives.

Three key takeaways:

  1. Data visibility allows organizations to effectively manage their compliance efforts and make data-driven decisions.
  2. By leveraging AI-driven solutions, compliance functions can generate dashboards and analytics that provide real-time insights into their risk landscape.
  3. This not only improves efficiency but also enables auditors to focus on understanding the data and identifying potential risks.


For more information on this month's sponsor check out KonaAI.com.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 365 no One Month to a More Effective Compliance Program Through Data Analytics: Day 3 - Building An Effective Data Analytics Program Chief Compliance Officers (CCOs) are increasingly turning to data analytics programs to enhance their compliance efforts. These programs leverage the power of data to identify risks, monitor activities, and detect potential compliance violations. There are several key factors that impact the success of building out data analytics programs. One crucial aspect is the need to define the risks that organizations want to monitor. By identifying the specific risks, compliance officers can focus their data analytics efforts on gathering relevant data and analyzing it to gain insights into potential compliance issues. This process involves thinking innovatively and finding creative ways to capture data that may not be immediately obvious. Building effective data analytics programs for compliance enhancement requires careful consideration of various factors. Compliance officers must define the risks they want to monitor, identify valuable data sources, and think innovatively to capture relevant data. Leveraging internal expertise and fostering collaboration between different departments is essential for successful implementation. By starting small and gradually expanding their capabilities, organizations can demonstrate their commitment to using data analytics and gain compliance expertise. Ultimately, these programs enable companies to enhance their compliance effectiveness and mitigate risks effectively.  Three key takeaways: 1. There are multiple factors in the design, creation, and implementation of a data-driven compliance program. 2. A data-driven approach will allow a shift of the focus from individual policy violations to identifying systemic issues. 3. Compliance officers should focus on how to begin and gradually build their capabilities. Check out the month's sponsor, KonaAI here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 05 Dec 2023 05:00:00 -0000 Day 3 - Building An Effective Data Analytics Program full Thomas Fox Today we consider how to build out your data analytics program. Chief Compliance Officers (CCOs) are increasingly turning to data analytics programs to enhance their compliance efforts. These programs leverage the power of data to identify risks, monitor activities, and detect potential compliance violations. There are several key factors that impact the success of building out data analytics programs. One crucial aspect is the need to define the risks that organizations want to monitor. By identifying the specific risks, compliance officers can focus their data analytics efforts on gathering relevant data and analyzing it to gain insights into potential compliance issues. This process involves thinking innovatively and finding creative ways to capture data that may not be immediately obvious. Building effective data analytics programs for compliance enhancement requires careful consideration of various factors. Compliance officers must define the risks they want to monitor, identify valuable data sources, and think innovatively to capture relevant data. Leveraging internal expertise and fostering collaboration between different departments is essential for successful implementation. By starting small and gradually expanding their capabilities, organizations can demonstrate their commitment to using data analytics and gain compliance expertise. Ultimately, these programs enable companies to enhance their compliance effectiveness and mitigate risks effectively.  Three key takeaways: 1. There are multiple factors in the design, creation, and implementation of a data-driven compliance program. 2. A data-driven approach will allow a shift of the focus from individual policy violations to identifying systemic issues. 3. Compliance officers should focus on how to begin and gradually build their capabilities. Check out the month's sponsor, KonaAI here. Learn more about your ad choices. Visit megaphone.fm/adchoices Chief Compliance Officers (CCOs) are increasingly turning to data analytics programs to enhance their compliance efforts. These programs leverage the power of data to identify risks, monitor activities, and detect potential compliance violations. There are several key factors that impact the success of building out data analytics programs. One crucial aspect is the need to define the risks that organizations want to monitor. By identifying the specific risks, compliance officers can focus their data analytics efforts on gathering relevant data and analyzing it to gain insights into potential compliance issues. This process involves thinking innovatively and finding creative ways to capture data that may not be immediately obvious.

Building effective data analytics programs for compliance enhancement requires careful consideration of various factors. Compliance officers must define the risks they want to monitor, identify valuable data sources, and think innovatively to capture relevant data. Leveraging internal expertise and fostering collaboration between different departments is essential for successful implementation. By starting small and gradually expanding their capabilities, organizations can demonstrate their commitment to using data analytics and gain compliance expertise. Ultimately, these programs enable companies to enhance their compliance effectiveness and mitigate risks effectively.

 Three key takeaways:

1. There are multiple factors in the design, creation, and implementation of a data-driven compliance program.

2. A data-driven approach will allow a shift of the focus from individual policy violations to identifying systemic issues.

3. Compliance officers should focus on how to begin and gradually build their capabilities.

Check out the month's sponsor, KonaAI here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 459 no One Month to a More Effective Compliance Program Through Data Analytics: Day 2-Data-Driven Solutions for Compliance and Risk Management In today's rapidly evolving business landscape, compliance and risk management have become critical components of any successful organization. With the increasing complexity of regulations and the growing need for transparency, companies are turning to AI and data-driven solutions to enhance their compliance programs and mitigate risks. A key to this approach is the user adoption of AI-driven compliance tools.  AI and data-driven solutions have the potential to revolutionize compliance and risk management practices. By leveraging advanced analytics, machine learning, and automation, organizations can enhance decision-making processes, improve efficiency, and proactively address compliance risks. However, it is essential to prioritize user adoption, consider the impact on user experience, and strike a balance between automation and human judgment. With the right approach, AI and data-driven solutions can become valuable assets in the pursuit of effective compliance and risk management.  Three key takeaways: 1. Compliance, risk management and corporate legal can all benefit from a data-driven approach to risk management.   2. By setting up alerts, compliance officers can be notified in real-time about potential risks or non-compliant activities. 3. There will always be the need for a balance between automation and human judgment. For more information on this month's sponsor KonaAI, check out their website, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 04 Dec 2023 05:00:00 -0000 Day 2-Data-Driven Solutions for Compliance and Risk Management full 2 Thomas Fox In Day 2, we take up Data-Driven Solutions for Compliance and Risk Management. In today's rapidly evolving business landscape, compliance and risk management have become critical components of any successful organization. With the increasing complexity of regulations and the growing need for transparency, companies are turning to AI and data-driven solutions to enhance their compliance programs and mitigate risks. A key to this approach is the user adoption of AI-driven compliance tools.  AI and data-driven solutions have the potential to revolutionize compliance and risk management practices. By leveraging advanced analytics, machine learning, and automation, organizations can enhance decision-making processes, improve efficiency, and proactively address compliance risks. However, it is essential to prioritize user adoption, consider the impact on user experience, and strike a balance between automation and human judgment. With the right approach, AI and data-driven solutions can become valuable assets in the pursuit of effective compliance and risk management.  Three key takeaways: 1. Compliance, risk management and corporate legal can all benefit from a data-driven approach to risk management.   2. By setting up alerts, compliance officers can be notified in real-time about potential risks or non-compliant activities. 3. There will always be the need for a balance between automation and human judgment. For more information on this month's sponsor KonaAI, check out their website, here. Learn more about your ad choices. Visit megaphone.fm/adchoices In today's rapidly evolving business landscape, compliance and risk management have become critical components of any successful organization. With the increasing complexity of regulations and the growing need for transparency, companies are turning to AI and data-driven solutions to enhance their compliance programs and mitigate risks. A key to this approach is the user adoption of AI-driven compliance tools. 

AI and data-driven solutions have the potential to revolutionize compliance and risk management practices. By leveraging advanced analytics, machine learning, and automation, organizations can enhance decision-making processes, improve efficiency, and proactively address compliance risks. However, it is essential to prioritize user adoption, consider the impact on user experience, and strike a balance between automation and human judgment. With the right approach, AI and data-driven solutions can become valuable assets in the pursuit of effective compliance and risk management.


 Three key takeaways:

1. Compliance, risk management and corporate legal can all benefit from a data-driven approach to risk management.  

2. By setting up alerts, compliance officers can be notified in real-time about potential risks or non-compliant activities.

3. There will always be the need for a balance between automation and human judgment.

For more information on this month's sponsor KonaAI, check out their website, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 464 no One Month to a More Effective Compliance Program Through Data-Driven Compliance: Day 1-Introduction to Data-Driven Compliance In the world of compliance, data analytics and monitoring have become increasingly important. The Department of Justice (DOJ) has emphasized the significance of effective compliance programs, highlighting the role of data analytics and technology-driven approaches. Data driven compliance helps companies gain insights into their data for informed decisions and improved compliance culture. Data-driven compliance should be designed to identify hidden money, prevent improper payments, and improve business efficiency. A key is the ability to facilitate collaboration and data sharing without compromising privacy or security, thereby enhancing the performance of predictive models. In the Albemarle FCPA enforcement, the DOJ said for the first time that data-driven compliance is now a part of the requirements of an effective compliance program. By leveraging data and data analytics, compliance professionals more effectively manage risks, improve compliance culture, investigate issues, and ultimately keep companies out of trouble. Additionally, a robust data analytics platform will also contribute to making the business better by identifying hidden money, stopping improper payments, and enhancing overall business efficiency. By leveraging data analytics, companies can identify hidden money, prevent improper payments, and enhance overall business efficiency. In today's regulatory environment, the risk of not adopting data-driven compliance approaches is high, making solutions essential for companies seeking to stay compliant and improve their business practices.  Three key takeaways: 1. The DOJ identified data analytics as a part of a best practices compliance program in the Albemarle FCPA enforcement action.  2. Data-driven compliance allows companies to access their data, search vendors, analyze transactions, run corruption and fraud tests, and even evaluate predictive models. 3. Data-driven compliance should be designed to identify hidden money, prevent improper payments, and improve business efficiency. For more information on KonaAi, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 01 Dec 2023 05:00:00 -0000 Day 1-Introduction to Data-Driven Compliance full 1 Thomas Fox Today we begin a month of how data-driven compliance will improve your organization. In the world of compliance, data analytics and monitoring have become increasingly important. The Department of Justice (DOJ) has emphasized the significance of effective compliance programs, highlighting the role of data analytics and technology-driven approaches. Data driven compliance helps companies gain insights into their data for informed decisions and improved compliance culture. Data-driven compliance should be designed to identify hidden money, prevent improper payments, and improve business efficiency. A key is the ability to facilitate collaboration and data sharing without compromising privacy or security, thereby enhancing the performance of predictive models. In the Albemarle FCPA enforcement, the DOJ said for the first time that data-driven compliance is now a part of the requirements of an effective compliance program. By leveraging data and data analytics, compliance professionals more effectively manage risks, improve compliance culture, investigate issues, and ultimately keep companies out of trouble. Additionally, a robust data analytics platform will also contribute to making the business better by identifying hidden money, stopping improper payments, and enhancing overall business efficiency. By leveraging data analytics, companies can identify hidden money, prevent improper payments, and enhance overall business efficiency. In today's regulatory environment, the risk of not adopting data-driven compliance approaches is high, making solutions essential for companies seeking to stay compliant and improve their business practices.  Three key takeaways: 1. The DOJ identified data analytics as a part of a best practices compliance program in the Albemarle FCPA enforcement action.  2. Data-driven compliance allows companies to access their data, search vendors, analyze transactions, run corruption and fraud tests, and even evaluate predictive models. 3. Data-driven compliance should be designed to identify hidden money, prevent improper payments, and improve business efficiency. For more information on KonaAi, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices In the world of compliance, data analytics and monitoring have become increasingly important. The Department of Justice (DOJ) has emphasized the significance of effective compliance programs, highlighting the role of data analytics and technology-driven approaches. Data driven compliance helps companies gain insights into their data for informed decisions and improved compliance culture. Data-driven compliance should be designed to identify hidden money, prevent improper payments, and improve business efficiency. A key is the ability to facilitate collaboration and data sharing without compromising privacy or security, thereby enhancing the performance of predictive models.

In the Albemarle FCPA enforcement, the DOJ said for the first time that data-driven compliance is now a part of the requirements of an effective compliance program. By leveraging data and data analytics, compliance professionals more effectively manage risks, improve compliance culture, investigate issues, and ultimately keep companies out of trouble. Additionally, a robust data analytics platform will also contribute to making the business better by identifying hidden money, stopping improper payments, and enhancing overall business efficiency.

By leveraging data analytics, companies can identify hidden money, prevent improper payments, and enhance overall business efficiency. In today's regulatory environment, the risk of not adopting data-driven compliance approaches is high, making solutions essential for companies seeking to stay compliant and improve their business practices.

 Three key takeaways:

1. The DOJ identified data analytics as a part of a best practices compliance program in the Albemarle FCPA enforcement action. 

2. Data-driven compliance allows companies to access their data, search vendors, analyze transactions, run corruption and fraud tests, and even evaluate predictive models.

3. Data-driven compliance should be designed to identify hidden money, prevent improper payments, and improve business efficiency.

For more information on KonaAi, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 419 no One Month to a More Effective Compliance Program Through Culture - Improve Corporate Culture Through an Internal Podcast One of the biggest benefits of podcasting is that it allows businesses to connect with their audience more personally. Unlike traditional forms of advertising, which often come across as impersonal and sales-driven, podcasts enable businesses to build a loyal following by offering valuable and engaging content. This can include interviews with industry experts, behind-the-scenes glimpses of the business, and informative discussions on relevant topics. Now take these same concepts of audience engagement and apply them internally to an organization. What do you potentially have? A mechanism to engage your employees, to engender trust, and to improve your overall corporate culture. Do you think this is a crazy way to improve culture? Think again about all the advantages podcasting has in place already. A major US consumer product company started a podcast and had corporate executives on it. Who were the biggest fans of the podcast? It turned out it was the company employees, many of whom had never met their corporate executives. This allowed the executives to be humanized in a way no number of town hall meetings or other similar corporate events could ever achieve. Podcasting is a powerful tool that corporate compliance programs can use to connect with their audience on a more personal level. By investing in podcasting, corporations can create engaging and informative audio content that will help build their ethical brand (culture) and drive employee engagement. If you want a new and different way to talk to your employees, why not try podcasting? Since you are only limited by your imagination in compliance, why not use some of that to be creative in your compliance training and communications? Podcasting has become an essential tool for businesses to connect with their employees, establish themselves as thought leaders, and promote their values and culture. By investing in the right podcast equipment and software, corporate compliance functions can create high-quality audio content that engages their audience helps to achieve their ethical goals, and improves the culture of any organization.  Three key takeaways: 1. You can improve employee trust and corporate culture through employee trust. 2. Communicating through a podcast can increase your brand promise with employees and other stakeholders. 3. An internal podcast can humanize your leadership to your employees. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 30 Nov 2023 05:00:00 -0000 Improve Corporate Culture Through an Internal Podcast full Thomas Fox How you can improve corporate culture through an internal podcast. One of the biggest benefits of podcasting is that it allows businesses to connect with their audience more personally. Unlike traditional forms of advertising, which often come across as impersonal and sales-driven, podcasts enable businesses to build a loyal following by offering valuable and engaging content. This can include interviews with industry experts, behind-the-scenes glimpses of the business, and informative discussions on relevant topics. Now take these same concepts of audience engagement and apply them internally to an organization. What do you potentially have? A mechanism to engage your employees, to engender trust, and to improve your overall corporate culture. Do you think this is a crazy way to improve culture? Think again about all the advantages podcasting has in place already. A major US consumer product company started a podcast and had corporate executives on it. Who were the biggest fans of the podcast? It turned out it was the company employees, many of whom had never met their corporate executives. This allowed the executives to be humanized in a way no number of town hall meetings or other similar corporate events could ever achieve. Podcasting is a powerful tool that corporate compliance programs can use to connect with their audience on a more personal level. By investing in podcasting, corporations can create engaging and informative audio content that will help build their ethical brand (culture) and drive employee engagement. If you want a new and different way to talk to your employees, why not try podcasting? Since you are only limited by your imagination in compliance, why not use some of that to be creative in your compliance training and communications? Podcasting has become an essential tool for businesses to connect with their employees, establish themselves as thought leaders, and promote their values and culture. By investing in the right podcast equipment and software, corporate compliance functions can create high-quality audio content that engages their audience helps to achieve their ethical goals, and improves the culture of any organization.  Three key takeaways: 1. You can improve employee trust and corporate culture through employee trust. 2. Communicating through a podcast can increase your brand promise with employees and other stakeholders. 3. An internal podcast can humanize your leadership to your employees. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the biggest benefits of podcasting is that it allows businesses to connect with their audience more personally. Unlike traditional forms of advertising, which often come across as impersonal and sales-driven, podcasts enable businesses to build a loyal following by offering valuable and engaging content. This can include interviews with industry experts, behind-the-scenes glimpses of the business, and informative discussions on relevant topics.

Now take these same concepts of audience engagement and apply them internally to an organization. What do you potentially have? A mechanism to engage your employees, to engender trust, and to improve your overall corporate culture. Do you think this is a crazy way to improve culture? Think again about all the advantages podcasting has in place already.

A major US consumer product company started a podcast and had corporate executives on it. Who were the biggest fans of the podcast? It turned out it was the company employees, many of whom had never met their corporate executives. This allowed the executives to be humanized in a way no number of town hall meetings or other similar corporate events could ever achieve.

Podcasting is a powerful tool that corporate compliance programs can use to connect with their audience on a more personal level. By investing in podcasting, corporations can create engaging and informative audio content that will help build their ethical brand (culture) and drive employee engagement. If you want a new and different way to talk to your employees, why not try podcasting?

Since you are only limited by your imagination in compliance, why not use some of that to be creative in your compliance training and communications? Podcasting has become an essential tool for businesses to connect with their employees, establish themselves as thought leaders, and promote their values and culture. By investing in the right podcast equipment and software, corporate compliance functions can create high-quality audio content that engages their audience helps to achieve their ethical goals, and improves the culture of any organization.

 Three key takeaways:

1. You can improve employee trust and corporate culture through employee trust.

2. Communicating through a podcast can increase your brand promise with employees and other stakeholders.

3. An internal podcast can humanize your leadership to your employees.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 465 no One Month to a More Effective Compliance Program Through Culture: Day 16 - How a Culture of Speak Up Improves Corporate Culture What is a speak-up culture, and how does it improve the overall corporate culture? A speak-up culture is a work environment where open communication is encouraged, fostering trust and innovation. This culture is built on leadership that values listening and employee involvement in problem-solving. One of the key factors in fostering a speaking-up culture is protecting employees from retaliation. Anti-retaliation policies and procedures, training for middle managers, and a consistent, transparent process for investigating concerns are crucial to maintaining this culture. The fair process doctrine, which emphasizes transparency, consistency, and protection from retaliation, plays a significant role in building trust, encouraging engagement, and enhancing the overall organizational culture. Empowered Employees. When employees feel empowered to contribute their ideas, it can lead to significant positive outcomes for the organization. However, fostering a speak-up culture goes beyond just listening. Retaliation should never be tolerated, and organizations must make it clear that it will not be accepted under any circumstances. Role of Middle Managers. Middle managers play a vital role in fostering a speak-up culture. They need to be trained to listen, accept information, and report it to the appropriate channels. Consistency and transparency. Consistency and transparency in the investigation process are also key components of a speak-up culture. Organizations must have a clear process in place for investigating concerns, and employees should be aware of this process. Fostering a speak-up culture in the workplace is crucial for building trust, encouraging engagement, and enhancing the overall organizational culture. It requires leadership that values listening and employee involvement, as well as policies and procedures to protect employees from retaliation. Middle managers play a vital role in supporting employees and facilitating open communication. Consistency and transparency in the investigation process are essential for building trust and ensuring that employees feel comfortable bringing forward their concerns. By fostering a speak-up culture, organizations can create a culture where employees feel empowered to contribute their ideas and make a positive impact on the workplace.  Three key takeaways: 1. Having a reporting system is important but listening is equally critical. 2. Employees must be protected from retaliation. 3. Fostering a speak-up culture can create a culture where employees feel empowered to contribute their ideas and make a positive impact on the workplace. Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? Check out the new tool, The Culture Audit For more information click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 29 Nov 2023 05:00:00 -0000 Day 16 - How a Culture of Speak Up Improves Corporate Culture full 16 Thomas Fox Today we consider the element of a speak up culture and it improves overall corporate culture. What is a speak-up culture, and how does it improve the overall corporate culture? A speak-up culture is a work environment where open communication is encouraged, fostering trust and innovation. This culture is built on leadership that values listening and employee involvement in problem-solving. One of the key factors in fostering a speaking-up culture is protecting employees from retaliation. Anti-retaliation policies and procedures, training for middle managers, and a consistent, transparent process for investigating concerns are crucial to maintaining this culture. The fair process doctrine, which emphasizes transparency, consistency, and protection from retaliation, plays a significant role in building trust, encouraging engagement, and enhancing the overall organizational culture. Empowered Employees. When employees feel empowered to contribute their ideas, it can lead to significant positive outcomes for the organization. However, fostering a speak-up culture goes beyond just listening. Retaliation should never be tolerated, and organizations must make it clear that it will not be accepted under any circumstances. Role of Middle Managers. Middle managers play a vital role in fostering a speak-up culture. They need to be trained to listen, accept information, and report it to the appropriate channels. Consistency and transparency. Consistency and transparency in the investigation process are also key components of a speak-up culture. Organizations must have a clear process in place for investigating concerns, and employees should be aware of this process. Fostering a speak-up culture in the workplace is crucial for building trust, encouraging engagement, and enhancing the overall organizational culture. It requires leadership that values listening and employee involvement, as well as policies and procedures to protect employees from retaliation. Middle managers play a vital role in supporting employees and facilitating open communication. Consistency and transparency in the investigation process are essential for building trust and ensuring that employees feel comfortable bringing forward their concerns. By fostering a speak-up culture, organizations can create a culture where employees feel empowered to contribute their ideas and make a positive impact on the workplace.  Three key takeaways: 1. Having a reporting system is important but listening is equally critical. 2. Employees must be protected from retaliation. 3. Fostering a speak-up culture can create a culture where employees feel empowered to contribute their ideas and make a positive impact on the workplace. Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? Check out the new tool, The Culture Audit For more information click here. Learn more about your ad choices. Visit megaphone.fm/adchoices What is a speak-up culture, and how does it improve the overall corporate culture? A speak-up culture is a work environment where open communication is encouraged, fostering trust and innovation. This culture is built on leadership that values listening and employee involvement in problem-solving. One of the key factors in fostering a speaking-up culture is protecting employees from retaliation. Anti-retaliation policies and procedures, training for middle managers, and a consistent, transparent process for investigating concerns are crucial to maintaining this culture. The fair process doctrine, which emphasizes transparency, consistency, and protection from retaliation, plays a significant role in building trust, encouraging engagement, and enhancing the overall organizational culture.

Empowered Employees. When employees feel empowered to contribute their ideas, it can lead to significant positive outcomes for the organization. However, fostering a speak-up culture goes beyond just listening. Retaliation should never be tolerated, and organizations must make it clear that it will not be accepted under any circumstances.

Role of Middle Managers. Middle managers play a vital role in fostering a speak-up culture. They need to be trained to listen, accept information, and report it to the appropriate channels.

Consistency and transparency. Consistency and transparency in the investigation process are also key components of a speak-up culture. Organizations must have a clear process in place for investigating concerns, and employees should be aware of this process.

Fostering a speak-up culture in the workplace is crucial for building trust, encouraging engagement, and enhancing the overall organizational culture. It requires leadership that values listening and employee involvement, as well as policies and procedures to protect employees from retaliation. Middle managers play a vital role in supporting employees and facilitating open communication. Consistency and transparency in the investigation process are essential for building trust and ensuring that employees feel comfortable bringing forward their concerns. By fostering a speak-up culture, organizations can create a culture where employees feel empowered to contribute their ideas and make a positive impact on the workplace.

 Three key takeaways:

1. Having a reporting system is important but listening is equally critical.

2. Employees must be protected from retaliation.

3. Fostering a speak-up culture can create a culture where employees feel empowered to contribute their ideas and make a positive impact on the workplace.

Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? Check out the new tool, The Culture Audit For more information click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 443 no One Month to a More Effective Compliance Program Through Culture-Day 15-The ROI of a Culture of Speak Up We are now at a place where there is sufficient data, academic research, and actual use cases from corporations and businesses that demonstrate good ethics and compliance programs are not simply good for business but when properly used, they lead to greater profitability. For 15 years, Ethisphere has been collecting data around its World’s Most Ethical Company awards. Companies which receive this designation have been found to outperform their peers on various stock indices. Ethisphere calls this the “Ethics Premium.” Ethisphere Executive Vice President (EVP) Erica Salmon Byrne has noted, “In tracking how the stock prices of publicly traded honorees compare to the U.S. Large Cap Index, we found that listed World’s Most Ethical Companies outperformed the large cap sector.” In 2010 that number was a delta of 4.5%. Yet by 2020 that number had skyrocketed to 13.5%. Clearly Ethisphere has been on to something. Academic research has also shown the efficacy of ethics and compliance programs. George Serafeim and Paul M. Healy demonstrated in their paper, An Analysis of Firm’s Self-Reported Anti-Corruption Efforts, that companies with robust compliance programs do better financially in countries prone to corruption than companies with less effective compliance programs. Without a robust compliance program, even with high sales in a high-risk country, the sales will drop off and lead to a negative Return on Equity (ROE) of between 24% to 30%. Dr. Kyle Welch, Assistant Professor at George Washington University (GWU), in his paper, co-authored with Stephen Stubben, Associate Professor from The University of Utah, entitled “Evidence on the Use and Efficacy of Internal Whistleblowing Systems” (Report). In this paper, Welch and Stubben reviewed some 15 years of anonymized data from NAVEX Global, Inc. This data was from the company’s hotline reporting systems. Some of the key findings included that companies with a robust whistleblower and reporting system had greater profitability and workforce productivity as measured by Return on Assets (ROA) and there were fewer material lawsuits brought against the company overall and there were lower settlement costs if a lawsuit did occur. Finally, there were fewer external whistleblower reports to regulatory agencies and other authorities.  Three key takeaways: 1. It’s not simply speaking up, it's a culture of speak up. 2. Companies with speak up culture, have a material reduction in legal fines and penalties. 3. Use Companies with speak up culture, have a higher ROI. Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? Check out this great new tool, The Culture Audit. For more information, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 28 Nov 2023 16:51:00 -0000 Day 15-The ROI of a Culture of Speak Up full 15 Thomas Fox Today we consider the ROI of a culture of speak up. We are now at a place where there is sufficient data, academic research, and actual use cases from corporations and businesses that demonstrate good ethics and compliance programs are not simply good for business but when properly used, they lead to greater profitability. For 15 years, Ethisphere has been collecting data around its World’s Most Ethical Company awards. Companies which receive this designation have been found to outperform their peers on various stock indices. Ethisphere calls this the “Ethics Premium.” Ethisphere Executive Vice President (EVP) Erica Salmon Byrne has noted, “In tracking how the stock prices of publicly traded honorees compare to the U.S. Large Cap Index, we found that listed World’s Most Ethical Companies outperformed the large cap sector.” In 2010 that number was a delta of 4.5%. Yet by 2020 that number had skyrocketed to 13.5%. Clearly Ethisphere has been on to something. Academic research has also shown the efficacy of ethics and compliance programs. George Serafeim and Paul M. Healy demonstrated in their paper, An Analysis of Firm’s Self-Reported Anti-Corruption Efforts, that companies with robust compliance programs do better financially in countries prone to corruption than companies with less effective compliance programs. Without a robust compliance program, even with high sales in a high-risk country, the sales will drop off and lead to a negative Return on Equity (ROE) of between 24% to 30%. Dr. Kyle Welch, Assistant Professor at George Washington University (GWU), in his paper, co-authored with Stephen Stubben, Associate Professor from The University of Utah, entitled “Evidence on the Use and Efficacy of Internal Whistleblowing Systems” (Report). In this paper, Welch and Stubben reviewed some 15 years of anonymized data from NAVEX Global, Inc. This data was from the company’s hotline reporting systems. Some of the key findings included that companies with a robust whistleblower and reporting system had greater profitability and workforce productivity as measured by Return on Assets (ROA) and there were fewer material lawsuits brought against the company overall and there were lower settlement costs if a lawsuit did occur. Finally, there were fewer external whistleblower reports to regulatory agencies and other authorities.  Three key takeaways: 1. It’s not simply speaking up, it's a culture of speak up. 2. Companies with speak up culture, have a material reduction in legal fines and penalties. 3. Use Companies with speak up culture, have a higher ROI. Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? Check out this great new tool, The Culture Audit. For more information, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices We are now at a place where there is sufficient data, academic research, and actual use cases from corporations and businesses that demonstrate good ethics and compliance programs are not simply good for business but when properly used, they lead to greater profitability.

For 15 years, Ethisphere has been collecting data around its World’s Most Ethical Company awards. Companies which receive this designation have been found to outperform their peers on various stock indices. Ethisphere calls this the “Ethics Premium.” Ethisphere Executive Vice President (EVP) Erica Salmon Byrne has noted, “In tracking how the stock prices of publicly traded honorees compare to the U.S. Large Cap Index, we found that listed World’s Most Ethical Companies outperformed the large cap sector.” In 2010 that number was a delta of 4.5%. Yet by 2020 that number had skyrocketed to 13.5%. Clearly Ethisphere has been on to something.

Academic research has also shown the efficacy of ethics and compliance programs. George Serafeim and Paul M. Healy demonstrated in their paper, An Analysis of Firm’s Self-Reported Anti-Corruption Efforts, that companies with robust compliance programs do better financially in countries prone to corruption than companies with less effective compliance programs. Without a robust compliance program, even with high sales in a high-risk country, the sales will drop off and lead to a negative Return on Equity (ROE) of between 24% to 30%.

Dr. Kyle Welch, Assistant Professor at George Washington University (GWU), in his paper, co-authored with Stephen Stubben, Associate Professor from The University of Utah, entitled “Evidence on the Use and Efficacy of Internal Whistleblowing Systems” (Report). In this paper, Welch and Stubben reviewed some 15 years of anonymized data from NAVEX Global, Inc. This data was from the company’s hotline reporting systems. Some of the key findings included that companies with a robust whistleblower and reporting system had greater profitability and workforce productivity as measured by Return on Assets (ROA) and there were fewer material lawsuits brought against the company overall and there were lower settlement costs if a lawsuit did occur. Finally, there were fewer external whistleblower reports to regulatory agencies and other authorities.

 Three key takeaways:

1. It’s not simply speaking up, it's a culture of speak up.

2. Companies with speak up culture, have a material reduction in legal fines and penalties.

3. Use Companies with speak up culture, have a higher ROI.


Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? Check out this great new tool, The Culture Audit. For more information, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 507 no One Month to a More Effective Compliance Program Through Culture: Day 14 - How Investigative Triage Can Drive Culture One area that organizations rarely consider impacting culture is the assessment and triage process in a hotline or speak up process. A proactive approach allows for increased response time and the ability to set realistic expectations for stakeholders, but this is a key component for improving corporate culture. One mechanism not thought of by compliance professionals is the setting of service level agreements (SLAs) to set response times based on the nature of the allegation. This concept, borrowed from customer service practices, ensures that employees who come forward with complaints or allegations are provided with a clear understanding of the expected timeline for response and communication. By setting these expectations, organizations can foster a culture of open communication and trust. Obviously a triage process is particularly important for multinational companies that operate across different regions. With varying compliance programs and regulations in different countries, having a well-documented process becomes essential. It allows compliance departments to navigate the complexities of compliance programs and investigations, ensuring consistency and adherence to local laws. The triage process and technology play a vital role in promoting a corporate culture and. By proactively assessing and triaging complaints and allegations, organizations can increase response time and set realistic expectations for stakeholders. It is important to consider the impact on employee rights and the need for thorough investigations when making decisions about the importance of triage process and technology in organizational compliance.  Three key takeaways: 1. Think about how your triage process can be used to foster culture. 2. Set Service Level Agreements, make them public and adhere to them to engender trust in your organization. 3. However, it is important to recognize the tradeoffs involved in balancing different factors when implementing a triage process. Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 27 Nov 2023 16:28:00 -0000 Day 14-How Investigative Triage Can Drive Culture full 14 Thomas Fox Today we consider how investigative triage and drive and improve corporate culture. One area that organizations rarely consider impacting culture is the assessment and triage process in a hotline or speak up process. A proactive approach allows for increased response time and the ability to set realistic expectations for stakeholders, but this is a key component for improving corporate culture. One mechanism not thought of by compliance professionals is the setting of service level agreements (SLAs) to set response times based on the nature of the allegation. This concept, borrowed from customer service practices, ensures that employees who come forward with complaints or allegations are provided with a clear understanding of the expected timeline for response and communication. By setting these expectations, organizations can foster a culture of open communication and trust. Obviously a triage process is particularly important for multinational companies that operate across different regions. With varying compliance programs and regulations in different countries, having a well-documented process becomes essential. It allows compliance departments to navigate the complexities of compliance programs and investigations, ensuring consistency and adherence to local laws. The triage process and technology play a vital role in promoting a corporate culture and. By proactively assessing and triaging complaints and allegations, organizations can increase response time and set realistic expectations for stakeholders. It is important to consider the impact on employee rights and the need for thorough investigations when making decisions about the importance of triage process and technology in organizational compliance.  Three key takeaways: 1. Think about how your triage process can be used to foster culture. 2. Set Service Level Agreements, make them public and adhere to them to engender trust in your organization. 3. However, it is important to recognize the tradeoffs involved in balancing different factors when implementing a triage process. Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices One area that organizations rarely consider impacting culture is the assessment and triage process in a hotline or speak up process. A proactive approach allows for increased response time and the ability to set realistic expectations for stakeholders, but this is a key component for improving corporate culture. One mechanism not thought of by compliance professionals is the setting of service level agreements (SLAs) to set response times based on the nature of the allegation. This concept, borrowed from customer service practices, ensures that employees who come forward with complaints or allegations are provided with a clear understanding of the expected timeline for response and communication. By setting these expectations, organizations can foster a culture of open communication and trust.

Obviously a triage process is particularly important for multinational companies that operate across different regions. With varying compliance programs and regulations in different countries, having a well-documented process becomes essential. It allows compliance departments to navigate the complexities of compliance programs and investigations, ensuring consistency and adherence to local laws.

The triage process and technology play a vital role in promoting a corporate culture and. By proactively assessing and triaging complaints and allegations, organizations can increase response time and set realistic expectations for stakeholders. It is important to consider the impact on employee rights and the need for thorough investigations when making decisions about the importance of triage process and technology in organizational compliance.

 Three key takeaways:

1. Think about how your triage process can be used to foster culture.

2. Set Service Level Agreements, make them public and adhere to them to engender trust in your organization.

3. However, it is important to recognize the tradeoffs involved in balancing different factors when implementing a triage process.


Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom

Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 425 no One Month to a More Effective Compliance Program Through Culture - Day 13 - Preventing Retaliation to Improve Culture Retaliation against a person who speaks up is a pervasive issue that not only creates a toxic work environment but also discourages victims from reporting incidents. This means you must address retaliation and encourage reporting in workplaces. When employees report harassment face severe retaliation, which leads to a loss of trust in the reporting process. This fear of being labeled a "rat" or "gossip" often prevents victims from coming forward and seeking justice. To combat this issue, non-retaliation protocols are crucial to protect individuals and ensure legal compliance. Non-retaliation protocols must be in place to encourage reporting. The fear of retaliation is deeply rooted in the perception of being a whistleblower or complainant. Every compliance must have strong policies, consequences for violators, and open workplace conversations to empower bystanders. Bystanders play a crucial role in identifying and reporting harassment, but they often fear retaliation or loyalty conflicts. Addressing retaliation and encouraging reporting in workplaces requires a multifaceted approach. Strong non-retaliation protocols, open workplace conversations, and the empowerment of bystanders are key factors in creating a safe and inclusive work environment. By prioritizing the well-being of employees and fostering a culture of trust, organizations can effectively combat sexual harassment and ensure compliance with legal and regulatory requirements. Three key takeaways: 1. You must have robust policies and procedures against retaliation. 2. A lack of confidential reports will have an impact on culture. 3. Bystanders are the key to a robust culture. Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 17 Nov 2023 05:00:00 -0000 Day 13 - Preventing Retaliation to Improve Culture full Thomas Fox How your non-retaliation program can improve corporate culture. Retaliation against a person who speaks up is a pervasive issue that not only creates a toxic work environment but also discourages victims from reporting incidents. This means you must address retaliation and encourage reporting in workplaces. When employees report harassment face severe retaliation, which leads to a loss of trust in the reporting process. This fear of being labeled a "rat" or "gossip" often prevents victims from coming forward and seeking justice. To combat this issue, non-retaliation protocols are crucial to protect individuals and ensure legal compliance. Non-retaliation protocols must be in place to encourage reporting. The fear of retaliation is deeply rooted in the perception of being a whistleblower or complainant. Every compliance must have strong policies, consequences for violators, and open workplace conversations to empower bystanders. Bystanders play a crucial role in identifying and reporting harassment, but they often fear retaliation or loyalty conflicts. Addressing retaliation and encouraging reporting in workplaces requires a multifaceted approach. Strong non-retaliation protocols, open workplace conversations, and the empowerment of bystanders are key factors in creating a safe and inclusive work environment. By prioritizing the well-being of employees and fostering a culture of trust, organizations can effectively combat sexual harassment and ensure compliance with legal and regulatory requirements. Three key takeaways: 1. You must have robust policies and procedures against retaliation. 2. A lack of confidential reports will have an impact on culture. 3. Bystanders are the key to a robust culture. Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Retaliation against a person who speaks up is a pervasive issue that not only creates a toxic work environment but also discourages victims from reporting incidents. This means you must address retaliation and encourage reporting in workplaces. When employees report harassment face severe retaliation, which leads to a loss of trust in the reporting process. This fear of being labeled a "rat" or "gossip" often prevents victims from coming forward and seeking justice. To combat this issue, non-retaliation protocols are crucial to protect individuals and ensure legal compliance.

Non-retaliation protocols must be in place to encourage reporting. The fear of retaliation is deeply rooted in the perception of being a whistleblower or complainant. Every compliance must have strong policies, consequences for violators, and open workplace conversations to empower bystanders. Bystanders play a crucial role in identifying and reporting harassment, but they often fear retaliation or loyalty conflicts.

Addressing retaliation and encouraging reporting in workplaces requires a multifaceted approach. Strong non-retaliation protocols, open workplace conversations, and the empowerment of bystanders are key factors in creating a safe and inclusive work environment. By prioritizing the well-being of employees and fostering a culture of trust, organizations can effectively combat sexual harassment and ensure compliance with legal and regulatory requirements.

Three key takeaways:

1. You must have robust policies and procedures against retaliation.

2. A lack of confidential reports will have an impact on culture.

3. Bystanders are the key to a robust culture.

Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom

Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 468 no One Month to More Effective Compliance Through Culture: Day 12 - Fixing an Unsafe Workplace We continue to look at fostering an ethical culture through psychological safety, using as a starting point the “Fostering Ethical Conduct Through Psychological Safety” whose authors believe that “when psychological safety is lacking, it may be a consequence of the employee having witnessed unethical behavior.” The more unethical behavior a person sees, the more likely they are to feel psychologically unsafe. The authors basically state the obvious when they write, “It makes intuitive sense that being in a work environment where unethical behavior is prevalent might diminish psychological safety.” Put another way “people are most reluctant to speak up in ethically troubled environments, where we most need them to do so.” This is an important issue for every CCO and business leader. To overcome such a deficiency, they found that “several other factors correlated with strong speak-up behavior, keeping everything else constant: moral engagement, moral attentiveness, and organizational justice combined with clarity of expectations.” Moral engagement. As a CCO you should endeavor to create an atmosphere where ethical conduct matters, “so that when employees recognize a potentially unethical situation, they will be motivated to do what’s right.” Moral attentiveness. You can educate employees to recognize the ethical dimensions of situations. You can have managers highlight examples of ethical and unethical behavior with their teams and encourage dialogue on workplace ethics. Organizational justice. Obviously, talk is cheap and it is actions, not deeds, that matter. The DOJ has made clear in the 2023 Evaluation of Corporate Compliance Programs that the keeper and responsibility of institutional justice sits with the CCO and the authors find that this same concept “is vital to building a reputation of organizational justice.” Clarity of expectations. CCOs must communicate a clear message to employees so that employees will have “an understanding of organizational standards and are clear about expectations.” Unethical conduct can remain hidden for a time but is likely to be discovered eventually, causing far more harm than if it were caught and corrected early. Psychological safety thus can help organizations respond and improve quickly instead of allowing misconduct and unethical behavior to fester and further degrade workplace psychological safety, thus triggering a vicious cycle.” Three key takeaways: 1. Without psychological safety, corporate culture with suffer. 2. When your CEO engages in illegal behavior what is the impact on culture? 3. Use moral engagement, moral attentiveness, and organizational justice to foster an improved culture. Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 16 Nov 2023 05:00:00 -0000 Day 12 - Fixing an Unsafe Workplace full Thomas Fox Today we consider the opposite of psychological safety; an unsafe workplace and how to fix it. We continue to look at fostering an ethical culture through psychological safety, using as a starting point the “Fostering Ethical Conduct Through Psychological Safety” whose authors believe that “when psychological safety is lacking, it may be a consequence of the employee having witnessed unethical behavior.” The more unethical behavior a person sees, the more likely they are to feel psychologically unsafe. The authors basically state the obvious when they write, “It makes intuitive sense that being in a work environment where unethical behavior is prevalent might diminish psychological safety.” Put another way “people are most reluctant to speak up in ethically troubled environments, where we most need them to do so.” This is an important issue for every CCO and business leader. To overcome such a deficiency, they found that “several other factors correlated with strong speak-up behavior, keeping everything else constant: moral engagement, moral attentiveness, and organizational justice combined with clarity of expectations.” Moral engagement. As a CCO you should endeavor to create an atmosphere where ethical conduct matters, “so that when employees recognize a potentially unethical situation, they will be motivated to do what’s right.” Moral attentiveness. You can educate employees to recognize the ethical dimensions of situations. You can have managers highlight examples of ethical and unethical behavior with their teams and encourage dialogue on workplace ethics. Organizational justice. Obviously, talk is cheap and it is actions, not deeds, that matter. The DOJ has made clear in the 2023 Evaluation of Corporate Compliance Programs that the keeper and responsibility of institutional justice sits with the CCO and the authors find that this same concept “is vital to building a reputation of organizational justice.” Clarity of expectations. CCOs must communicate a clear message to employees so that employees will have “an understanding of organizational standards and are clear about expectations.” Unethical conduct can remain hidden for a time but is likely to be discovered eventually, causing far more harm than if it were caught and corrected early. Psychological safety thus can help organizations respond and improve quickly instead of allowing misconduct and unethical behavior to fester and further degrade workplace psychological safety, thus triggering a vicious cycle.” Three key takeaways: 1. Without psychological safety, corporate culture with suffer. 2. When your CEO engages in illegal behavior what is the impact on culture? 3. Use moral engagement, moral attentiveness, and organizational justice to foster an improved culture. Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices We continue to look at fostering an ethical culture through psychological safety, using as a starting point the “Fostering Ethical Conduct Through Psychological Safety” whose authors believe that “when psychological safety is lacking, it may be a consequence of the employee having witnessed unethical behavior.” The more unethical behavior a person sees, the more likely they are to feel psychologically unsafe.

The authors basically state the obvious when they write, “It makes intuitive sense that being in a work environment where unethical behavior is prevalent might diminish psychological safety.” Put another way “people are most reluctant to speak up in ethically troubled environments, where we most need them to do so.” This is an important issue for every CCO and business leader. To overcome such a deficiency, they found that “several other factors correlated with strong speak-up behavior, keeping everything else constant: moral engagement, moral attentiveness, and organizational justice combined with clarity of expectations.”

Moral engagement. As a CCO you should endeavor to create an atmosphere where ethical conduct matters, “so that when employees recognize a potentially unethical situation, they will be motivated to do what’s right.”

Moral attentiveness. You can educate employees to recognize the ethical dimensions of situations. You can have managers highlight examples of ethical and unethical behavior with their teams and encourage dialogue on workplace ethics.

Organizational justice. Obviously, talk is cheap and it is actions, not deeds, that matter. The DOJ has made clear in the 2023 Evaluation of Corporate Compliance Programs that the keeper and responsibility of institutional justice sits with the CCO and the authors find that this same concept “is vital to building a reputation of organizational justice.”

Clarity of expectations. CCOs must communicate a clear message to employees so that employees will have “an understanding of organizational standards and are clear about expectations.”

Unethical conduct can remain hidden for a time but is likely to be discovered eventually, causing far more harm than if it were caught and corrected early. Psychological safety thus can help organizations respond and improve quickly instead of allowing misconduct and unethical behavior to fester and further degrade workplace psychological safety, thus triggering a vicious cycle.”


Three key takeaways:

1. Without psychological safety, corporate culture with suffer.

2. When your CEO engages in illegal behavior what is the impact on culture?

3. Use moral engagement, moral attentiveness, and organizational justice to foster an improved culture.

Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 468 no One Month to a More Effective Compliance Program Through Culture: Day 11 - Psychological Safety in the Middle Advancing ethical culture through psychological safety can be a powerful tool. But how can you determine the state of psychological safety in your organization? Once again using the article “Fostering Ethical Conduct Through Psychological Safety” as a starting point, “there are a number of things organizations can do to make it more likely that people will speak up when they observe unethical behaviors.” But one key is psychological safety, defined by co-author Edmondson as “a shared belief held by members of a team that the team is safe for interpersonal risk-taking” — or, put another way, that “we can say what we think” or “be ourselves around here.” There is a non-siloed nature of psychological safety at the workplace. Ethics, risk management, legal and compliance functions, plus HR all share an interest in fostering such an environment. This mandates a cross-functional approach as an essential requirement of molding an organization’s culture to include psychological safety. The authors believe, “Managers throughout a company must become aware of the blind spots created by a psychologically unsafe environment, along with the associated risk of underreported misconduct.” They also caution that a formal program such as a reporting hotline “may capture only a fraction of the problematic behaviors that occur.” This leads the authors to posit that gauging psychological safety “may help companies determine whether misconduct is being reported and, in turn, enhance the effectiveness of their formal speak-up programs.” The authors also confirmed a greater problem which is that “in a global context, psychological safety is not uniform across nations.” Survey respondents from “the Americas and Europe tended to score higher on psychological safety than respondents from Asia.” This suggests to the authors that “the potential effectiveness of tailoring interventions that promote speaking up in order to address the specific circumstances of different groups of employees.” Moreover, “global organizations that seek to build psychological safety must assess its various region-specific drivers and derailers to adjust their activities to specific seniorities and cultures.”  Three key takeaways: 1. How can you determine the state of psychological safety in your organization? 2. Psychologically safety at the workplace is non-siloed. 3. Middle managers are critical. Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 15 Nov 2023 12:09:00 -0000 Day 11- Psychological Safety in the Middle full Thomas Fox We continue our look at psychological safety leading to culture improve. Today, in the middle. Advancing ethical culture through psychological safety can be a powerful tool. But how can you determine the state of psychological safety in your organization? Once again using the article “Fostering Ethical Conduct Through Psychological Safety” as a starting point, “there are a number of things organizations can do to make it more likely that people will speak up when they observe unethical behaviors.” But one key is psychological safety, defined by co-author Edmondson as “a shared belief held by members of a team that the team is safe for interpersonal risk-taking” — or, put another way, that “we can say what we think” or “be ourselves around here.” There is a non-siloed nature of psychological safety at the workplace. Ethics, risk management, legal and compliance functions, plus HR all share an interest in fostering such an environment. This mandates a cross-functional approach as an essential requirement of molding an organization’s culture to include psychological safety. The authors believe, “Managers throughout a company must become aware of the blind spots created by a psychologically unsafe environment, along with the associated risk of underreported misconduct.” They also caution that a formal program such as a reporting hotline “may capture only a fraction of the problematic behaviors that occur.” This leads the authors to posit that gauging psychological safety “may help companies determine whether misconduct is being reported and, in turn, enhance the effectiveness of their formal speak-up programs.” The authors also confirmed a greater problem which is that “in a global context, psychological safety is not uniform across nations.” Survey respondents from “the Americas and Europe tended to score higher on psychological safety than respondents from Asia.” This suggests to the authors that “the potential effectiveness of tailoring interventions that promote speaking up in order to address the specific circumstances of different groups of employees.” Moreover, “global organizations that seek to build psychological safety must assess its various region-specific drivers and derailers to adjust their activities to specific seniorities and cultures.”  Three key takeaways: 1. How can you determine the state of psychological safety in your organization? 2. Psychologically safety at the workplace is non-siloed. 3. Middle managers are critical. Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Advancing ethical culture through psychological safety can be a powerful tool. But how can you determine the state of psychological safety in your organization? Once again using the article “Fostering Ethical Conduct Through Psychological Safety” as a starting point, “there are a number of things organizations can do to make it more likely that people will speak up when they observe unethical behaviors.” But one key is psychological safety, defined by co-author Edmondson as “a shared belief held by members of a team that the team is safe for interpersonal risk-taking” — or, put another way, that “we can say what we think” or “be ourselves around here.”

There is a non-siloed nature of psychological safety at the workplace. Ethics, risk management, legal and compliance functions, plus HR all share an interest in fostering such an environment. This mandates a cross-functional approach as an essential requirement of molding an organization’s culture to include psychological safety. The authors believe, “Managers throughout a company must become aware of the blind spots created by a psychologically unsafe environment, along with the associated risk of underreported misconduct.” They also caution that a formal program such as a reporting hotline “may capture only a fraction of the problematic behaviors that occur.” This leads the authors to posit that gauging psychological safety “may help companies determine whether misconduct is being reported and, in turn, enhance the effectiveness of their formal speak-up programs.”

The authors also confirmed a greater problem which is that “in a global context, psychological safety is not uniform across nations.” Survey respondents from “the Americas and Europe tended to score higher on psychological safety than respondents from Asia.” This suggests to the authors that “the potential effectiveness of tailoring interventions that promote speaking up in order to address the specific circumstances of different groups of employees.” Moreover, “global organizations that seek to build psychological safety must assess its various region-specific drivers and derailers to adjust their activities to specific seniorities and cultures.”

 Three key takeaways:

1. How can you determine the state of psychological safety in your organization?

2. Psychologically safety at the workplace is non-siloed.

3. Middle managers are critical.

Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 470 no One Month to a More Effective Compliance Program Through Culture: Day 10 - Improving Culture Through Investigations Meric Bloch strongly emphasizes the importance of workplace investigations and fostering a culture of employee compliance. He believes that merely setting up a hotline and establishing policies is insufficient; companies must actively engage with employees to understand their motivations for speaking up or remaining silent. Bloch also underscores the need for accountability and a critical evaluation of the effectiveness of compliance programs. His experiences with multinational companies have shaped his understanding of the challenges they face, particularly the fear of being perceived as incompetent and the difficulties in reporting.  One of the key points raised by Bloch is the importance of making speaking up meaningful and credible. He pointed out that companies often fail to clearly communicate what should be reported, leading to confusion among employees. Another challenge highlighted by Bloch is the lack of follow-up interviews and education for reporters. He stressed the need for organizations to engage with reporters and gather additional information to gain a better understanding of the context and potential gaps in the initial report. Bloch also discussed the importance of addressing friction points within organizations. He mentioned that employees often hesitate to speak up due to concerns about the involvement of headquarters or fear of retaliation. Organizations need to actively address these concerns and create an environment where employees feel safe and supported when reporting issues. In order to create a culture of speaking up, organizations must move beyond passive measures such as hotlines and policies. They need to actively engage with employees, educate them about their role in the process, and provide clear guidance on what should be reported. By doing so, organizations can foster a culture of compliance where employees feel empowered to speak up and contribute to maintaining ethical standards. In order to create a culture of speaking up, organizations must move beyond passive measures such as hotlines and policies. They need to actively engage with employees, educate them about their role in the process, and provide clear guidance on what should be reported. By doing so, organizations can foster a culture of compliance where employees feel empowered to speak up and contribute to maintaining ethical standards.  Three key takeaways: 1. Your investigation process must go beyond simply policies and procedures. 2. Seeking additional information from a reporter will enhance both the investigative process and your culture. 3. Remove friction points in the speak-up and investigative process.  Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 14 Nov 2023 05:00:00 -0000 Day 10 - Improving Culture Through Investigations full Thomas Fox Today, I visit with Meric Bloch on how investigations can improves culture. Meric Bloch strongly emphasizes the importance of workplace investigations and fostering a culture of employee compliance. He believes that merely setting up a hotline and establishing policies is insufficient; companies must actively engage with employees to understand their motivations for speaking up or remaining silent. Bloch also underscores the need for accountability and a critical evaluation of the effectiveness of compliance programs. His experiences with multinational companies have shaped his understanding of the challenges they face, particularly the fear of being perceived as incompetent and the difficulties in reporting.  One of the key points raised by Bloch is the importance of making speaking up meaningful and credible. He pointed out that companies often fail to clearly communicate what should be reported, leading to confusion among employees. Another challenge highlighted by Bloch is the lack of follow-up interviews and education for reporters. He stressed the need for organizations to engage with reporters and gather additional information to gain a better understanding of the context and potential gaps in the initial report. Bloch also discussed the importance of addressing friction points within organizations. He mentioned that employees often hesitate to speak up due to concerns about the involvement of headquarters or fear of retaliation. Organizations need to actively address these concerns and create an environment where employees feel safe and supported when reporting issues. In order to create a culture of speaking up, organizations must move beyond passive measures such as hotlines and policies. They need to actively engage with employees, educate them about their role in the process, and provide clear guidance on what should be reported. By doing so, organizations can foster a culture of compliance where employees feel empowered to speak up and contribute to maintaining ethical standards. In order to create a culture of speaking up, organizations must move beyond passive measures such as hotlines and policies. They need to actively engage with employees, educate them about their role in the process, and provide clear guidance on what should be reported. By doing so, organizations can foster a culture of compliance where employees feel empowered to speak up and contribute to maintaining ethical standards.  Three key takeaways: 1. Your investigation process must go beyond simply policies and procedures. 2. Seeking additional information from a reporter will enhance both the investigative process and your culture. 3. Remove friction points in the speak-up and investigative process.  Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Meric Bloch strongly emphasizes the importance of workplace investigations and fostering a culture of employee compliance. He believes that merely setting up a hotline and establishing policies is insufficient; companies must actively engage with employees to understand their motivations for speaking up or remaining silent. Bloch also underscores the need for accountability and a critical evaluation of the effectiveness of compliance programs. His experiences with multinational companies have shaped his understanding of the challenges they face, particularly the fear of being perceived as incompetent and the difficulties in reporting. 

One of the key points raised by Bloch is the importance of making speaking up meaningful and credible. He pointed out that companies often fail to clearly communicate what should be reported, leading to confusion among employees. Another challenge highlighted by Bloch is the lack of follow-up interviews and education for reporters. He stressed the need for organizations to engage with reporters and gather additional information to gain a better understanding of the context and potential gaps in the initial report. Bloch also discussed the importance of addressing friction points within organizations. He mentioned that employees often hesitate to speak up due to concerns about the involvement of headquarters or fear of retaliation. Organizations need to actively address these concerns and create an environment where employees feel safe and supported when reporting issues.

In order to create a culture of speaking up, organizations must move beyond passive measures such as hotlines and policies. They need to actively engage with employees, educate them about their role in the process, and provide clear guidance on what should be reported. By doing so, organizations can foster a culture of compliance where employees feel empowered to speak up and contribute to maintaining ethical standards.

In order to create a culture of speaking up, organizations must move beyond passive measures such as hotlines and policies. They need to actively engage with employees, educate them about their role in the process, and provide clear guidance on what should be reported. By doing so, organizations can foster a culture of compliance where employees feel empowered to speak up and contribute to maintaining ethical standards.

 Three key takeaways:

1. Your investigation process must go beyond simply policies and procedures.

2. Seeking additional information from a reporter will enhance both the investigative process and your culture.

3. Remove friction points in the speak-up and investigative process. 

Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 470 no One Month to a More Effective Compliance Program Through Culture: Day 9-Fostering Culture with Psychological Safety How can you improve corporate culture through speaking up? In an MIT Sloan Management Review, Summer edition, entitled “Fostering Ethical Conduct Through Psychological Safety” authors Antoine Ferrère, Chris Rider, Baiba Renerte, and Amy Edmondson asked such questions as “How do organizations encourage people to speak up about ethical breaches, whether inadvertent or deliberate?” and “Why do some employees choose to remain silent when others report misconduct?” Additionally, they “analyzed the perceptions of those who report misconduct against those of “silent bystanders” to help “better understand both the drivers and derailers of speaking up — and revealed insights into how leaders and compliance officers can encourage employees to make such reports.’” The authors believe today, “it is more essential than ever that when misconduct happens or difficult problems arise, there is a strong ethical climate for surfacing information so leaders can respond quickly and appropriately. An environment in which employees feel comfortable reporting such issues is also vital to preventing future misconduct.” The authors believe that a “healthy organizational culture is one in which speaking up and listening go hand in hand, reinforcing ethical standards. If concerns are expressed, changes can be made promptly.” This is important because it moves from the detect prong to the prevent prong, which is by far the most important and effective prong in any compliance regime. Further ideas or innovations, rather than simply reporting untoward actions, can make a company more efficient and more profitable. This means a company can receive far more benefits than monetary fines or penalty avoidance if psychological safety exists.  Three key takeaways: 1. How a speak-up culture improves your culture. 2. What is the role of psychological safety in improving culture? 3. What is the role of externals in your corporate culture?  Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 13 Nov 2023 05:00:00 -0000 Day 9-Fostering Culture with Psychological Safety full Thomas Fox Today we explore how psychological safety impacts culture. How can you improve corporate culture through speaking up? In an MIT Sloan Management Review, Summer edition, entitled “Fostering Ethical Conduct Through Psychological Safety” authors Antoine Ferrère, Chris Rider, Baiba Renerte, and Amy Edmondson asked such questions as “How do organizations encourage people to speak up about ethical breaches, whether inadvertent or deliberate?” and “Why do some employees choose to remain silent when others report misconduct?” Additionally, they “analyzed the perceptions of those who report misconduct against those of “silent bystanders” to help “better understand both the drivers and derailers of speaking up — and revealed insights into how leaders and compliance officers can encourage employees to make such reports.’” The authors believe today, “it is more essential than ever that when misconduct happens or difficult problems arise, there is a strong ethical climate for surfacing information so leaders can respond quickly and appropriately. An environment in which employees feel comfortable reporting such issues is also vital to preventing future misconduct.” The authors believe that a “healthy organizational culture is one in which speaking up and listening go hand in hand, reinforcing ethical standards. If concerns are expressed, changes can be made promptly.” This is important because it moves from the detect prong to the prevent prong, which is by far the most important and effective prong in any compliance regime. Further ideas or innovations, rather than simply reporting untoward actions, can make a company more efficient and more profitable. This means a company can receive far more benefits than monetary fines or penalty avoidance if psychological safety exists.  Three key takeaways: 1. How a speak-up culture improves your culture. 2. What is the role of psychological safety in improving culture? 3. What is the role of externals in your corporate culture?  Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices How can you improve corporate culture through speaking up? In an MIT Sloan Management Review, Summer edition, entitled “Fostering Ethical Conduct Through Psychological Safety” authors Antoine Ferrère, Chris Rider, Baiba Renerte, and Amy Edmondson asked such questions as “How do organizations encourage people to speak up about ethical breaches, whether inadvertent or deliberate?” and “Why do some employees choose to remain silent when others report misconduct?” Additionally, they “analyzed the perceptions of those who report misconduct against those of “silent bystanders” to help “better understand both the drivers and derailers of speaking up — and revealed insights into how leaders and compliance officers can encourage employees to make such reports.’”

The authors believe today, “it is more essential than ever that when misconduct happens or difficult problems arise, there is a strong ethical climate for surfacing information so leaders can respond quickly and appropriately. An environment in which employees feel comfortable reporting such issues is also vital to preventing future misconduct.”

The authors believe that a “healthy organizational culture is one in which speaking up and listening go hand in hand, reinforcing ethical standards. If concerns are expressed, changes can be made promptly.” This is important because it moves from the detect prong to the prevent prong, which is by far the most important and effective prong in any compliance regime. Further ideas or innovations, rather than simply reporting untoward actions, can make a company more efficient and more profitable. This means a company can receive far more benefits than monetary fines or penalty avoidance if psychological safety exists.

 Three key takeaways:

1. How a speak-up culture improves your culture.

2. What is the role of psychological safety in improving culture?

3. What is the role of externals in your corporate culture? 

Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 477 no One Month to a More Effective Compliance Program Through Culture: Day 8 - A Listening Tour to Improve Culture Any top CEO must first listen. But it is more than simply listening to rebuild trust, it is rebuilding employee engagement by making them and their ideas part of the solution. Today, we consider how a compliance listening tour can improve culture. A.    Engagement Start off by meeting as many compliance stakeholders as possible. You can use town hall settings or go smaller, meeting with key employee leaders, key stakeholders, and employees identified as high-risk who you can meet with individually or in smaller groups. Listen to their compliance concerns and take their compliance ideas back to the home office. After returning to your office, winnow down their ideas and suggestions to form the basis of enhancements to your culture. This employee engagement will lead to greater stakeholder buy-in for your culture. B.    Education But during the town hall meetings, and the smaller more informal group meetings, you can do more than listen, you can also train. This training is on ethics and how the employees could use compliance as a business tool. Moreover, this lays the groundwork for enhancing your culture and the training that will occur as the enhancement is rolled out. C.    Risk Assessment Now, think about this same approach from the risk assessment perspective. Listen to your employee's concerns and listen to the compliance issues raised. From there you can begin to ask questions about what was done and why. This approach is not adversarial or an interrogation. Still, it is ferreting out the employee's concerns while having the employees educate your compliance team on the actual procedures that are used. By listening, and gently questioning, you should be able to garner enough information to create a risk assessment profile that can inform and even become the basis of compliance program enhancements.  Three key takeaways: 1. A listening tour can be used to improve your culture. 2. Listening improves engagement, which improves culture. 3. Culture lessens if employees think you don’t care. Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 10 Nov 2023 05:00:00 -0000 Day 8 - A Listening Tour to Improve Culture full Thomas Fox Today how a listening tour can improve culture. Any top CEO must first listen. But it is more than simply listening to rebuild trust, it is rebuilding employee engagement by making them and their ideas part of the solution. Today, we consider how a compliance listening tour can improve culture. A.    Engagement Start off by meeting as many compliance stakeholders as possible. You can use town hall settings or go smaller, meeting with key employee leaders, key stakeholders, and employees identified as high-risk who you can meet with individually or in smaller groups. Listen to their compliance concerns and take their compliance ideas back to the home office. After returning to your office, winnow down their ideas and suggestions to form the basis of enhancements to your culture. This employee engagement will lead to greater stakeholder buy-in for your culture. B.    Education But during the town hall meetings, and the smaller more informal group meetings, you can do more than listen, you can also train. This training is on ethics and how the employees could use compliance as a business tool. Moreover, this lays the groundwork for enhancing your culture and the training that will occur as the enhancement is rolled out. C.    Risk Assessment Now, think about this same approach from the risk assessment perspective. Listen to your employee's concerns and listen to the compliance issues raised. From there you can begin to ask questions about what was done and why. This approach is not adversarial or an interrogation. Still, it is ferreting out the employee's concerns while having the employees educate your compliance team on the actual procedures that are used. By listening, and gently questioning, you should be able to garner enough information to create a risk assessment profile that can inform and even become the basis of compliance program enhancements.  Three key takeaways: 1. A listening tour can be used to improve your culture. 2. Listening improves engagement, which improves culture. 3. Culture lessens if employees think you don’t care. Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Any top CEO must first listen. But it is more than simply listening to rebuild trust, it is rebuilding employee engagement by making them and their ideas part of the solution. Today, we consider how a compliance listening tour can improve culture.

A.    Engagement

Start off by meeting as many compliance stakeholders as possible. You can use town hall settings or go smaller, meeting with key employee leaders, key stakeholders, and employees identified as high-risk who you can meet with individually or in smaller groups. Listen to their compliance concerns and take their compliance ideas back to the home office. After returning to your office, winnow down their ideas and suggestions to form the basis of enhancements to your culture. This employee engagement will lead to greater stakeholder buy-in for your culture.

B.    Education

But during the town hall meetings, and the smaller more informal group meetings, you can do more than listen, you can also train. This training is on ethics and how the employees could use compliance as a business tool. Moreover, this lays the groundwork for enhancing your culture and the training that will occur as the enhancement is rolled out.

C.    Risk Assessment

Now, think about this same approach from the risk assessment perspective. Listen to your employee's concerns and listen to the compliance issues raised. From there you can begin to ask questions about what was done and why. This approach is not adversarial or an interrogation. Still, it is ferreting out the employee's concerns while having the employees educate your compliance team on the actual procedures that are used. By listening, and gently questioning, you should be able to garner enough information to create a risk assessment profile that can inform and even become the basis of compliance program enhancements.


 Three key takeaways:

1. A listening tour can be used to improve your culture.

2. Listening improves engagement, which improves culture.

3. Culture lessens if employees think you don’t care.

Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 553 One Month to a More Effective Compliance Program Through Culture: Day 7 - To Improve Culture, Engage More One thing I have learned in working with Carsten Tams is that one of the very top keys to a successful compliance program is employee engagement. Tams and I explored this topic in the popular podcast series Design Thinking in Compliance. It also appears that attention can lead to excellent business resiliency based upon an article entitled The Top 10 Findings on Resilience and Engagement, by Marcus Buckingham. Not surprisingly, trust is the number 1 factor in engagement and resilience. Astoundingly, the author found that “employees who said they completely trust their team leader were 14 times more likely to be fully engaged.” Moreover, those employees who completely trusted their colleagues, team leader, and senior leaders “were 42 times more likely to be highly resilient.” The reason should seem obvious as it is undoubtedly “easier to engage in our best work when we don’t have to expend mental resources looking over our shoulders or protecting ourselves against dysfunctional workplace practices that erode trust, like bullying or micromanaging. When it comes to building engagement and resilience, trust is everything.” Teamwork is also a key factor. Although this is not something I have experienced over the past 12 years of working alone, the author found, “Those who said they are on a team were 2.6 times more likely to be fully engaged and 2.7 times more likely to be highly resilient than those who didn’t identify as team members. For millennia, humans have experienced psychological well-being only when they feel connected to and supported by a small group of people around them.” When the pandemic hit, working from home was not new to me as I had been doing it since 2010, but even in the WFH or Hybrid Work era, most employees need to feel like they are part of a team. Every CCO and compliance professional must work to lessen or dissolve the disconnect between senior leadership and front-line workers. Your front-line business folks will make or break your compliance program. Getting your senior management more engaged will create and establish the trust your employees will need to show resilience in the face of the following primary business location, whether a pandemic or military invasion.  Three key takeaways: 1. The concepts from Design Thinking can improve your culture. 2. A key factor in culture is engagement. 3. You can improve culture by dissolving the disconnect between senior leadership and front-line workers.  Check the free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 20, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 09 Nov 2023 05:00:00 -0000 Day 7 - To Improve Culture, Engage More full 7 Thomas Fox To improve culture, engage more. One thing I have learned in working with Carsten Tams is that one of the very top keys to a successful compliance program is employee engagement. Tams and I explored this topic in the popular podcast series Design Thinking in Compliance. It also appears that attention can lead to excellent business resiliency based upon an article entitled The Top 10 Findings on Resilience and Engagement, by Marcus Buckingham. Not surprisingly, trust is the number 1 factor in engagement and resilience. Astoundingly, the author found that “employees who said they completely trust their team leader were 14 times more likely to be fully engaged.” Moreover, those employees who completely trusted their colleagues, team leader, and senior leaders “were 42 times more likely to be highly resilient.” The reason should seem obvious as it is undoubtedly “easier to engage in our best work when we don’t have to expend mental resources looking over our shoulders or protecting ourselves against dysfunctional workplace practices that erode trust, like bullying or micromanaging. When it comes to building engagement and resilience, trust is everything.” Teamwork is also a key factor. Although this is not something I have experienced over the past 12 years of working alone, the author found, “Those who said they are on a team were 2.6 times more likely to be fully engaged and 2.7 times more likely to be highly resilient than those who didn’t identify as team members. For millennia, humans have experienced psychological well-being only when they feel connected to and supported by a small group of people around them.” When the pandemic hit, working from home was not new to me as I had been doing it since 2010, but even in the WFH or Hybrid Work era, most employees need to feel like they are part of a team. Every CCO and compliance professional must work to lessen or dissolve the disconnect between senior leadership and front-line workers. Your front-line business folks will make or break your compliance program. Getting your senior management more engaged will create and establish the trust your employees will need to show resilience in the face of the following primary business location, whether a pandemic or military invasion.  Three key takeaways: 1. The concepts from Design Thinking can improve your culture. 2. A key factor in culture is engagement. 3. You can improve culture by dissolving the disconnect between senior leadership and front-line workers.  Check the free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 20, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices One thing I have learned in working with Carsten Tams is that one of the very top keys to a successful compliance program is employee engagement. Tams and I explored this topic in the popular podcast series Design Thinking in Compliance. It also appears that attention can lead to excellent business resiliency based upon an article entitled The Top 10 Findings on Resilience and Engagement, by Marcus Buckingham.

Not surprisingly, trust is the number 1 factor in engagement and resilience. Astoundingly, the author found that “employees who said they completely trust their team leader were 14 times more likely to be fully engaged.” Moreover, those employees who completely trusted their colleagues, team leader, and senior leaders “were 42 times more likely to be highly resilient.” The reason should seem obvious as it is undoubtedly “easier to engage in our best work when we don’t have to expend mental resources looking over our shoulders or protecting ourselves against dysfunctional workplace practices that erode trust, like bullying or micromanaging. When it comes to building engagement and resilience, trust is everything.”

Teamwork is also a key factor. Although this is not something I have experienced over the past 12 years of working alone, the author found, “Those who said they are on a team were 2.6 times more likely to be fully engaged and 2.7 times more likely to be highly resilient than those who didn’t identify as team members. For millennia, humans have experienced psychological well-being only when they feel connected to and supported by a small group of people around them.” When the pandemic hit, working from home was not new to me as I had been doing it since 2010, but even in the WFH or Hybrid Work era, most employees need to feel like they are part of a team.

Every CCO and compliance professional must work to lessen or dissolve the disconnect between senior leadership and front-line workers. Your front-line business folks will make or break your compliance program. Getting your senior management more engaged will create and establish the trust your employees will need to show resilience in the face of the following primary business location, whether a pandemic or military invasion.

 Three key takeaways:

1. The concepts from Design Thinking can improve your culture.

2. A key factor in culture is engagement.

3. You can improve culture by dissolving the disconnect between senior leadership and front-line workers. 

Check the free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 20, 12 CT. For more information and registration, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 621 One Month to a More Effective Compliance Program Through Culture: Day 6 - Attributes of a Toxic Culture Corporate culture is finally being acknowledged as a key ingredient in a successful business, particularly one that operates ethically and in compliance. But what are some indicia of good culture and more importantly what are some indicia of a toxic culture? A recent article in the MIT Sloan Management Review provided some guidance. In Why Every Leader Needs to Worry About Toxic Culture, the authors posited that by pinpointing the elements of toxic culture in a company, its leaders focus on addressing the issues that lead employees to disengage and quit. These ideas have significant importance for the compliance function as it navigates corporate culture, both in assessing and improving it.  Moreover, the Chief Compliance Officer and corporate compliance function were identified in the 2023 3 Evaluation of Corporate Compliance Programs as the keepers of institutional justice and institutional fairness. This means recognizing and then preventing a toxic culture from spreading and infecting your entire organization squarely in the compliance wheelhouse. The article lays out key red flags for every CCO and compliance professional to look for in assessing culture. Finally, for any company with a toxic culture, the chances are much greater to be defrauded by its own employees or to defraud others through bribery and corruption by violating such laws as the Foreign Corrupt Practices Act (FCPA).  The authors identify behaviors that they call “the Toxic Five attributes”, being “disrespectful, noninclusive, unethical, cutthroat, and abusive - poison corporate culture in the eyes of employees. While organizational culture can disappoint employees in many ways, these five elements have by far the largest negative impact on how employees rate their corporate culture and have contributed most to employee attrition throughout the Great Resignation.” As a CCO or compliance professional you need to be on the watch for them and take steps to remedy them if you see or hear about them.   Three key takeaways: 1. Are the attributes of a toxic culture present in your organization? 2. The 2020 Update to the Evaluation of Corporate Compliance Programs mandated the compliance lead this effort. 3. Does your organization have abusive behavior?  Check the free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 20, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 08 Nov 2023 05:00:00 -0000 Day 6 - Attributes of a Toxic Culture bonus 6 Thomas Fox Today we consider the attributes of a toxic culture. Corporate culture is finally being acknowledged as a key ingredient in a successful business, particularly one that operates ethically and in compliance. But what are some indicia of good culture and more importantly what are some indicia of a toxic culture? A recent article in the MIT Sloan Management Review provided some guidance. In Why Every Leader Needs to Worry About Toxic Culture, the authors posited that by pinpointing the elements of toxic culture in a company, its leaders focus on addressing the issues that lead employees to disengage and quit. These ideas have significant importance for the compliance function as it navigates corporate culture, both in assessing and improving it.  Moreover, the Chief Compliance Officer and corporate compliance function were identified in the 2023 3 Evaluation of Corporate Compliance Programs as the keepers of institutional justice and institutional fairness. This means recognizing and then preventing a toxic culture from spreading and infecting your entire organization squarely in the compliance wheelhouse. The article lays out key red flags for every CCO and compliance professional to look for in assessing culture. Finally, for any company with a toxic culture, the chances are much greater to be defrauded by its own employees or to defraud others through bribery and corruption by violating such laws as the Foreign Corrupt Practices Act (FCPA).  The authors identify behaviors that they call “the Toxic Five attributes”, being “disrespectful, noninclusive, unethical, cutthroat, and abusive - poison corporate culture in the eyes of employees. While organizational culture can disappoint employees in many ways, these five elements have by far the largest negative impact on how employees rate their corporate culture and have contributed most to employee attrition throughout the Great Resignation.” As a CCO or compliance professional you need to be on the watch for them and take steps to remedy them if you see or hear about them.   Three key takeaways: 1. Are the attributes of a toxic culture present in your organization? 2. The 2020 Update to the Evaluation of Corporate Compliance Programs mandated the compliance lead this effort. 3. Does your organization have abusive behavior?  Check the free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 20, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Corporate culture is finally being acknowledged as a key ingredient in a successful business, particularly one that operates ethically and in compliance. But what are some indicia of good culture and more importantly what are some indicia of a toxic culture? A recent article in the MIT Sloan Management Review provided some guidance. In Why Every Leader Needs to Worry About Toxic Culture, the authors posited that by pinpointing the elements of toxic culture in a company, its leaders focus on addressing the issues that lead employees to disengage and quit. These ideas have significant importance for the compliance function as it navigates corporate culture, both in assessing and improving it. 

Moreover, the Chief Compliance Officer and corporate compliance function were identified in the 2023 3 Evaluation of Corporate Compliance Programs as the keepers of institutional justice and institutional fairness. This means recognizing and then preventing a toxic culture from spreading and infecting your entire organization squarely in the compliance wheelhouse. The article lays out key red flags for every CCO and compliance professional to look for in assessing culture. Finally, for any company with a toxic culture, the chances are much greater to be defrauded by its own employees or to defraud others through bribery and corruption by violating such laws as the Foreign Corrupt Practices Act (FCPA). 

The authors identify behaviors that they call “the Toxic Five attributes”, being “disrespectful, noninclusive, unethical, cutthroat, and abusive - poison corporate culture in the eyes of employees. While organizational culture can disappoint employees in many ways, these five elements have by far the largest negative impact on how employees rate their corporate culture and have contributed most to employee attrition throughout the Great Resignation.” As a CCO or compliance professional you need to be on the watch for them and take steps to remedy them if you see or hear about them. 

 Three key takeaways:

1. Are the attributes of a toxic culture present in your organization?

2. The 2020 Update to the Evaluation of Corporate Compliance Programs mandated the compliance lead this effort.

3. Does your organization have abusive behavior? 

Check the free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 20, 12 CT. For more information and registration, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 629 no One Month to a More Effective Compliance Program Through Culture: Day 5 - Redesigning Culture How can you think through a different way to redesign your culture and compliance program based on an article in MIT Sloan Management, entitled The Four-Step Process for Redesigning Work by Lynda Gratton? Gratton believes that a “fear of failure weighs heavily on many leaders tasked with managing new workplace expectations. Seeing the challenge as a process is the way forward.” Her piece provides a great way to think about the decision on hybrid or other models of working going forward. Understand What Matters Reimagine new ways of operating Model and test new ways of working Act and create Gratton ended her piece by challenging leaders to ask themselves three questions: “Where are you now on the journey of redesigning work? Are there steps you need to reengage in a more purposeful manner? Are you clear about what your biggest priorities are? The actions you take now will create your signature model of work and define the deal that you are making with your employees and your customers.” The same is even more so for a Chief Compliance Officer, the corporate compliance function and culture.   Three key takeaways: 1. How to think through redesigning your culture. 2. Understand what matters to your employees. 3. Listen, listen, listen.  Check the free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Monday, November 20, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 07 Nov 2023 05:00:00 -0000 Day 5 - Redesigning Culture bonus 5 Thomas Fox Today we consider how to redesign your corporate culture. How can you think through a different way to redesign your culture and compliance program based on an article in MIT Sloan Management, entitled The Four-Step Process for Redesigning Work by Lynda Gratton? Gratton believes that a “fear of failure weighs heavily on many leaders tasked with managing new workplace expectations. Seeing the challenge as a process is the way forward.” Her piece provides a great way to think about the decision on hybrid or other models of working going forward. Understand What Matters Reimagine new ways of operating Model and test new ways of working Act and create Gratton ended her piece by challenging leaders to ask themselves three questions: “Where are you now on the journey of redesigning work? Are there steps you need to reengage in a more purposeful manner? Are you clear about what your biggest priorities are? The actions you take now will create your signature model of work and define the deal that you are making with your employees and your customers.” The same is even more so for a Chief Compliance Officer, the corporate compliance function and culture.   Three key takeaways: 1. How to think through redesigning your culture. 2. Understand what matters to your employees. 3. Listen, listen, listen.  Check the free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Monday, November 20, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices How can you think through a different way to redesign your culture and compliance program based on an article in MIT Sloan Management, entitled The Four-Step Process for Redesigning Work by Lynda Gratton? Gratton believes that a “fear of failure weighs heavily on many leaders tasked with managing new workplace expectations. Seeing the challenge as a process is the way forward.” Her piece provides a great way to think about the decision on hybrid or other models of working going forward.

Understand What Matters

Reimagine new ways of operating

Model and test new ways of working

Act and create

Gratton ended her piece by challenging leaders to ask themselves three questions: “Where are you now on the journey of redesigning work? Are there steps you need to reengage in a more purposeful manner? Are you clear about what your biggest priorities are? The actions you take now will create your signature model of work and define the deal that you are making with your employees and your customers.” The same is even more so for a Chief Compliance Officer, the corporate compliance function and culture. 

 Three key takeaways:

1. How to think through redesigning your culture.

2. Understand what matters to your employees.

3. Listen, listen, listen. 

Check the free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Monday, November 20, 12 CT. For more information and registration, click here.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 656 no One Month to a More Effective Compliance Program Through Culture: Day 4 - Assessing and Aligning your Corporate Values One of concepts enshrined in the Monaco Memo is that the Department of Justice (DOJ) will assess corporate culture for any company that may find itself under investigation for Foreign Corrupt Practices Act (FCPA) violations. This enshrinement is not exactly new as Deputy Attorney General (DAG) Lisa Monaco announced this new DOJ focus in October 2021 in her speech. The parameters of how the DOJ will assess culture are still being worked out but Chief Compliance Officers (CCOs) and compliance professionals need to be considering this issue in the context of their own compliance programs and corporate culture in case the DOJ ever comes knocking. We begin with assessing your corporate values and then aligning them within your organization. In a recent Harvard Business Review (HBR) article, entitled What Does Your Company Really Stand For?, authors Paul Ingram and Yoonjin Choi explored these and other issues. The authors believe that corporate values are more critical than ever. I have adapted their work for the compliance professional.  The authors developed a five-step approach for values alignment.  1.     Identify the values within your employee base and create a values structure. 2.     Identify key priorities from strategy to determine what is the most important thing the organization can do to achieve its strategy. 3.     Wed values that serve both the organization and its employees.  4.     Begin the assessment process.  5.     Generate a final list of organizational values.  From the compliance perspective, the protocol. Recognizing that values are but one part of an overall corporate culture, gives you a mechanism to think through how to begin an overall assessment of your organization. Values do make up a portion of an overall culture. Through the engagement advocated herein, you can not only get a good reading on such key values as trust and respect but, more importantly, learn how to incorporate them as overall assets into your corporate culture.   Three key takeaways: 1. The Monaco Memo enshrined the concept that the DOJ will assess culture. 2. What does your company stand for? 3. When properly aligned, values can be a powerful part of corporate culture. Check the free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 20, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 06 Nov 2023 05:00:00 -0000 Assessing and Aligning your Corporate Values bonus 4 Thomas Fox Today we consider assessing and then aligning your corporate values. One of concepts enshrined in the Monaco Memo is that the Department of Justice (DOJ) will assess corporate culture for any company that may find itself under investigation for Foreign Corrupt Practices Act (FCPA) violations. This enshrinement is not exactly new as Deputy Attorney General (DAG) Lisa Monaco announced this new DOJ focus in October 2021 in her speech. The parameters of how the DOJ will assess culture are still being worked out but Chief Compliance Officers (CCOs) and compliance professionals need to be considering this issue in the context of their own compliance programs and corporate culture in case the DOJ ever comes knocking. We begin with assessing your corporate values and then aligning them within your organization. In a recent Harvard Business Review (HBR) article, entitled What Does Your Company Really Stand For?, authors Paul Ingram and Yoonjin Choi explored these and other issues. The authors believe that corporate values are more critical than ever. I have adapted their work for the compliance professional.  The authors developed a five-step approach for values alignment.  1.     Identify the values within your employee base and create a values structure. 2.     Identify key priorities from strategy to determine what is the most important thing the organization can do to achieve its strategy. 3.     Wed values that serve both the organization and its employees.  4.     Begin the assessment process.  5.     Generate a final list of organizational values.  From the compliance perspective, the protocol. Recognizing that values are but one part of an overall corporate culture, gives you a mechanism to think through how to begin an overall assessment of your organization. Values do make up a portion of an overall culture. Through the engagement advocated herein, you can not only get a good reading on such key values as trust and respect but, more importantly, learn how to incorporate them as overall assets into your corporate culture.   Three key takeaways: 1. The Monaco Memo enshrined the concept that the DOJ will assess culture. 2. What does your company stand for? 3. When properly aligned, values can be a powerful part of corporate culture. Check the free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 20, 12 CT. For more information and registration, click here. Learn more about your ad choices. Visit megaphone.fm/adchoices One of concepts enshrined in the Monaco Memo is that the Department of Justice (DOJ) will assess corporate culture for any company that may find itself under investigation for Foreign Corrupt Practices Act (FCPA) violations. This enshrinement is not exactly new as Deputy Attorney General (DAG) Lisa Monaco announced this new DOJ focus in October 2021 in her speech. The parameters of how the DOJ will assess culture are still being worked out but Chief Compliance Officers (CCOs) and compliance professionals need to be considering this issue in the context of their own compliance programs and corporate culture in case the DOJ ever comes knocking.

We begin with assessing your corporate values and then aligning them within your organization. In a recent Harvard Business Review (HBR) article, entitled What Does Your Company Really Stand For?, authors Paul Ingram and Yoonjin Choi explored these and other issues. The authors believe that corporate values are more critical than ever. I have adapted their work for the compliance professional. 

The authors developed a five-step approach for values alignment. 

1.     Identify the values within your employee base and create a values structure.

2.     Identify key priorities from strategy to determine what is the most important thing the organization can do to achieve its strategy.

3.     Wed values that serve both the organization and its employees. 

4.     Begin the assessment process. 

5.     Generate a final list of organizational values. 

From the compliance perspective, the protocol. Recognizing that values are but one part of an overall corporate culture, gives you a mechanism to think through how to begin an overall assessment of your organization. Values do make up a portion of an overall culture. Through the engagement advocated herein, you can not only get a good reading on such key values as trust and respect but, more importantly, learn how to incorporate them as overall assets into your corporate culture. 

 Three key takeaways:

1. The Monaco Memo enshrined the concept that the DOJ will assess culture.

2. What does your company stand for?

3. When properly aligned, values can be a powerful part of corporate culture.

Check the free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 20, 12 CT. For more information and registration, click here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 656 no One Month to a More Effective Compliance Program Through Culture: Day 3 - Compliance and Corporate Principles in Today’s World For corporations, navigating the political landscape has become an increasingly difficult task. While being admonished to ‘stay in their lane’ by some, businesses are just like their stakeholders, impacted by the ever-changing political miasma. When this new reality is coupled with the new levels of transparency in companies, which are only amplified by social media, a company can be embroiled in public controversies with one or more stakeholder groups. As these situations occur, CCOs and compliance professionals will be called upon to help companies navigate this fraught process. How can compliance help a company navigate through all of this? To make and implement the best strategic choices in this environment, leaders will have to develop principles to guide strategic choices, address ethical issues early on, consistently communicate and implement their choices, engage beyond the industry to shape the context and learn from mistakes to make better choices in the future. This is a process that the corporate compliance function can facilitate. If you work through these steps, you should be able to prepare your organization for the next major shock. Three key takeaways: 1. Why a company can no longer simply ‘stay in its lane’. 2. Compliance should lead the way to develop robust principles to guide cultural choices. 3. Even in culture, continuous improvement is a mandate.  Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 03 Nov 2023 04:00:00 -0000 Day 3 - Compliance and Corporate Principles in Today’s World full Thomas Fox For corporations, navigating the political landscape has become an increasingly difficult task. While being admonished to ‘stay in their lane’ by some, businesses are just like their stakeholders, impacted by the ever-changing political miasma. When this new reality is coupled with the new levels of transparency in companies, which are only amplified by social media, a company can be embroiled in public controversies with one or more stakeholder groups. As these situations occur, CCOs and compliance professionals will be called upon to help companies navigate this fraught process. How can compliance help a company navigate through all of this? To make and implement the best strategic choices in this environment, leaders will have to develop principles to guide strategic choices, address ethical issues early on, consistently communicate and implement their choices, engage beyond the industry to shape the context and learn from mistakes to make better choices in the future. This is a process that the corporate compliance function can facilitate. If you work through these steps, you should be able to prepare your organization for the next major shock. Three key takeaways: 1. Why a company can no longer simply ‘stay in its lane’. 2. Compliance should lead the way to develop robust principles to guide cultural choices. 3. Even in culture, continuous improvement is a mandate.  Learn more about your ad choices. Visit megaphone.fm/adchoices For corporations, navigating the political landscape has become an increasingly difficult task. While being admonished to ‘stay in their lane’ by some, businesses are just like their stakeholders, impacted by the ever-changing political miasma. When this new reality is coupled with the new levels of transparency in companies, which are only amplified by social media, a company can be embroiled in public controversies with one or more stakeholder groups. As these situations occur, CCOs and compliance professionals will be called upon to help companies navigate this fraught process.

How can compliance help a company navigate through all of this? To make and implement the best strategic choices in this environment, leaders will have to

  1. develop principles to guide strategic choices,
  2. address ethical issues early on,
  3. consistently communicate and implement their choices,
  4. engage beyond the industry to shape the context and
  5. learn from mistakes to make better choices in the future.


This is a process that the corporate compliance function can facilitate. If you work through these steps, you should be able to prepare your organization for the next major shock.

Three key takeaways:

1. Why a company can no longer simply ‘stay in its lane’.

2. Compliance should lead the way to develop robust principles to guide cultural choices.

3. Even in culture, continuous improvement is a mandate. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 681 no One Month to a More Effective Compliance Program Through Culture: Day 2 – Getting Culture Right Vin DiCianni, founder of Affiliated Monitors, Inc. (AMI), talked about the Monaco speech and culture. He said, “The announcement by Deputy Attorney General Lisa Monaco and the Justice Department reignited the agency’s concentration of corporate liability for white-collar crimes. In doing so, she emphasized to businesses, their leadership, and the lawyers representing them how important it is to implement and maintain strong, effective compliance programs and how DOJ will con. In other words, the criticality of culture is now paramount. CCOs must focus on growing corporate culture to build the ethical foundation for a successful compliance program. In the most recent MIT Sloan Management Review issue, Donald Sull and Charles Sull penned an article entitled “10 Things Your Corporate Culture Needs to Get Right”, in which they posited that “knowing what elements of culture matter most to employees can help leaders foster engagement as they transition to a new reality that will include more remote and hybrid work.” It is an excellent review of some of the key elements of corporate culture and how CCOs can move forward to lay the foundation of one. CCOs and compliance functions face challenges while navigating the post-COVID-19 return to work. Through corporate culture, companies must maintain a healthy culture, as mandated by the DOJ. The authors conclude, “Understanding the elements of culture that matter most to employees can help leaders maintain employee engagement and a vibrant culture as they transition to the new normal.” Three key takeaways: 1. What distinguishes a good corporate culture from a bad one in the eyes of employees? 2. A good corporate culture forms the basis of a good compliance program. 3. How many elements of a good corporate culture are in your organization? Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 02 Nov 2023 04:00:00 -0000 Getting Culture Right full 3 Thomas Fox Today, we explore how you can get the culture right. Vin DiCianni, founder of Affiliated Monitors, Inc. (AMI), talked about the Monaco speech and culture. He said, “The announcement by Deputy Attorney General Lisa Monaco and the Justice Department reignited the agency’s concentration of corporate liability for white-collar crimes. In doing so, she emphasized to businesses, their leadership, and the lawyers representing them how important it is to implement and maintain strong, effective compliance programs and how DOJ will con. In other words, the criticality of culture is now paramount. CCOs must focus on growing corporate culture to build the ethical foundation for a successful compliance program. In the most recent MIT Sloan Management Review issue, Donald Sull and Charles Sull penned an article entitled “10 Things Your Corporate Culture Needs to Get Right”, in which they posited that “knowing what elements of culture matter most to employees can help leaders foster engagement as they transition to a new reality that will include more remote and hybrid work.” It is an excellent review of some of the key elements of corporate culture and how CCOs can move forward to lay the foundation of one. CCOs and compliance functions face challenges while navigating the post-COVID-19 return to work. Through corporate culture, companies must maintain a healthy culture, as mandated by the DOJ. The authors conclude, “Understanding the elements of culture that matter most to employees can help leaders maintain employee engagement and a vibrant culture as they transition to the new normal.” Three key takeaways: 1. What distinguishes a good corporate culture from a bad one in the eyes of employees? 2. A good corporate culture forms the basis of a good compliance program. 3. How many elements of a good corporate culture are in your organization? Learn more about your ad choices. Visit megaphone.fm/adchoices Vin DiCianni, founder of Affiliated Monitors, Inc. (AMI), talked about the Monaco speech and culture. He said, “The announcement by Deputy Attorney General Lisa Monaco and the Justice Department reignited the agency’s concentration of corporate liability for white-collar crimes. In doing so, she emphasized to businesses, their leadership, and the lawyers representing them how important it is to implement and maintain strong, effective compliance programs and how DOJ will con. In other words, the criticality of culture is now paramount. CCOs must focus on growing corporate culture to build the ethical foundation for a successful compliance program.

In the most recent MIT Sloan Management Review issue, Donald Sull and Charles Sull penned an article entitled “10 Things Your Corporate Culture Needs to Get Right”, in which they posited that “knowing what elements of culture matter most to employees can help leaders foster engagement as they transition to a new reality that will include more remote and hybrid work.” It is an excellent review of some of the key elements of corporate culture and how CCOs can move forward to lay the foundation of one.

CCOs and compliance functions face challenges while navigating the post-COVID-19 return to work. Through corporate culture, companies must maintain a healthy culture, as mandated by the DOJ. The authors conclude, “Understanding the elements of culture that matter most to employees can help leaders maintain employee engagement and a vibrant culture as they transition to the new normal.”

Three key takeaways:

1. What distinguishes a good corporate culture from a bad one in the eyes of employees?

2. A good corporate culture forms the basis of a good compliance program.

3. How many elements of a good corporate culture are in your organization?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 623 no One Month to a More Effective Compliance Program Through Culture: Day 1 - Introduction In her October 2021 speech, presaging the Monaco Memo, Deputy Attorney General Lisa Monaco talked at length about the importance of corporate culture. She noted, “Corporate culture matters. A corporate culture that fails to hold individuals accountable or fails to invest in compliance — or worse that thumbs its nose at compliance — leads to bad results. Let me also be clear: a company can fulfill its fiduciary duty to shareholders and maintain a commitment to compliance and lawfulness. Companies serve their shareholders when they proactively place compliance functions and spend resources anticipating problems. They do so both by avoiding regulatory actions in the first place and receiving credit from the government. Conversely, we will ensure the absence of such programs inevitably proves a costly omission for companies who end up the focus of department investigations.” These thoughts were formalized in the Monaco Memo. What does all this mean for compliance professionals going forward? DOJ officials have emphasized that the changes laid out in the Monaco Memo and the requirements around CCO Certification are to empower compliance professionals. In the Monaco Speech, DAG Monaco stated, “Companies should feel empowered to do the right thing—to invest in compliance and culture and to step up and own up when misconduct occurs. Companies that do so will welcome the announcements today. For those who don’t, however, our Department prosecutors will be empowered, too—to hold accountable those who don’t follow the law.” However you may characterize it, I will channel my inner Glenn Fry (with a nod to Miami Vice) and simply say to CCOs and compliance professionals, “The Heat is On.” Three Key Takeaway: The DOJ will now evaluate corporate culture in an enforcement action. You must assess, manage, monitor, and improve your culture. Corporate culture is now a key metric for regulators. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 01 Nov 2023 12:05:00 -0000 Day 1 - Introduction full Thomas Fox Today we begin a look at corporate culture and compliance. In her October 2021 speech, presaging the Monaco Memo, Deputy Attorney General Lisa Monaco talked at length about the importance of corporate culture. She noted, “Corporate culture matters. A corporate culture that fails to hold individuals accountable or fails to invest in compliance — or worse that thumbs its nose at compliance — leads to bad results. Let me also be clear: a company can fulfill its fiduciary duty to shareholders and maintain a commitment to compliance and lawfulness. Companies serve their shareholders when they proactively place compliance functions and spend resources anticipating problems. They do so both by avoiding regulatory actions in the first place and receiving credit from the government. Conversely, we will ensure the absence of such programs inevitably proves a costly omission for companies who end up the focus of department investigations.” These thoughts were formalized in the Monaco Memo. What does all this mean for compliance professionals going forward? DOJ officials have emphasized that the changes laid out in the Monaco Memo and the requirements around CCO Certification are to empower compliance professionals. In the Monaco Speech, DAG Monaco stated, “Companies should feel empowered to do the right thing—to invest in compliance and culture and to step up and own up when misconduct occurs. Companies that do so will welcome the announcements today. For those who don’t, however, our Department prosecutors will be empowered, too—to hold accountable those who don’t follow the law.” However you may characterize it, I will channel my inner Glenn Fry (with a nod to Miami Vice) and simply say to CCOs and compliance professionals, “The Heat is On.” Three Key Takeaway: The DOJ will now evaluate corporate culture in an enforcement action. You must assess, manage, monitor, and improve your culture. Corporate culture is now a key metric for regulators. Learn more about your ad choices. Visit megaphone.fm/adchoices In her October 2021 speech, presaging the Monaco Memo, Deputy Attorney General Lisa Monaco talked at length about the importance of corporate culture. She noted, “Corporate culture matters. A corporate culture that fails to hold individuals accountable or fails to invest in compliance — or worse that thumbs its nose at compliance — leads to bad results. Let me also be clear: a company can fulfill its fiduciary duty to shareholders and maintain a commitment to compliance and lawfulness. Companies serve their shareholders when they proactively place compliance functions and spend resources anticipating problems. They do so both by avoiding regulatory actions in the first place and receiving credit from the government. Conversely, we will ensure the absence of such programs inevitably proves a costly omission for companies who end up the focus of department investigations.” These thoughts were formalized in the Monaco Memo.

What does all this mean for compliance professionals going forward? DOJ officials have emphasized that the changes laid out in the Monaco Memo and the requirements around CCO Certification are to empower compliance professionals. In the Monaco Speech, DAG Monaco stated, “Companies should feel empowered to do the right thing—to invest in compliance and culture and to step up and own up when misconduct occurs. Companies that do so will welcome the announcements today. For those who don’t, however, our Department prosecutors will be empowered, too—to hold accountable those who don’t follow the law.” However you may characterize it, I will channel my inner Glenn Fry (with a nod to Miami Vice) and simply say to CCOs and compliance professionals, “The Heat is On.”

Three Key Takeaway:

  1. The DOJ will now evaluate corporate culture in an enforcement action.
  2. You must assess, manage, monitor, and improve your culture.
  3. Corporate culture is now a key metric for regulators.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 436 no One Month to a More Effective Compliance Program Through Innovation: Day 15 – Leveraging AI in Compliance Investigations The 2023 ECCP provided clear-cut criteria regarding effective compliance investigations. Unfortunately, many compliance teams fail to promptly substantiate most of the reports they investigate, partly due to their inability to quickly and easily find the evidence they need, especially about harassment and misconduct cases. He stated, “This doesn’t just demonstrate a fundamental lack of effectiveness from the DOJ’s perspective, but a long-term organizational risk that goes well beyond any individual allegation of misconduct.” The reason is not simply legal but also operational. If substantive allegations are indeed violations, they could continue, exacerbating the problem(s) and lengthening the time of legal liability. All of this is particularly significant in light of the industry research that shows many compliance investigations today are unsubstantiated and can take over 40 days from start to finish. The ability of AI to find and analyze data from the web and social media in this automated fashion will be able to overcome some of those challenges in terms of length of time and overall scope of the investigation. Finally, always remember data preservation. The regulators always want to know if you have the documents and data tied down. This allows a company to have confidence in its papers and, in turn, can make such representations to regulators and prosecutors that the documents are secure. In other words, Document, Document, and Document.  Three key takeaways: AI is an appropriate tool for supplementing investigations. AI can look at large bodies of social media data. AI can help you decrease your investigation length. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 20 Oct 2023 04:00:00 -0000 Leveraging AI in Compliance Investigations full 15 Thomas Fox Today, how to leverage AI in a compliance investigation. The 2023 ECCP provided clear-cut criteria regarding effective compliance investigations. Unfortunately, many compliance teams fail to promptly substantiate most of the reports they investigate, partly due to their inability to quickly and easily find the evidence they need, especially about harassment and misconduct cases. He stated, “This doesn’t just demonstrate a fundamental lack of effectiveness from the DOJ’s perspective, but a long-term organizational risk that goes well beyond any individual allegation of misconduct.” The reason is not simply legal but also operational. If substantive allegations are indeed violations, they could continue, exacerbating the problem(s) and lengthening the time of legal liability. All of this is particularly significant in light of the industry research that shows many compliance investigations today are unsubstantiated and can take over 40 days from start to finish. The ability of AI to find and analyze data from the web and social media in this automated fashion will be able to overcome some of those challenges in terms of length of time and overall scope of the investigation. Finally, always remember data preservation. The regulators always want to know if you have the documents and data tied down. This allows a company to have confidence in its papers and, in turn, can make such representations to regulators and prosecutors that the documents are secure. In other words, Document, Document, and Document.  Three key takeaways: AI is an appropriate tool for supplementing investigations. AI can look at large bodies of social media data. AI can help you decrease your investigation length. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2023 ECCP provided clear-cut criteria regarding effective compliance investigations. Unfortunately, many compliance teams fail to promptly substantiate most of the reports they investigate, partly due to their inability to quickly and easily find the evidence they need, especially about harassment and misconduct cases. He stated, “This doesn’t just demonstrate a fundamental lack of effectiveness from the DOJ’s perspective, but a long-term organizational risk that goes well beyond any individual allegation of misconduct.” The reason is not simply legal but also operational. If substantive allegations are indeed violations, they could continue, exacerbating the problem(s) and lengthening the time of legal liability.

All of this is particularly significant in light of the industry research that shows many compliance investigations today are unsubstantiated and can take over 40 days from start to finish. The ability of AI to find and analyze data from the web and social media in this automated fashion will be able to overcome some of those challenges in terms of length of time and overall scope of the investigation. Finally, always remember data preservation. The regulators always want to know if you have the documents and data tied down. This allows a company to have confidence in its papers and, in turn, can make such representations to regulators and prosecutors that the documents are secure. In other words, Document, Document, and Document. 

Three key takeaways:

  1. AI is an appropriate tool for supplementing investigations.
  2. AI can look at large bodies of social media data.
  3. AI can help you decrease your investigation length.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 437 no One Month to A More Effective Compliance Program Through Innovation: Day 14 – Creating an Inventory of Metrics The 2023 ECCP not only continued to emphasize the importance of monitoring and testing the effectiveness of a compliance program, but it spoke more about a Chief Compliance Officer (CCO) and compliance function utilizing data to engage in continuous monitoring and continuous improvement. For some time, the DOJ has stressed the importance of leveraging data to have objective evidence around whether or not a compliance program is working effectively. Yet, as many CCOs are legally trained, they are still determining what specific areas to consider in establishing quantifiable metrics to monitor for effectiveness. A methodical review of the 2023 ECCP to identify the different areas where a company could establish and quantify metrics to assess effectiveness is the place to start. Many companies have what Edwards called “metrics on the basics” and noted they “have in place processes whereby their employees review the Code of Conduct and confirm they comply with it either when they first onboard with the company and then periodically on an annual basis, companies are doing just fine at reporting.” But it is now the barest minimum of what compliance professionals must do. For instance, they could consider Quote To Cash (QTC) lifecycles or Procure To Pay (P2P). The key starts with a documented process that can be audited and built from there. Three key takeaways: Create an inventory of compliance metrics. Create your metrics based on the 2023 ECCP. Use these metrics for continuous monitoring and improvement. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 19 Oct 2023 04:00:00 -0000 Day 14 – Creating an Inventory of Metrics full 14 Thomas Fox Today, we are creating a set of compliance metrics. The 2023 ECCP not only continued to emphasize the importance of monitoring and testing the effectiveness of a compliance program, but it spoke more about a Chief Compliance Officer (CCO) and compliance function utilizing data to engage in continuous monitoring and continuous improvement. For some time, the DOJ has stressed the importance of leveraging data to have objective evidence around whether or not a compliance program is working effectively. Yet, as many CCOs are legally trained, they are still determining what specific areas to consider in establishing quantifiable metrics to monitor for effectiveness. A methodical review of the 2023 ECCP to identify the different areas where a company could establish and quantify metrics to assess effectiveness is the place to start. Many companies have what Edwards called “metrics on the basics” and noted they “have in place processes whereby their employees review the Code of Conduct and confirm they comply with it either when they first onboard with the company and then periodically on an annual basis, companies are doing just fine at reporting.” But it is now the barest minimum of what compliance professionals must do. For instance, they could consider Quote To Cash (QTC) lifecycles or Procure To Pay (P2P). The key starts with a documented process that can be audited and built from there. Three key takeaways: Create an inventory of compliance metrics. Create your metrics based on the 2023 ECCP. Use these metrics for continuous monitoring and improvement. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2023 ECCP not only continued to emphasize the importance of monitoring and testing the effectiveness of a compliance program, but it spoke more about a Chief Compliance Officer (CCO) and compliance function utilizing data to engage in continuous monitoring and continuous improvement. For some time, the DOJ has stressed the importance of leveraging data to have objective evidence around whether or not a compliance program is working effectively. Yet, as many CCOs are legally trained, they are still determining what specific areas to consider in establishing quantifiable metrics to monitor for effectiveness.

A methodical review of the 2023 ECCP to identify the different areas where a company could establish and quantify metrics to assess effectiveness is the place to start. Many companies have what Edwards called “metrics on the basics” and noted they “have in place processes whereby their employees review the Code of Conduct and confirm they comply with it either when they first onboard with the company and then periodically on an annual basis, companies are doing just fine at reporting.” But it is now the barest minimum of what compliance professionals must do. For instance, they could consider Quote To Cash (QTC) lifecycles or Procure To Pay (P2P). The key starts with a documented process that can be audited and built from there.

Three key takeaways:

  1. Create an inventory of compliance metrics.
  2. Create your metrics based on the 2023 ECCP.
  3. Use these metrics for continuous monitoring and improvement.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 460 no One Month to a More Effective Compliance Program Through Innovation: Day 13 – Consistency as a Compliance Best Practice The 2023 ECCP emphasized the need for the corporate compliance function to ensure consistency and fairness in monitoring investigations and the resulting discipline. One of the ways the 2020 Update emphasized this was through tracking the investigations and the discipline that may come out of any investigation. Companies’ challenges are that facts and circumstances are always different in every investigation. This makes it sometimes difficult, but if companies treat employees of one country differently in terms of discipline, it does create potential gaps in a compliance program. This can give certain countries a feeling that they can do what they want without the risk of punishment from corporate headquarters. This is why the DOJ re-emphasized monitoring the investigations and ensuring consistent application of discipline as a critical factor in providing an effective compliance program. The FCPA Resource Guide, 2nd edition, added a new hallmark to the previously titled 10 Hallmarks of an Effective Compliance Program (now it is simply the Hallmarks). The Hallmark added was one that has been around for some time: Root Cause Analysis (RCA). It is familiar because it was subtly considered in the original FCPA Resource Guide and explicitly discussed since at least the original formulation of the Evaluation of Corporate Compliance Programs in February 2017. The focus on consistency is insightful and instructive as a key element of a best practices compliance program. Consistency forms the basis of both institutional justice and institutional fairness. That, in turn, facilitates a speak-up culture, which is the role of the compliance department to foster. Three key takeaways: Consistency is a key part of any compliance program. Consistency forms the basis of both institutional justice and institutional fairness. Consistency facilitates a speak-up culture. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 18 Oct 2023 04:00:00 -0000 Day 13 – Consistency as a Compliance Best Practice full 13 Thomas Fox Today, Tom Fox discusses why consistency should be considered a compliance best practice. The 2023 ECCP emphasized the need for the corporate compliance function to ensure consistency and fairness in monitoring investigations and the resulting discipline. One of the ways the 2020 Update emphasized this was through tracking the investigations and the discipline that may come out of any investigation. Companies’ challenges are that facts and circumstances are always different in every investigation. This makes it sometimes difficult, but if companies treat employees of one country differently in terms of discipline, it does create potential gaps in a compliance program. This can give certain countries a feeling that they can do what they want without the risk of punishment from corporate headquarters. This is why the DOJ re-emphasized monitoring the investigations and ensuring consistent application of discipline as a critical factor in providing an effective compliance program. The FCPA Resource Guide, 2nd edition, added a new hallmark to the previously titled 10 Hallmarks of an Effective Compliance Program (now it is simply the Hallmarks). The Hallmark added was one that has been around for some time: Root Cause Analysis (RCA). It is familiar because it was subtly considered in the original FCPA Resource Guide and explicitly discussed since at least the original formulation of the Evaluation of Corporate Compliance Programs in February 2017. The focus on consistency is insightful and instructive as a key element of a best practices compliance program. Consistency forms the basis of both institutional justice and institutional fairness. That, in turn, facilitates a speak-up culture, which is the role of the compliance department to foster. Three key takeaways: Consistency is a key part of any compliance program. Consistency forms the basis of both institutional justice and institutional fairness. Consistency facilitates a speak-up culture. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2023 ECCP emphasized the need for the corporate compliance function to ensure consistency and fairness in monitoring investigations and the resulting discipline. One of the ways the 2020 Update emphasized this was through tracking the investigations and the discipline that may come out of any investigation. Companies’ challenges are that facts and circumstances are always different in every investigation. This makes it sometimes difficult, but if companies treat employees of one country differently in terms of discipline, it does create potential gaps in a compliance program. This can give certain countries a feeling that they can do what they want without the risk of punishment from corporate headquarters. This is why the DOJ re-emphasized monitoring the investigations and ensuring consistent application of discipline as a critical factor in providing an effective compliance program.

The FCPA Resource Guide, 2nd edition, added a new hallmark to the previously titled 10 Hallmarks of an Effective Compliance Program (now it is simply the Hallmarks). The Hallmark added was one that has been around for some time: Root Cause Analysis (RCA). It is familiar because it was subtly considered in the original FCPA Resource Guide and explicitly discussed since at least the original formulation of the Evaluation of Corporate Compliance Programs in February 2017.

The focus on consistency is insightful and instructive as a key element of a best practices compliance program. Consistency forms the basis of both institutional justice and institutional fairness. That, in turn, facilitates a speak-up culture, which is the role of the compliance department to foster.

Three key takeaways:

  1. Consistency is a key part of any compliance program.
  2. Consistency forms the basis of both institutional justice and institutional fairness.
  3. Consistency facilitates a speak-up culture.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 463 no One Month to a More Effective Compliance Program: Day 12 – A Seat at the Table Going into the 2020s and beyond, a corporate compliance function must be integral to your business strategy. One of the key reasons is that the ever-important debate of compliance as a cost center will become more critical in the future in this decade. If compliance programs are ineffective, enforcement actions will continue to be highly costly. Over the last 10 years, there has been an increasing impact on the business where you must have compliance resources focused on remediation and business resources. This has only grown greater with reputational risks amplified by social media. This is because as significant (and costly) as these regulatory fines and penalties have been, it is the intangible reputational damage that, in the long run, maybe even more expensive. Multiple stakeholders who might not desire to play out on the risk curve might be at higher risk, located in higher jurisdictions, or operating in higher-risk industries. Further, there are other consequential impacts if compliance does not have a seat at the table. Suppose compliance has a seat at the table. In that case, there can be some leeway for compliance officers and firms to figure out how best to roll out a compliance program that is commensurate with the organization’s risk and compliant with the regulations. If compliance is relegated to the back of the (corporate) bus, there will be little chance to do so. Three key takeaways: It will be even more important for compliance to sit at the table in the future. Look for synergies with other types of compliance. Such synergies can be a big cost savings. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 17 Oct 2023 04:00:00 -0000 Day 12 – A Seat at the Table full 12 Thomas Fox Today, why does compliance need a seat at the table? Going into the 2020s and beyond, a corporate compliance function must be integral to your business strategy. One of the key reasons is that the ever-important debate of compliance as a cost center will become more critical in the future in this decade. If compliance programs are ineffective, enforcement actions will continue to be highly costly. Over the last 10 years, there has been an increasing impact on the business where you must have compliance resources focused on remediation and business resources. This has only grown greater with reputational risks amplified by social media. This is because as significant (and costly) as these regulatory fines and penalties have been, it is the intangible reputational damage that, in the long run, maybe even more expensive. Multiple stakeholders who might not desire to play out on the risk curve might be at higher risk, located in higher jurisdictions, or operating in higher-risk industries. Further, there are other consequential impacts if compliance does not have a seat at the table. Suppose compliance has a seat at the table. In that case, there can be some leeway for compliance officers and firms to figure out how best to roll out a compliance program that is commensurate with the organization’s risk and compliant with the regulations. If compliance is relegated to the back of the (corporate) bus, there will be little chance to do so. Three key takeaways: It will be even more important for compliance to sit at the table in the future. Look for synergies with other types of compliance. Such synergies can be a big cost savings. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Going into the 2020s and beyond, a corporate compliance function must be integral to your business strategy. One of the key reasons is that the ever-important debate of compliance as a cost center will become more critical in the future in this decade. If compliance programs are ineffective, enforcement actions will continue to be highly costly. Over the last 10 years, there has been an increasing impact on the business where you must have compliance resources focused on remediation and business resources. This has only grown greater with reputational risks amplified by social media.

This is because as significant (and costly) as these regulatory fines and penalties have been, it is the intangible reputational damage that, in the long run, maybe even more expensive. Multiple stakeholders who might not desire to play out on the risk curve might be at higher risk, located in higher jurisdictions, or operating in higher-risk industries. Further, there are other consequential impacts if compliance does not have a seat at the table. Suppose compliance has a seat at the table. In that case, there can be some leeway for compliance officers and firms to figure out how best to roll out a compliance program that is commensurate with the organization’s risk and compliant with the regulations. If compliance is relegated to the back of the (corporate) bus, there will be little chance to do so.

Three key takeaways:

  1. It will be even more important for compliance to sit at the table in the future.
  2. Look for synergies with other types of compliance.
  3. Such synergies can be a big cost savings.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 450 no One Month to a More Effective Compliance Program Through Innovation: Day 11 – Compliance Innovation Through KPIs Measuring your compliance program’s effectiveness will be a critical criterion going forward. One of the mechanisms to do so is through Key Performance Indicators (KPIs). If you have been working towards your stated goals and reporting success, KPIs are critical in showing compliance program success or failure. And while specific requirements for this kind of reporting have been hotly debated in the industry for some time, KPIs are a regulatory requirement. Your KPIs will be specific and unique to your company and its business. Couple this with what goals you are trying to achieve as a whole as a compliance program, and you will see there is no set list of these metrics. KPIs provide yet another mechanism for you to monitor and update your compliance program almost continuously. KPIs can be extremely low in cost and, therefore, something you can put in place without much approval from higher-ups in your organization that you might have to go to for budget approval. Finally, innovation can come in many ways. ComTech can be a huge jump forward. But sometimes innovation can occur at much less cost and a much more granular level. KPIs can be such a mechanism for you. Three key takeaways: KPIs will be critical to assess a compliance program going forward. Set your KPIs. Decide on how to use KPIs and the blueprint for going forward. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 16 Oct 2023 04:00:00 -0000 Day 11 – Compliance Innovation Through KPIs full 11 Thomas Fox Today, we consider KPIs in compliance. Measuring your compliance program’s effectiveness will be a critical criterion going forward. One of the mechanisms to do so is through Key Performance Indicators (KPIs). If you have been working towards your stated goals and reporting success, KPIs are critical in showing compliance program success or failure. And while specific requirements for this kind of reporting have been hotly debated in the industry for some time, KPIs are a regulatory requirement. Your KPIs will be specific and unique to your company and its business. Couple this with what goals you are trying to achieve as a whole as a compliance program, and you will see there is no set list of these metrics. KPIs provide yet another mechanism for you to monitor and update your compliance program almost continuously. KPIs can be extremely low in cost and, therefore, something you can put in place without much approval from higher-ups in your organization that you might have to go to for budget approval. Finally, innovation can come in many ways. ComTech can be a huge jump forward. But sometimes innovation can occur at much less cost and a much more granular level. KPIs can be such a mechanism for you. Three key takeaways: KPIs will be critical to assess a compliance program going forward. Set your KPIs. Decide on how to use KPIs and the blueprint for going forward. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Measuring your compliance program’s effectiveness will be a critical criterion going forward. One of the mechanisms to do so is through Key Performance Indicators (KPIs). If you have been working towards your stated goals and reporting success, KPIs are critical in showing compliance program success or failure. And while specific requirements for this kind of reporting have been hotly debated in the industry for some time, KPIs are a regulatory requirement. Your KPIs will be specific and unique to your company and its business. Couple this with what goals you are trying to achieve as a whole as a compliance program, and you will see there is no set list of these metrics.

KPIs provide yet another mechanism for you to monitor and update your compliance program almost continuously. KPIs can be extremely low in cost and, therefore, something you can put in place without much approval from higher-ups in your organization that you might have to go to for budget approval. Finally, innovation can come in many ways. ComTech can be a huge jump forward. But sometimes innovation can occur at much less cost and a much more granular level. KPIs can be such a mechanism for you.

Three key takeaways:

  1. KPIs will be critical to assess a compliance program going forward.
  2. Set your KPIs.
  3. Decide on how to use KPIs and the blueprint for going forward.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 457 no One Month to a More Effective Compliance Program Through Innovation: Day 10 – Connected Compliance Disconnectedness compliance comes from the fact that there is not one system that connects the disparate strands of the compliance discipline. Connected compliance allows a CCO and all those people in the organization working with compliance to have one central place, a system of record for everything they do. This can be their whistleblowing hotline, case management, training of their employees, or training of their vendor’s policy. It is literally connecting them all so they are running from one central location, and these disparate systems can be monitored from one central location. A key way to think about it is “getting everything under one roof,” as one of the struggles many compliance officers have is that the information they need is literally siloed across different functions of the company. Information can be contained in the sales function, where there may be employee expense data, information on marketing expenses, or charitable donations in the sales organization, but it could be spread among other corporate functions as well. All of this is what the DOJ has articulated as operationalizing compliance. It first garnered attention in the February 2017 release of the original Evaluation of Corporate Compliance Programs and has only increased with the 2023 ECCP. Since that time, compliance practitioners have steadily worked to move their compliance programs forward onto the front lines of their business units. Connected compliance is one way to do so, but it clearly requires a human element to not only interpret data but to impart the appropriate or required compliance solution. Operationalizing compliance means that you cannot have an annual or even quarterly update on what’s going on in the program. It must be operationalized in such a way that you are sharing information not only with the regional business units of floating up to the corporate compliance folks but also sharing information back and forth with the other business units, procurement, finance, and reacting in real-time. Three key takeaways: Connected compliance moves you towards continuous monitoring. Compliance under one roof. Never forget the human element. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 13 Oct 2023 04:00:00 -0000 Day 10 – Connected Compliance full Thomas Fox Today we explore connected compliance. Disconnectedness compliance comes from the fact that there is not one system that connects the disparate strands of the compliance discipline. Connected compliance allows a CCO and all those people in the organization working with compliance to have one central place, a system of record for everything they do. This can be their whistleblowing hotline, case management, training of their employees, or training of their vendor’s policy. It is literally connecting them all so they are running from one central location, and these disparate systems can be monitored from one central location. A key way to think about it is “getting everything under one roof,” as one of the struggles many compliance officers have is that the information they need is literally siloed across different functions of the company. Information can be contained in the sales function, where there may be employee expense data, information on marketing expenses, or charitable donations in the sales organization, but it could be spread among other corporate functions as well. All of this is what the DOJ has articulated as operationalizing compliance. It first garnered attention in the February 2017 release of the original Evaluation of Corporate Compliance Programs and has only increased with the 2023 ECCP. Since that time, compliance practitioners have steadily worked to move their compliance programs forward onto the front lines of their business units. Connected compliance is one way to do so, but it clearly requires a human element to not only interpret data but to impart the appropriate or required compliance solution. Operationalizing compliance means that you cannot have an annual or even quarterly update on what’s going on in the program. It must be operationalized in such a way that you are sharing information not only with the regional business units of floating up to the corporate compliance folks but also sharing information back and forth with the other business units, procurement, finance, and reacting in real-time. Three key takeaways: Connected compliance moves you towards continuous monitoring. Compliance under one roof. Never forget the human element. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Disconnectedness compliance comes from the fact that there is not one system that connects the disparate strands of the compliance discipline. Connected compliance allows a CCO and all those people in the organization working with compliance to have one central place, a system of record for everything they do. This can be their whistleblowing hotline, case management, training of their employees, or training of their vendor’s policy. It is literally connecting them all so they are running from one central location, and these disparate systems can be monitored from one central location. A key way to think about it is “getting everything under one roof,” as one of the struggles many compliance officers have is that the information they need is literally siloed across different functions of the company. Information can be contained in the sales function, where there may be employee expense data, information on marketing expenses, or charitable donations in the sales organization, but it could be spread among other corporate functions as well.

All of this is what the DOJ has articulated as operationalizing compliance. It first garnered attention in the February 2017 release of the original Evaluation of Corporate Compliance Programs and has only increased with the 2023 ECCP. Since that time, compliance practitioners have steadily worked to move their compliance programs forward onto the front lines of their business units. Connected compliance is one way to do so, but it clearly requires a human element to not only interpret data but to impart the appropriate or required compliance solution. Operationalizing compliance means that you cannot have an annual or even quarterly update on what’s going on in the program. It must be operationalized in such a way that you are sharing information not only with the regional business units of floating up to the corporate compliance folks but also sharing information back and forth with the other business units, procurement, finance, and reacting in real-time.

Three key takeaways:

  1. Connected compliance moves you towards continuous monitoring.
  2. Compliance under one roof.
  3. Never forget the human element.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 451 no One Month to a More Effective Compliance Program Through Innovation: Day 9 - The Competitive Advantage of Data The DOJ and SEC have both made it clear that they expect companies to be more robust in their use of data analytics in compliance programs. This means using data not only to detect and prevent illegal conduct but also in the remediation prong of any best practices compliance program through continuous improvement. In 2019, former Deputy Assistant Attorney General Matthew Miner said in a speech that the DOJ will inquire whether compliance departments have access to internal data that could help them identify misconduct and whether compliance officers make adequate use of data analytics in their reviews of companies under investigation. Since at least 2016, in the FCPA enforcement action involving Key Energy Services, Inc., the SEC has been communicating to compliance professionals the need for increased use of data and data analytics in any compliance program. The bottom line is that it is not if but when you begin to incorporate corporate information into your compliance program to make your compliance program more efficient, and your business process run more effectively. Let's start now to identify the data you have access to and the data to which you currently do not have access. Find a way to bridge that gap.   Three key takeaways: DOJ pronouncements mandate CCO availability to and use of data. Data can be an actionable solution across geographic and business lines. Use data as a business strategy. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 12 Oct 2023 14:56:45 -0000 Day 9 - The Competitive Advantage of Data full Thomas Fox What is the competitive advantage of data? The DOJ and SEC have both made it clear that they expect companies to be more robust in their use of data analytics in compliance programs. This means using data not only to detect and prevent illegal conduct but also in the remediation prong of any best practices compliance program through continuous improvement. In 2019, former Deputy Assistant Attorney General Matthew Miner said in a speech that the DOJ will inquire whether compliance departments have access to internal data that could help them identify misconduct and whether compliance officers make adequate use of data analytics in their reviews of companies under investigation. Since at least 2016, in the FCPA enforcement action involving Key Energy Services, Inc., the SEC has been communicating to compliance professionals the need for increased use of data and data analytics in any compliance program. The bottom line is that it is not if but when you begin to incorporate corporate information into your compliance program to make your compliance program more efficient, and your business process run more effectively. Let's start now to identify the data you have access to and the data to which you currently do not have access. Find a way to bridge that gap.   Three key takeaways: DOJ pronouncements mandate CCO availability to and use of data. Data can be an actionable solution across geographic and business lines. Use data as a business strategy. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices The DOJ and SEC have both made it clear that they expect companies to be more robust in their use of data analytics in compliance programs. This means using data not only to detect and prevent illegal conduct but also in the remediation prong of any best practices compliance program through continuous improvement. In 2019, former Deputy Assistant Attorney General Matthew Miner said in a speech that the DOJ will inquire whether compliance departments have access to internal data that could help them identify misconduct and whether compliance officers make adequate use of data analytics in their reviews of companies under investigation. Since at least 2016, in the FCPA enforcement action involving Key Energy Services, Inc., the SEC has been communicating to compliance professionals the need for increased use of data and data analytics in any compliance program.

The bottom line is that it is not if but when you begin to incorporate corporate information into your compliance program to make your compliance program more efficient, and your business process run more effectively. Let's start now to identify the data you have access to and the data to which you currently do not have access. Find a way to bridge that gap.

 

Three key takeaways:

  1. DOJ pronouncements mandate CCO availability to and use of data.
  2. Data can be an actionable solution across geographic and business lines.
  3. Use data as a business strategy.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 460 no One Month to a More Effective Compliance Program Through Innovation: Day 8 – The Compliance Function into the 2030s and Beyond Today, we look at the Compliance Function. The pandemic accelerated changes in compliance that have been percolating for the last few years. Indeed, I believe that in as short a time as 5 years, 2020 will be seen as an inflection point in compliance, IE., the Year When Everything Changed. There are four major changes I would like to highlight and what these changes portend for compliance down the road. Compliance Convergence. In 2019, there were three significant releases of information by the federal government, which directly impacted compliance professionals. Public/private partnership in the anti-corruption fight. Over the past few years, the DOJ has gone far toward laying out real incentives for corporations to help in the fight against the international scourge against bribery and corruption. Data, Data, Data. The DOJ has made it clear that it expects companies to be more robust in their use of data analytics in compliance programs. Compliance as the Ethical Edge. We have known for many years that companies with more robust compliance programs were most generally better-run companies. This academic research and other case studies demonstrate that effective compliance programs equate to more efficient business processes and lead to greater profitability. As senior business leaders come to understand this message, they will (properly) see compliance as a business process that can be analyzed and improved through continuous improvement to make companies run more efficiently and, at the end of the day, more profitably. These companies do not make money because they have a better heart. They are more profitable because they are better run. Finally, all of this ties back to a requirement from the DOJ for continuous improvement of your compliance program. Three key takeaways: It’s all about compliance now. Compliance connectedness. It’s all about the data. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 11 Oct 2023 04:00:00 -0000 Day 8 – The Compliance Function into the 2030s and Beyond full Thomas Fox Today, Tom Fox considers the compliance function into the 2030s and beyond. Today, we look at the Compliance Function. The pandemic accelerated changes in compliance that have been percolating for the last few years. Indeed, I believe that in as short a time as 5 years, 2020 will be seen as an inflection point in compliance, IE., the Year When Everything Changed. There are four major changes I would like to highlight and what these changes portend for compliance down the road. Compliance Convergence. In 2019, there were three significant releases of information by the federal government, which directly impacted compliance professionals. Public/private partnership in the anti-corruption fight. Over the past few years, the DOJ has gone far toward laying out real incentives for corporations to help in the fight against the international scourge against bribery and corruption. Data, Data, Data. The DOJ has made it clear that it expects companies to be more robust in their use of data analytics in compliance programs. Compliance as the Ethical Edge. We have known for many years that companies with more robust compliance programs were most generally better-run companies. This academic research and other case studies demonstrate that effective compliance programs equate to more efficient business processes and lead to greater profitability. As senior business leaders come to understand this message, they will (properly) see compliance as a business process that can be analyzed and improved through continuous improvement to make companies run more efficiently and, at the end of the day, more profitably. These companies do not make money because they have a better heart. They are more profitable because they are better run. Finally, all of this ties back to a requirement from the DOJ for continuous improvement of your compliance program. Three key takeaways: It’s all about compliance now. Compliance connectedness. It’s all about the data. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Today, we look at the Compliance Function. The pandemic accelerated changes in compliance that have been percolating for the last few years. Indeed, I believe that in as short a time as 5 years, 2020 will be seen as an inflection point in compliance, IE., the Year When Everything Changed. There are four major changes I would like to highlight and what these changes portend for compliance down the road.

Compliance Convergence. In 2019, there were three significant releases of information by the federal government, which directly impacted compliance professionals.

Public/private partnership in the anti-corruption fight. Over the past few years, the DOJ has gone far toward laying out real incentives for corporations to help in the fight against the international scourge against bribery and corruption.

Data, Data, Data. The DOJ has made it clear that it expects companies to be more robust in their use of data analytics in compliance programs.

Compliance as the Ethical Edge. We have known for many years that companies with more robust compliance programs were most generally better-run companies.

This academic research and other case studies demonstrate that effective compliance programs equate to more efficient business processes and lead to greater profitability. As senior business leaders come to understand this message, they will (properly) see compliance as a business process that can be analyzed and improved through continuous improvement to make companies run more efficiently and, at the end of the day, more profitably. These companies do not make money because they have a better heart. They are more profitable because they are better run. Finally, all of this ties back to a requirement from the DOJ for continuous improvement of your compliance program.

Three key takeaways:

  1. It’s all about compliance now.
  2. Compliance connectedness.
  3. It’s all about the data.


For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 451 no One Month to a More Effective Compliance Program Through Innovation: Day 7-Skills for the Compliance Professional in 2025 and Beyond What should compliance practitioners do to move themselves forward professionally in 2025 and beyond? To consider this question, I drew inspiration from the Financial Times (FT) piece, entitled “Work in the 2020s: 5 essential skills to succeed”, by Lyndsey Jones. In this article Jones laid out five areas where workers need to have skills that will keep abreast of the ever-evolving marketplace. They are: (1) Adapt to thrive, (2) Be creative; (3) Develop emotional intelligence; (4) Become tech savvy; and (5) Build your personal brand. Being a compliance professional in the coming decade will be one of the most challenging, rewarding and exciting professions for anyone to engage in. You have the opportunity to help lead not only your organization but also your profession. To paraphrase Alyson Van Hooser, will you put your (compliance) stake in the ground and own it? For your sake and the sake of the compliance profession going forward, I hope you will do so.  Three key takeaways: Adapt to thrive as you are only limited by your imagination. Build your brand and deliver. Be creative. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 10 Oct 2023 04:00:00 -0000 Day 7-Skills for the Compliance Professional in 2025 and Beyond full Thomas Fox Today I consider some of the skills the compliance professional will need in 2025 and beyond. What should compliance practitioners do to move themselves forward professionally in 2025 and beyond? To consider this question, I drew inspiration from the Financial Times (FT) piece, entitled “Work in the 2020s: 5 essential skills to succeed”, by Lyndsey Jones. In this article Jones laid out five areas where workers need to have skills that will keep abreast of the ever-evolving marketplace. They are: (1) Adapt to thrive, (2) Be creative; (3) Develop emotional intelligence; (4) Become tech savvy; and (5) Build your personal brand. Being a compliance professional in the coming decade will be one of the most challenging, rewarding and exciting professions for anyone to engage in. You have the opportunity to help lead not only your organization but also your profession. To paraphrase Alyson Van Hooser, will you put your (compliance) stake in the ground and own it? For your sake and the sake of the compliance profession going forward, I hope you will do so.  Three key takeaways: Adapt to thrive as you are only limited by your imagination. Build your brand and deliver. Be creative. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices What should compliance practitioners do to move themselves forward professionally in 2025 and beyond? To consider this question, I drew inspiration from the Financial Times (FT) piece, entitled “Work in the 2020s: 5 essential skills to succeed”, by Lyndsey Jones. In this article Jones laid out five areas where workers need to have skills that will keep abreast of the ever-evolving marketplace. They are: (1) Adapt to thrive, (2) Be creative; (3) Develop emotional intelligence; (4) Become tech savvy; and (5) Build your personal brand.

Being a compliance professional in the coming decade will be one of the most challenging, rewarding and exciting professions for anyone to engage in. You have the opportunity to help lead not only your organization but also your profession. To paraphrase Alyson Van Hooser, will you put your (compliance) stake in the ground and own it? For your sake and the sake of the compliance profession going forward, I hope you will do so. 

Three key takeaways:

  1. Adapt to thrive as you are only limited by your imagination.
  2. Build your brand and deliver.
  3. Be creative.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 439 no One Month to More Effective Compliance Through Innovation: Day 6 – Future of Compliance Training Where is compliance training headed? In the 2020 Update, the DOJ stated, “companies have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit, or other risk management functions.” While this tactical solution has proven useful, I wanted to consider the broader compliance training themes that compliance professionals have learned over the past few years to gain insight into where compliance training may be headed. I sat down with Shawn Rogers, Senior Director, Global Ethics & Compliance at Stanley Black & Decker, Inc., to provide some thoughts on the veiled land of the future of compliance training. Compliance training needs to get to the point where managers and leaders drive compliance training based on how they perceive the risks in their organizations. In other words, an awareness of risks can permeate the organization to such a degree that managers will be able to recognize when their employees need training and can call on the compliance function to provide custom training opportunities. Three key takeaways: Business crises almost always begin with a culture failure. Focus your most detailed training on those employees who are truly high-risk. This is the “just-in-time” training model that provides training exactly when and where the employee needs the information. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 09 Oct 2023 04:00:00 -0000 Day 6 – Future of Compliance Training full Thomas Fox Today Tom Fox consider the future of compliance training. Where is compliance training headed? In the 2020 Update, the DOJ stated, “companies have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit, or other risk management functions.” While this tactical solution has proven useful, I wanted to consider the broader compliance training themes that compliance professionals have learned over the past few years to gain insight into where compliance training may be headed. I sat down with Shawn Rogers, Senior Director, Global Ethics & Compliance at Stanley Black & Decker, Inc., to provide some thoughts on the veiled land of the future of compliance training. Compliance training needs to get to the point where managers and leaders drive compliance training based on how they perceive the risks in their organizations. In other words, an awareness of risks can permeate the organization to such a degree that managers will be able to recognize when their employees need training and can call on the compliance function to provide custom training opportunities. Three key takeaways: Business crises almost always begin with a culture failure. Focus your most detailed training on those employees who are truly high-risk. This is the “just-in-time” training model that provides training exactly when and where the employee needs the information. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Where is compliance training headed? In the 2020 Update, the DOJ stated, “companies have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit, or other risk management functions.” While this tactical solution has proven useful, I wanted to consider the broader compliance training themes that compliance professionals have learned over the past few years to gain insight into where compliance training may be headed. I sat down with Shawn Rogers, Senior Director, Global Ethics & Compliance at Stanley Black & Decker, Inc., to provide some thoughts on the veiled land of the future of compliance training.

Compliance training needs to get to the point where managers and leaders drive compliance training based on how they perceive the risks in their organizations. In other words, an awareness of risks can permeate the organization to such a degree that managers will be able to recognize when their employees need training and can call on the compliance function to provide custom training opportunities.

Three key takeaways:

  1. Business crises almost always begin with a culture failure.
  2. Focus your most detailed training on those employees who are truly high-risk.
  3. This is the “just-in-time” training model that provides training exactly when and where the employee needs the information.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 450 no One Month to a More Effective Compliance Program Through Innovation: Day 5 - Communication to see Around Corners The more you can operationalize compliance, the more it works to operationalize culture in your organization. It works for all levels of a company, literally from the Boardroom to the shop floor. The DOJ and SEC recognized this when they noted in their 2020 FCPA Resource Guide, “A compliance program should apply from the board room to the supply room - no one should be beyond its reach.” Yet culture can provide more than simply an ethical foundation, and it is also a part of the business foundation of an entity. Using such an approach to communications allows a CCO to “see around corners” and can be one of the greatest strengths of a best practices compliance program. The reason is listening. Listening is a key leadership component, and there are certainly many ways to listen. You can sit in your office and wait for a call or report on the hotline, or you can go out into the field and find out what challenges employees are facing. From this, you can work with them to craft a solution that works for the company and holds to the company’s ethical and compliance values. Using social media tools, a CCO can move towards Thomas’ next key ingredient of a successful corporate culture, which is trust. Thomas said, “I’m obsessive about the culture that we create specifically around trust, and this is an adjustment for some people when they come here. If you join our team, there’s trust by default here. That means you trust in the competence of your teammates. You trust in their intentions and what they’re saying. At some companies, the culture is that trust is earned over time, but that means if everyone in the organization says you have to earn trust, the amount of energy that actually goes into the trust-earning process is a distraction from our mission.” Three key takeaways: A company can fail if it does not get its culture right. Using communications to “see around corners.” Trust works as a business strategy. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 06 Oct 2023 13:54:02 -0000 Communication to see Around Corners full Thomas Fox Today, using communication to see around corners. The more you can operationalize compliance, the more it works to operationalize culture in your organization. It works for all levels of a company, literally from the Boardroom to the shop floor. The DOJ and SEC recognized this when they noted in their 2020 FCPA Resource Guide, “A compliance program should apply from the board room to the supply room - no one should be beyond its reach.” Yet culture can provide more than simply an ethical foundation, and it is also a part of the business foundation of an entity. Using such an approach to communications allows a CCO to “see around corners” and can be one of the greatest strengths of a best practices compliance program. The reason is listening. Listening is a key leadership component, and there are certainly many ways to listen. You can sit in your office and wait for a call or report on the hotline, or you can go out into the field and find out what challenges employees are facing. From this, you can work with them to craft a solution that works for the company and holds to the company’s ethical and compliance values. Using social media tools, a CCO can move towards Thomas’ next key ingredient of a successful corporate culture, which is trust. Thomas said, “I’m obsessive about the culture that we create specifically around trust, and this is an adjustment for some people when they come here. If you join our team, there’s trust by default here. That means you trust in the competence of your teammates. You trust in their intentions and what they’re saying. At some companies, the culture is that trust is earned over time, but that means if everyone in the organization says you have to earn trust, the amount of energy that actually goes into the trust-earning process is a distraction from our mission.” Three key takeaways: A company can fail if it does not get its culture right. Using communications to “see around corners.” Trust works as a business strategy. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices The more you can operationalize compliance, the more it works to operationalize culture in your organization. It works for all levels of a company, literally from the Boardroom to the shop floor. The DOJ and SEC recognized this when they noted in their 2020 FCPA Resource Guide, “A compliance program should apply from the board room to the supply room - no one should be beyond its reach.” Yet culture can provide more than simply an ethical foundation, and it is also a part of the business foundation of an entity.

Using such an approach to communications allows a CCO to “see around corners” and can be one of the greatest strengths of a best practices compliance program. The reason is listening. Listening is a key leadership component, and there are certainly many ways to listen. You can sit in your office and wait for a call or report on the hotline, or you can go out into the field and find out what challenges employees are facing. From this, you can work with them to craft a solution that works for the company and holds to the company’s ethical and compliance values.

Using social media tools, a CCO can move towards Thomas’ next key ingredient of a successful corporate culture, which is trust. Thomas said, “I’m obsessive about the culture that we create specifically around trust, and this is an adjustment for some people when they come here. If you join our team, there’s trust by default here. That means you trust in the competence of your teammates. You trust in their intentions and what they’re saying. At some companies, the culture is that trust is earned over time, but that means if everyone in the organization says you have to earn trust, the amount of energy that actually goes into the trust-earning process is a distraction from our mission.”

Three key takeaways:

  1. A company can fail if it does not get its culture right.
  2. Using communications to “see around corners.”
  3. Trust works as a business strategy.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 439 no One Month to a More Effective Compliance Program Through Innovation: Day 4 - The ROI of Effective Compliance We are now at a place where there is sufficient data, academic research, and actual use cases from corporations and businesses that demonstrate good ethics and compliance programs are not simply good for business, but when properly used, they lead to greater profitability. The data and information you collect, which might initially begin as a compliance solution or project, can be used to improve business process efficiency. The delivery of a compliance solution can enhance an overall business process. When you start to consider the compliance data points in every organization, from the Quote To Cash (QTC) sales cycle to the procure-to-pay (P2P) procurement cycle, you begin to see how compliance can be used to improve business efficiency and lead to greater profitability. Three key takeaways: The World’s Most Ethical companies had 13.5% delta about the S&P 500 average in 2020. Companies with robust compliance programs do better financially in countries prone to corruption than companies with less effective compliance programs. What does the data tell you? For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 05 Oct 2023 13:13:27 -0000 Day 4 - The ROI of Effective Compliance bonus 4 Thomas Fox Today the Day the ROI of Effective Compliance. We are now at a place where there is sufficient data, academic research, and actual use cases from corporations and businesses that demonstrate good ethics and compliance programs are not simply good for business, but when properly used, they lead to greater profitability. The data and information you collect, which might initially begin as a compliance solution or project, can be used to improve business process efficiency. The delivery of a compliance solution can enhance an overall business process. When you start to consider the compliance data points in every organization, from the Quote To Cash (QTC) sales cycle to the procure-to-pay (P2P) procurement cycle, you begin to see how compliance can be used to improve business efficiency and lead to greater profitability. Three key takeaways: The World’s Most Ethical companies had 13.5% delta about the S&P 500 average in 2020. Companies with robust compliance programs do better financially in countries prone to corruption than companies with less effective compliance programs. What does the data tell you? For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices We are now at a place where there is sufficient data, academic research, and actual use cases from corporations and businesses that demonstrate good ethics and compliance programs are not simply good for business, but when properly used, they lead to greater profitability.

The data and information you collect, which might initially begin as a compliance solution or project, can be used to improve business process efficiency. The delivery of a compliance solution can enhance an overall business process. When you start to consider the compliance data points in every organization, from the Quote To Cash (QTC) sales cycle to the procure-to-pay (P2P) procurement cycle, you begin to see how compliance can be used to improve business efficiency and lead to greater profitability.

Three key takeaways:

  1. The World’s Most Ethical companies had 13.5% delta about the S&P 500 average in 2020.
  2. Companies with robust compliance programs do better financially in countries prone to corruption than companies with less effective compliance programs.
  3. What does the data tell you?

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 448 no One Month to a More Effective Compliance Program Through Innovation: Day 3 – The Digital Transformation of Compliance Through restructuring, senior leadership can signal that digital transformation in compliance is critical for the future of the organization. From this point, the compliance function can work with an internal digital product design group. By doing so, the corporate compliance function can work with a team dedicated to supervising the development of the new compliance solution through product design, testing, and analysis, which will include customized generative design and analysis tools. Top management can signal the importance of the compliance digital transformation by using this dedicated team to spearhead the compliance function’s digital transformation development process. One of the great things about the compliance world is that we are only limited by our own imaginations. If you can imagine a better way for your company to comply fully, it is at your disposal to do so. Yet, rarely do we think about the structure of how compliance activates as a way to operationalize compliance more fully. By identifying and bringing in the skills needed to move forward with compliance innovation, you can help kick-start the compliance operationalize process through a digital transformation of your compliance regime. By doing so, you may make all the difference between success and failure coming out of the Coronavirus health crisis as the world reopens for business. Three key takeaways: Have you considered a generational team approach to a digital transformation in compliance? Have non-compliance professionals aid in compliance program development. In compliance, you are only limited by your imagination. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 04 Oct 2023 04:00:00 -0000 Day 3 – The Digital Transformation of Compliance bonus 3 Thomas Fox Today, we consider the digital transformation of compliance. Through restructuring, senior leadership can signal that digital transformation in compliance is critical for the future of the organization. From this point, the compliance function can work with an internal digital product design group. By doing so, the corporate compliance function can work with a team dedicated to supervising the development of the new compliance solution through product design, testing, and analysis, which will include customized generative design and analysis tools. Top management can signal the importance of the compliance digital transformation by using this dedicated team to spearhead the compliance function’s digital transformation development process. One of the great things about the compliance world is that we are only limited by our own imaginations. If you can imagine a better way for your company to comply fully, it is at your disposal to do so. Yet, rarely do we think about the structure of how compliance activates as a way to operationalize compliance more fully. By identifying and bringing in the skills needed to move forward with compliance innovation, you can help kick-start the compliance operationalize process through a digital transformation of your compliance regime. By doing so, you may make all the difference between success and failure coming out of the Coronavirus health crisis as the world reopens for business. Three key takeaways: Have you considered a generational team approach to a digital transformation in compliance? Have non-compliance professionals aid in compliance program development. In compliance, you are only limited by your imagination. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Through restructuring, senior leadership can signal that digital transformation in compliance is critical for the future of the organization. From this point, the compliance function can work with an internal digital product design group. By doing so, the corporate compliance function can work with a team dedicated to supervising the development of the new compliance solution through product design, testing, and analysis, which will include customized generative design and analysis tools. Top management can signal the importance of the compliance digital transformation by using this dedicated team to spearhead the compliance function’s digital transformation development process.

One of the great things about the compliance world is that we are only limited by our own imaginations. If you can imagine a better way for your company to comply fully, it is at your disposal to do so. Yet, rarely do we think about the structure of how compliance activates as a way to operationalize compliance more fully. By identifying and bringing in the skills needed to move forward with compliance innovation, you can help kick-start the compliance operationalize process through a digital transformation of your compliance regime. By doing so, you may make all the difference between success and failure coming out of the Coronavirus health crisis as the world reopens for business.

Three key takeaways:

  1. Have you considered a generational team approach to a digital transformation in compliance?
  2. Have non-compliance professionals aid in compliance program development.
  3. In compliance, you are only limited by your imagination.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 456 no One Month to a More Effective Compliance Program Through Innovation: Day 2 – Taming Complexity in Compliance One of the lessons we have learned from various FCPA enforcement actions over the years is how complexity in business organizations can work to defeat compliance programs. Whether a corrupt employee is working to actively hide a pot of money, which can or will be used to pay a bribe, or an improper payment slips through the cracks, complexity can work to defeat a best practices compliance program. A compliance function needs visibility into a business unit, how it does business, and where its payments are going, or else it may be due to design defects or inadvertent complexity. Compliance is now in an era of brisk innovation and evolution. It is prone to technological change and rapid obsolescence of the lawyer-driven, spreadsheets, and word document-based compliance programs. As we advance, the compliance professional needs to understand that a “package of resilience, adaptability, coordination, and inimitability becomes more attractive than the package of efficiency, understandability, manageability, and predictability.” The key is to learn how to harness complexity on a sustainable basis. Three key takeaways: Not all complexity is bad. If you cannot figure out how a foreigner does business, you have a problem. Compliance is now properly seen as a business process. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 03 Oct 2023 04:00:00 -0000 Day 2 – Taming Complexity in Compliance bonus 2 Thomas Fox Today, we consider how to tame complexity in compliance. One of the lessons we have learned from various FCPA enforcement actions over the years is how complexity in business organizations can work to defeat compliance programs. Whether a corrupt employee is working to actively hide a pot of money, which can or will be used to pay a bribe, or an improper payment slips through the cracks, complexity can work to defeat a best practices compliance program. A compliance function needs visibility into a business unit, how it does business, and where its payments are going, or else it may be due to design defects or inadvertent complexity. Compliance is now in an era of brisk innovation and evolution. It is prone to technological change and rapid obsolescence of the lawyer-driven, spreadsheets, and word document-based compliance programs. As we advance, the compliance professional needs to understand that a “package of resilience, adaptability, coordination, and inimitability becomes more attractive than the package of efficiency, understandability, manageability, and predictability.” The key is to learn how to harness complexity on a sustainable basis. Three key takeaways: Not all complexity is bad. If you cannot figure out how a foreigner does business, you have a problem. Compliance is now properly seen as a business process. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the lessons we have learned from various FCPA enforcement actions over the years is how complexity in business organizations can work to defeat compliance programs. Whether a corrupt employee is working to actively hide a pot of money, which can or will be used to pay a bribe, or an improper payment slips through the cracks, complexity can work to defeat a best practices compliance program. A compliance function needs visibility into a business unit, how it does business, and where its payments are going, or else it may be due to design defects or inadvertent complexity.

Compliance is now in an era of brisk innovation and evolution. It is prone to technological change and rapid obsolescence of the lawyer-driven, spreadsheets, and word document-based compliance programs. As we advance, the compliance professional needs to understand that a “package of resilience, adaptability, coordination, and inimitability becomes more attractive than the package of efficiency, understandability, manageability, and predictability.” The key is to learn how to harness complexity on a sustainable basis.

Three key takeaways:

  1. Not all complexity is bad.
  2. If you cannot figure out how a foreigner does business, you have a problem.
  3. Compliance is now properly seen as a business process.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 458 no One Month to a More Effective Compliance Program Through Innovation: Day 1 - Originating a Compliance Ecosystem The compliance profession seems to be an inflection point, moving away from the lawyer-driven written policies and procedures to a more operationalized regime where compliance is a part of the overall ecosystem embedded directly in business process focused discipline. Seen in this manner, compliance will be seen not as a cost center but as a value creation center, helping the company to make business processes more efficient and then more profitable. To be the orchestrator and prime mover of a compliance ecosystem, you need a superior compliance service that is hard to replicate. This means some combination of compliance, a large network of internal users and strong branding. Compliance is undergoing a paradigm shift as a result of technological and digital innovation. CCOs who cannot interpret the data from their own systems will likely find themselves consigned to the dustbin of corporate luddites. Compliance will be moving into a new era of collaboration and connection to more fully operationalize compliance to make all business stakeholders more efficient and at the end of the day more profitable. Three Key Takeaways: Compliance is undergoing a paradigm shift as a result of technological and digital innovation. To be the orchestrator and prime mover of a compliance ecosystem, you need a superior service that is hard to replicate. Compliance should help other corporate functions. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 02 Oct 2023 04:00:00 -0000 Day 1 - Originating a Compliance Ecosystem bonus Thomas Fox Today we begin a month on innovation in compliance by looking at compliance ecosystems. The compliance profession seems to be an inflection point, moving away from the lawyer-driven written policies and procedures to a more operationalized regime where compliance is a part of the overall ecosystem embedded directly in business process focused discipline. Seen in this manner, compliance will be seen not as a cost center but as a value creation center, helping the company to make business processes more efficient and then more profitable. To be the orchestrator and prime mover of a compliance ecosystem, you need a superior compliance service that is hard to replicate. This means some combination of compliance, a large network of internal users and strong branding. Compliance is undergoing a paradigm shift as a result of technological and digital innovation. CCOs who cannot interpret the data from their own systems will likely find themselves consigned to the dustbin of corporate luddites. Compliance will be moving into a new era of collaboration and connection to more fully operationalize compliance to make all business stakeholders more efficient and at the end of the day more profitable. Three Key Takeaways: Compliance is undergoing a paradigm shift as a result of technological and digital innovation. To be the orchestrator and prime mover of a compliance ecosystem, you need a superior service that is hard to replicate. Compliance should help other corporate functions. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices The compliance profession seems to be an inflection point, moving away from the lawyer-driven written policies and procedures to a more operationalized regime where compliance is a part of the overall ecosystem embedded directly in business process focused discipline. Seen in this manner, compliance will be seen not as a cost center but as a value creation center, helping the company to make business processes more efficient and then more profitable. To be the orchestrator and prime mover of a compliance ecosystem, you need a superior compliance service that is hard to replicate. This means some combination of compliance, a large network of internal users and strong branding.

Compliance is undergoing a paradigm shift as a result of technological and digital innovation. CCOs who cannot interpret the data from their own systems will likely find themselves consigned to the dustbin of corporate luddites. Compliance will be moving into a new era of collaboration and connection to more fully operationalize compliance to make all business stakeholders more efficient and at the end of the day more profitable.

Three Key Takeaways:

  1. Compliance is undergoing a paradigm shift as a result of technological and digital innovation.
  2. To be the orchestrator and prime mover of a compliance ecosystem, you need a superior service that is hard to replicate.
  3. Compliance should help other corporate functions.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 442 no One Month to More Effective Written Standards: Day 18: Polices on extortion payments The next area for policies is extortion payments, which not are made illegal under the FCPA. Extortion payments are made for any action which threatens or demands payment for life, liberty, or health. These should be exempted out from your facilitation payments and your compliance program through specific language. You need to do this for a variety of reasons. First and foremost, your employees must understand that the company will support them if they are in any way threatened with harm, with arrest or physical detention, their health/safety is threatened. As a compliance professional, you need to make sure they understand they need to do whatever they have to do to get themselves out of such a situation.  Some of the situations your employees might face are along the lines of the following: Employees are stopped by police, military or paramilitary personnel, or militia (uniformed or not) at designated or other checkpoints or other places and a payment is demanded as a condition of passage of persons or property; Employees are stopped at the airport by customs or passport control personnel or military personnel and a payment is demanded for entry or exit of persons or property; or Employees are asked by persons claiming to be security personnel, immigration control, or health inspectors to pay for an allegedly required inoculation or other similar procedure. The key though is that it be properly documented. But more than simply the documentation is that you must specifically list extortion payments in your books and records, so you will not be suspected with hiding them by describing them as something else. The key is to train your employees specifically on the actions to take. In your policy, state that if there is a threat to health, safety or liberty, it is not a facilitation payment but an extortion payment. Make sure that they understand what their rights are and what their obligations are to report it when they come back to the corporate office or their office. Always remember, an extortion payment is not a FCPA violation. Three key takeaways: Extortion payments are not illegal under the FCPA. Was the action an extortion or some other type of situation? “Document, Document, and Document” your extortion payments, both the financial component and a description of the underlying events. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 29 Sep 2023 19:08:34 -0000 Polices on extortion payments full Thomas Fox Today we consider polices on extortion payments. The next area for policies is extortion payments, which not are made illegal under the FCPA. Extortion payments are made for any action which threatens or demands payment for life, liberty, or health. These should be exempted out from your facilitation payments and your compliance program through specific language. You need to do this for a variety of reasons. First and foremost, your employees must understand that the company will support them if they are in any way threatened with harm, with arrest or physical detention, their health/safety is threatened. As a compliance professional, you need to make sure they understand they need to do whatever they have to do to get themselves out of such a situation.  Some of the situations your employees might face are along the lines of the following: Employees are stopped by police, military or paramilitary personnel, or militia (uniformed or not) at designated or other checkpoints or other places and a payment is demanded as a condition of passage of persons or property; Employees are stopped at the airport by customs or passport control personnel or military personnel and a payment is demanded for entry or exit of persons or property; or Employees are asked by persons claiming to be security personnel, immigration control, or health inspectors to pay for an allegedly required inoculation or other similar procedure. The key though is that it be properly documented. But more than simply the documentation is that you must specifically list extortion payments in your books and records, so you will not be suspected with hiding them by describing them as something else. The key is to train your employees specifically on the actions to take. In your policy, state that if there is a threat to health, safety or liberty, it is not a facilitation payment but an extortion payment. Make sure that they understand what their rights are and what their obligations are to report it when they come back to the corporate office or their office. Always remember, an extortion payment is not a FCPA violation. Three key takeaways: Extortion payments are not illegal under the FCPA. Was the action an extortion or some other type of situation? “Document, Document, and Document” your extortion payments, both the financial component and a description of the underlying events. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices The next area for policies is extortion payments, which not are made illegal under the FCPA. Extortion payments are made for any action which threatens or demands payment for life, liberty, or health. These should be exempted out from your facilitation payments and your compliance program through specific language. You need to do this for a variety of reasons. First and foremost, your employees must understand that the company will support them if they are in any way threatened with harm, with arrest or physical detention, their health/safety is threatened. As a compliance professional, you need to make sure they understand they need to do whatever they have to do to get themselves out of such a situation.

 Some of the situations your employees might face are along the lines of the following:

  • Employees are stopped by police, military or paramilitary personnel, or militia (uniformed or not) at designated or other checkpoints or other places and a payment is demanded as a condition of passage of persons or property;
  • Employees are stopped at the airport by customs or passport control personnel or military personnel and a payment is demanded for entry or exit of persons or property; or
  • Employees are asked by persons claiming to be security personnel, immigration control, or health inspectors to pay for an allegedly required inoculation or other similar procedure.


The key though is that it be properly documented. But more than simply the documentation is that you must specifically list extortion payments in your books and records, so you will not be suspected with hiding them by describing them as something else. The key is to train your employees specifically on the actions to take. In your policy, state that if there is a threat to health, safety or liberty, it is not a facilitation payment but an extortion payment. Make sure that they understand what their rights are and what their obligations are to report it when they come back to the corporate office or their office. Always remember, an extortion payment is not a FCPA violation.

Three key takeaways:

  1. Extortion payments are not illegal under the FCPA.
  2. Was the action an extortion or some other type of situation?
  3. “Document, Document, and Document” your extortion payments, both the financial component and a description of the underlying events.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 553 no One Month to More Effective Written Standards: Day 17: Policies for third-parties As every compliance practitioner is well aware, third-parties still present the highest risk under the FCPA. The DOJ 2023 ECCP devotes an entire prong to third-party management. It begins with the following: A well-designed compliance program should apply risk-based due diligence to its third-party relationships. Although the degree of appropriate due diligence may vary based on the size and nature of the company or transaction, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions. This set of queries clearly specifies the DOJ expects an integrated approach that is operationalized throughout the company. This means your compliance program must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party management: 1) business justification; 2) questionnaire to third-party; 3) due diligence on third-party; 4) compliance terms and conditions, including payment terms; and 5) management and oversight of third parties after contract signing. I continually give my mantra of compliance, which is “Document, Document, and Document”. Each of the steps you take in the management of your third parties must be documented. Not only must they be documented but they must be stored and managed in a manner that you can retrieve them with relative ease. The management of third parties is absolutely critical in any best practices compliance program. Three key takeaways: Use the full five-step process for third-party management. Make sure you have Business Development involvement and buy-in. Operationalize all steps going forward by including business unit representatives. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 27 Sep 2023 04:00:00 -0000 Policies for third-parties full Thomas Fox What are the policies you need around 3rd parties? As every compliance practitioner is well aware, third-parties still present the highest risk under the FCPA. The DOJ 2023 ECCP devotes an entire prong to third-party management. It begins with the following: A well-designed compliance program should apply risk-based due diligence to its third-party relationships. Although the degree of appropriate due diligence may vary based on the size and nature of the company or transaction, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions. This set of queries clearly specifies the DOJ expects an integrated approach that is operationalized throughout the company. This means your compliance program must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party management: 1) business justification; 2) questionnaire to third-party; 3) due diligence on third-party; 4) compliance terms and conditions, including payment terms; and 5) management and oversight of third parties after contract signing. I continually give my mantra of compliance, which is “Document, Document, and Document”. Each of the steps you take in the management of your third parties must be documented. Not only must they be documented but they must be stored and managed in a manner that you can retrieve them with relative ease. The management of third parties is absolutely critical in any best practices compliance program. Three key takeaways: Use the full five-step process for third-party management. Make sure you have Business Development involvement and buy-in. Operationalize all steps going forward by including business unit representatives. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices As every compliance practitioner is well aware, third-parties still present the highest risk under the FCPA. The DOJ 2023 ECCP devotes an entire prong to third-party management. It begins with the following: A well-designed compliance program should apply risk-based due diligence to its third-party relationships. Although the degree of appropriate due diligence may vary based on the size and nature of the company or transaction, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.

This set of queries clearly specifies the DOJ expects an integrated approach that is operationalized throughout the company. This means your compliance program must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party management: 1) business justification; 2) questionnaire to third-party; 3) due diligence on third-party; 4) compliance terms and conditions, including payment terms; and 5) management and oversight of third parties after contract signing.

I continually give my mantra of compliance, which is “Document, Document, and Document”. Each of the steps you take in the management of your third parties must be documented. Not only must they be documented but they must be stored and managed in a manner that you can retrieve them with relative ease. The management of third parties is absolutely critical in any best practices compliance program.

Three key takeaways:

  1. Use the full five-step process for third-party management.
  2. Make sure you have Business Development involvement and buy-in.
  3. Operationalize all steps going forward by including business unit representatives.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 546 no One Month to More Effective Written Standards: Day 16: Policies on Facilitation Payments From the information provided by the DOJ in Opinion Releases and in enforcement actions, there are several different insights which may be drawn on regarding what should go into your policy on facilitation payments. Do not forget that facilitation payments must be accurately shown on the books and records of your company. In all cases the employee who requested permission to make the facilitation payment must be responsible for obtaining all required approvals and forwarding a copy of the approvals and any other relevant supporting documentation as required, so that the it is recorded as a facilitation expense in the books and records and maintained in a central file. Facilitation payments should not be recorded as consulting fees, entertainment expenses, or other types of expenses that may misrepresent the true nature of the payments. There may be emergency situations when it will be difficult or impossible for employees to obtain approvals before having to decide whether or not to pay a facilitation payment. If the facilitation payment is made in an emergency, the employee reports the facilitating payment to the compliance department and explains the emergency as soon as practical after making the facilitation payment. Three key takeaways: What was the amount of the facilitation payment? Was the action truly routine? How high up was the government official who received the facilitation payment? Was his or her decision discretionary? For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 26 Sep 2023 04:00:00 -0000 Policies on Facilitation Payments full Thomas Fox In this episode we consider Policies on Facilitation Payments. From the information provided by the DOJ in Opinion Releases and in enforcement actions, there are several different insights which may be drawn on regarding what should go into your policy on facilitation payments. Do not forget that facilitation payments must be accurately shown on the books and records of your company. In all cases the employee who requested permission to make the facilitation payment must be responsible for obtaining all required approvals and forwarding a copy of the approvals and any other relevant supporting documentation as required, so that the it is recorded as a facilitation expense in the books and records and maintained in a central file. Facilitation payments should not be recorded as consulting fees, entertainment expenses, or other types of expenses that may misrepresent the true nature of the payments. There may be emergency situations when it will be difficult or impossible for employees to obtain approvals before having to decide whether or not to pay a facilitation payment. If the facilitation payment is made in an emergency, the employee reports the facilitating payment to the compliance department and explains the emergency as soon as practical after making the facilitation payment. Three key takeaways: What was the amount of the facilitation payment? Was the action truly routine? How high up was the government official who received the facilitation payment? Was his or her decision discretionary? For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices From the information provided by the DOJ in Opinion Releases and in enforcement actions, there are several different insights which may be drawn on regarding what should go into your policy on facilitation payments. Do not forget that facilitation payments must be accurately shown on the books and records of your company. In all cases the employee who requested permission to make the facilitation payment must be responsible for obtaining all required approvals and forwarding a copy of the approvals and any other relevant supporting documentation as required, so that the it is recorded as a facilitation expense in the books and records and maintained in a central file. Facilitation payments should not be recorded as consulting fees, entertainment expenses, or other types of expenses that may misrepresent the true nature of the payments.

There may be emergency situations when it will be difficult or impossible for employees to obtain approvals before having to decide whether or not to pay a facilitation payment. If the facilitation payment is made in an emergency, the employee reports the facilitating payment to the compliance department and explains the emergency as soon as practical after making the facilitation payment.

Three key takeaways:

  1. What was the amount of the facilitation payment?
  2. Was the action truly routine?
  3. How high up was the government official who received the facilitation payment? Was his or her decision discretionary?

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 550 One Month to More Effective Written Standards: Day 15: Enforcement Actions Featuring Facilitation Payments One of the more confusing areas of the FCPA is in that of facilitation payments. Facilitation payments are small bribes but make no mistake about it, they are bribes. For that reason, many companies feel they are inconsistent with a company culture of doing business ethically and in compliance with laws prohibiting corruption and bribery. Further, the 2020 FCPA Resource Guide specified, “while the payment may qualify as an exception to the FCPA’s anti-bribery provisions, it may violate other laws, both in Foreign Country and elsewhere. In addition, if the payment is not accurately recorded, it could violate the FCPA’s books and records provision.” Additionally, the 2020 FCPA Resource Guide stated, “Whether a payment falls within the exception is not dependent on the size of the payment, though size can be telling, as a large payment is more suggestive of corrupt intent to influence a non-routine governmental action. But, like the FCPA’s anti-bribery provisions more generally, the facilitating payments exception focuses on the purpose of the payment rather than its value.” In addition to these clear statements about whether the FCPA should continue to allow said bribes; you should also consider the administrative nightmare for any international company. The U.K. Bribery Act does not have any such exception, exemption or defense along the lines of the FCPA facilitation payment exception. This means that even if your company allows facilitation payments, it must exempt out every U.K. Company or subsidiary from the policy. Further, if your company employs any U.K. citizens, they are subject to the U.K. Bribery Act no matter who they work for and where they may work in the world, so they must also be exempted. Finally, if your U.S. Company does business with a U.K. or other company subject to the U.K. Bribery Act, you may be prevented contractually from making facilitation payments while working under that customer’s contract. As I said, an administrative nightmare. Three key takeaways: Do not forget the administrative nightmare of facilitation payments for international organizations. The Kay decision made clear how narrow the “routine government action” exception is. Facilitation payments will usually be an add-on as they are symptomatic of an ineffective compliance program. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 25 Sep 2023 04:00:00 -0000 Enforcement Actions Featuring Facilitation Payments full 15 Thomas Fox Today we look at enforcement actions involving facilitation payments. One of the more confusing areas of the FCPA is in that of facilitation payments. Facilitation payments are small bribes but make no mistake about it, they are bribes. For that reason, many companies feel they are inconsistent with a company culture of doing business ethically and in compliance with laws prohibiting corruption and bribery. Further, the 2020 FCPA Resource Guide specified, “while the payment may qualify as an exception to the FCPA’s anti-bribery provisions, it may violate other laws, both in Foreign Country and elsewhere. In addition, if the payment is not accurately recorded, it could violate the FCPA’s books and records provision.” Additionally, the 2020 FCPA Resource Guide stated, “Whether a payment falls within the exception is not dependent on the size of the payment, though size can be telling, as a large payment is more suggestive of corrupt intent to influence a non-routine governmental action. But, like the FCPA’s anti-bribery provisions more generally, the facilitating payments exception focuses on the purpose of the payment rather than its value.” In addition to these clear statements about whether the FCPA should continue to allow said bribes; you should also consider the administrative nightmare for any international company. The U.K. Bribery Act does not have any such exception, exemption or defense along the lines of the FCPA facilitation payment exception. This means that even if your company allows facilitation payments, it must exempt out every U.K. Company or subsidiary from the policy. Further, if your company employs any U.K. citizens, they are subject to the U.K. Bribery Act no matter who they work for and where they may work in the world, so they must also be exempted. Finally, if your U.S. Company does business with a U.K. or other company subject to the U.K. Bribery Act, you may be prevented contractually from making facilitation payments while working under that customer’s contract. As I said, an administrative nightmare. Three key takeaways: Do not forget the administrative nightmare of facilitation payments for international organizations. The Kay decision made clear how narrow the “routine government action” exception is. Facilitation payments will usually be an add-on as they are symptomatic of an ineffective compliance program. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the more confusing areas of the FCPA is in that of facilitation payments. Facilitation payments are small bribes but make no mistake about it, they are bribes. For that reason, many companies feel they are inconsistent with a company culture of doing business ethically and in compliance with laws prohibiting corruption and bribery. Further, the 2020 FCPA Resource Guide specified, “while the payment may qualify as an exception to the FCPA’s anti-bribery provisions, it may violate other laws, both in Foreign Country and elsewhere. In addition, if the payment is not accurately recorded, it could violate the FCPA’s books and records provision.” Additionally, the 2020 FCPA Resource Guide stated, “Whether a payment falls within the exception is not dependent on the size of the payment, though size can be telling, as a large payment is more suggestive of corrupt intent to influence a non-routine governmental action. But, like the FCPA’s anti-bribery provisions more generally, the facilitating payments exception focuses on the purpose of the payment rather than its value.”

In addition to these clear statements about whether the FCPA should continue to allow said bribes; you should also consider the administrative nightmare for any international company. The U.K. Bribery Act does not have any such exception, exemption or defense along the lines of the FCPA facilitation payment exception. This means that even if your company allows facilitation payments, it must exempt out every U.K. Company or subsidiary from the policy. Further, if your company employs any U.K. citizens, they are subject to the U.K. Bribery Act no matter who they work for and where they may work in the world, so they must also be exempted. Finally, if your U.S. Company does business with a U.K. or other company subject to the U.K. Bribery Act, you may be prevented contractually from making facilitation payments while working under that customer’s contract. As I said, an administrative nightmare.

Three key takeaways:

  1. Do not forget the administrative nightmare of facilitation payments for international organizations.
  2. The Kay decision made clear how narrow the “routine government action” exception is.
  3. Facilitation payments will usually be an add-on as they are symptomatic of an ineffective compliance program.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 549 no One Month to More Effective Written Standards: Day 14-the Problem with Facilitation Payments The original version of the Foreign Corrupt Practices Act (FCPA), enacted in 1977, contained an exception for payments made to non-US officials who performed duties that were “essentially ministerial or clerical”. In 1988 Congress responded by amending the FCPA under the Omnibus Trade and Competitiveness Act to clarify the scope of the FCPA’s prohibitions on bribery, including the scope of permitted facilitation payments. An expanded definition of “routine governmental action” was included in the final version of the bill, reflecting the intent of Congress that the exceptions apply only to the performance of duties listed in the subcategories of the statute and actions of a similar nature. Congress also meant to make clear that “ordinarily and commonly performed actions”, with respect to permits or licenses, would not include those governmental approvals involving an exercise of discretion by a government official where the actions are the functional equivalent of “obtaining or retaining business for, or with, or directing business to, any person.” Three key takeaways: Many companies still struggle with facilitation payments. What are the five listed purposes for facilitation payments? The facilitation payment exception is narrowly construed by both the courts and the Justice Department. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 22 Sep 2023 04:00:00 -0000 Day 14-the Problem with Facilitation Payments full Thomas Fox Today we consider Day 14-the Problem with Facilitation Payments. The original version of the Foreign Corrupt Practices Act (FCPA), enacted in 1977, contained an exception for payments made to non-US officials who performed duties that were “essentially ministerial or clerical”. In 1988 Congress responded by amending the FCPA under the Omnibus Trade and Competitiveness Act to clarify the scope of the FCPA’s prohibitions on bribery, including the scope of permitted facilitation payments. An expanded definition of “routine governmental action” was included in the final version of the bill, reflecting the intent of Congress that the exceptions apply only to the performance of duties listed in the subcategories of the statute and actions of a similar nature. Congress also meant to make clear that “ordinarily and commonly performed actions”, with respect to permits or licenses, would not include those governmental approvals involving an exercise of discretion by a government official where the actions are the functional equivalent of “obtaining or retaining business for, or with, or directing business to, any person.” Three key takeaways: Many companies still struggle with facilitation payments. What are the five listed purposes for facilitation payments? The facilitation payment exception is narrowly construed by both the courts and the Justice Department. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices The original version of the Foreign Corrupt Practices Act (FCPA), enacted in 1977, contained an exception for payments made to non-US officials who performed duties that were “essentially ministerial or clerical”. In 1988 Congress responded by amending the FCPA under the Omnibus Trade and Competitiveness Act to clarify the scope of the FCPA’s prohibitions on bribery, including the scope of permitted facilitation payments. An expanded definition of “routine governmental action” was included in the final version of the bill, reflecting the intent of Congress that the exceptions apply only to the performance of duties listed in the subcategories of the statute and actions of a similar nature. Congress also meant to make clear that “ordinarily and commonly performed actions”, with respect to permits or licenses, would not include those governmental approvals involving an exercise of discretion by a government official where the actions are the functional equivalent of “obtaining or retaining business for, or with, or directing business to, any person.”

Three key takeaways:

  1. Many companies still struggle with facilitation payments.
  2. What are the five listed purposes for facilitation payments?
  3. The facilitation payment exception is narrowly construed by both the courts and the Justice Department.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 549 no One Month to More Effective Written Standards: Day 13-Policies on Political Contributions The FCPA states, “The FCPA’s anti-bribery provisions apply to corrupt payments made to (1) “any foreign official”; (2) “any foreign political party or official thereof”; (3) “any candidate for foreign political office”; or (4) any person, while knowing that all or a portion of the payment will be offered, given, or promised to an individual falling within one of these three categories. Although the statute distinguishes between a “foreign official,” “foreign political party or official thereof,” and “candidate for foreign political office,” the term “foreign official” in this guide generally refers to an individual falling within any of these three categories.” Government policies affect the commercial environment. A company is subject to legislation and regulation that affects how it conducts its business and generates value for its investors. Participating in the political process is part of a business strategy to protect a company’s interests. Most international businesses have strategy to engage in the political process with a view to the long-term interests of the company and to promote and protect its interests. All political contributions and expenditures on behalf of the Company and management reports on these political contributions and expenditures should be reported to the Board of Directors annually. No political contributions may be made or promised unless written pre-approval has been obtained from the corporate compliance function Three key takeaways: Political candidates are covered by the FCPA. What is the business purpose for the contribution? Do not make contributions towards candidates who can award your company business. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 21 Sep 2023 04:00:00 -0000 Day 13-Policies on Political Contributions full Thomas Fox What are your policies on political donations? The FCPA states, “The FCPA’s anti-bribery provisions apply to corrupt payments made to (1) “any foreign official”; (2) “any foreign political party or official thereof”; (3) “any candidate for foreign political office”; or (4) any person, while knowing that all or a portion of the payment will be offered, given, or promised to an individual falling within one of these three categories. Although the statute distinguishes between a “foreign official,” “foreign political party or official thereof,” and “candidate for foreign political office,” the term “foreign official” in this guide generally refers to an individual falling within any of these three categories.” Government policies affect the commercial environment. A company is subject to legislation and regulation that affects how it conducts its business and generates value for its investors. Participating in the political process is part of a business strategy to protect a company’s interests. Most international businesses have strategy to engage in the political process with a view to the long-term interests of the company and to promote and protect its interests. All political contributions and expenditures on behalf of the Company and management reports on these political contributions and expenditures should be reported to the Board of Directors annually. No political contributions may be made or promised unless written pre-approval has been obtained from the corporate compliance function Three key takeaways: Political candidates are covered by the FCPA. What is the business purpose for the contribution? Do not make contributions towards candidates who can award your company business. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices The FCPA states, “The FCPA’s anti-bribery provisions apply to corrupt payments made to (1) “any foreign official”; (2) “any foreign political party or official thereof”; (3) “any candidate for foreign political office”; or (4) any person, while knowing that all or a portion of the payment will be offered, given, or promised to an individual falling within one of these three categories. Although the statute distinguishes between a “foreign official,” “foreign political party or official thereof,” and “candidate for foreign political office,” the term “foreign official” in this guide generally refers to an individual falling within any of these three categories.” Government policies affect the commercial environment. A company is subject to legislation and regulation that affects how it conducts its business and generates value for its investors. Participating in the political process is part of a business strategy to protect a company’s interests.

Most international businesses have strategy to engage in the political process with a view to the long-term interests of the company and to promote and protect its interests. All political contributions and expenditures on behalf of the Company and management reports on these political contributions and expenditures should be reported to the Board of Directors annually. No political contributions may be made or promised unless written pre-approval has been obtained from the corporate compliance function

Three key takeaways:

  1. Political candidates are covered by the FCPA.
  2. What is the business purpose for the contribution?
  3. Do not make contributions towards candidates who can award your company business.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 528 no One Month to More Effective Written Standards: Day 12-Policies on Charitable Donations What should your compliance policy and procedures on charitable donations look like? What should you prohibit or even caution against? The starting point is the 2012 FCPA Guidance regarding charitable donations. The information on the red flags from the Opinion Releases and the best practices, as set out in the 2020 FCPA Resource Guide, have been available for some time. From the Schering-Plough and Lilly enforcement actions, your policy should consider the timing of charitable donations to see if they are at or near the time of the awarding of new or continued business. Finally, in managing the relationship, you now need to look at overall increases in sales to determine if they are tied to a pattern of charitable donations. By looking at the timing and quantum of charitable donations, internal audit may be able to ascertain that a spike in sales is tied to corrupt conduct. Three key takeaways: 1.What are the basic inquiries to make around charitable donations? 2.Use all of the communication tools the DOJ has provided; written guidance, enforcement actions and Opinion Releases to inform your charitable donation policy. 3. Document, Document, and Document the basis of your charitable donations risk assessment. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 20 Sep 2023 04:00:00 -0000 Day 12-Policies and Procedures on Charitable Donations full Thomas Fox Today, polices on charitable donations. What should your compliance policy and procedures on charitable donations look like? What should you prohibit or even caution against? The starting point is the 2012 FCPA Guidance regarding charitable donations. The information on the red flags from the Opinion Releases and the best practices, as set out in the 2020 FCPA Resource Guide, have been available for some time. From the Schering-Plough and Lilly enforcement actions, your policy should consider the timing of charitable donations to see if they are at or near the time of the awarding of new or continued business. Finally, in managing the relationship, you now need to look at overall increases in sales to determine if they are tied to a pattern of charitable donations. By looking at the timing and quantum of charitable donations, internal audit may be able to ascertain that a spike in sales is tied to corrupt conduct. Three key takeaways: 1.What are the basic inquiries to make around charitable donations? 2.Use all of the communication tools the DOJ has provided; written guidance, enforcement actions and Opinion Releases to inform your charitable donation policy. 3. Document, Document, and Document the basis of your charitable donations risk assessment. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices What should your compliance policy and procedures on charitable donations look like? What should you prohibit or even caution against? The starting point is the 2012 FCPA Guidance regarding charitable donations. The information on the red flags from the Opinion Releases and the best practices, as set out in the 2020 FCPA Resource Guide, have been available for some time. From the Schering-Plough and Lilly enforcement actions, your policy should consider the timing of charitable donations to see if they are at or near the time of the awarding of new or continued business. Finally, in managing the relationship, you now need to look at overall increases in sales to determine if they are tied to a pattern of charitable donations. By looking at the timing and quantum of charitable donations, internal audit may be able to ascertain that a spike in sales is tied to corrupt conduct.

Three key takeaways:

1.What are the basic inquiries to make around charitable donations?

2.Use all of the communication tools the DOJ has provided; written guidance, enforcement actions and Opinion Releases to inform your charitable donation policy.

3. Document, Document, and Document the basis of your charitable donations risk assessment.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 529 no One Month to More Effective Written Standards: Day 11 - Charitable Donation Enforcement Actions When is a rose not a rose? When it is a charitable donation not made for philanthropic purposes and violates the FCPA. This was a feature of the Eli Lilly and Company (Lilly) FCPA enforcement action brought by the SEC in 2012, involving a bribery scheme utilized by Lilly in Poland. The scheme and FCPA violations mirrored an earlier FCPA enforcement action, also brought by the SEC as a civil matter, rather than by the DOJ as a criminal matter, against another U.S. entity Schering-Plough, for making charitable donations in Poland which violated the FCPA. One of the remarkable things about both of these enforcement actions, brought almost eight years apart, was that they involved improper payments to the same Polish charitable foundation to wrongfully influence the same Polish government official to purchase products from both of these companies. Three key takeaways: Every compliance practitioner should study both the Lilly and Schering-Plough enforcement actions. What is the purpose of the charitable entity you are making a donation to? “Document, Document, and Document” your due diligence around donors. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 19 Sep 2023 04:00:00 -0000 Day 11 - Charitable Donation Enforcement Actions full Thomas Fox When is a rose not a rose? When it is a charitable donation not made for philanthropic purposes and violates the FCPA. When is a rose not a rose? When it is a charitable donation not made for philanthropic purposes and violates the FCPA. This was a feature of the Eli Lilly and Company (Lilly) FCPA enforcement action brought by the SEC in 2012, involving a bribery scheme utilized by Lilly in Poland. The scheme and FCPA violations mirrored an earlier FCPA enforcement action, also brought by the SEC as a civil matter, rather than by the DOJ as a criminal matter, against another U.S. entity Schering-Plough, for making charitable donations in Poland which violated the FCPA. One of the remarkable things about both of these enforcement actions, brought almost eight years apart, was that they involved improper payments to the same Polish charitable foundation to wrongfully influence the same Polish government official to purchase products from both of these companies. Three key takeaways: Every compliance practitioner should study both the Lilly and Schering-Plough enforcement actions. What is the purpose of the charitable entity you are making a donation to? “Document, Document, and Document” your due diligence around donors. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices When is a rose not a rose? When it is a charitable donation not made for philanthropic purposes and violates the FCPA. This was a feature of the Eli Lilly and Company (Lilly) FCPA enforcement action brought by the SEC in 2012, involving a bribery scheme utilized by Lilly in Poland. The scheme and FCPA violations mirrored an earlier FCPA enforcement action, also brought by the SEC as a civil matter, rather than by the DOJ as a criminal matter, against another U.S. entity Schering-Plough, for making charitable donations in Poland which violated the FCPA. One of the remarkable things about both of these enforcement actions, brought almost eight years apart, was that they involved improper payments to the same Polish charitable foundation to wrongfully influence the same Polish government official to purchase products from both of these companies.

Three key takeaways:

  1. Every compliance practitioner should study both the Lilly and Schering-Plough enforcement actions.
  2. What is the purpose of the charitable entity you are making a donation to?
  3. “Document, Document, and Document” your due diligence around donors.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 553 no One Month to More Written Standards: Day 10 - Policies and procedures on gifts and business entertainment If one were to reflect upon the providing of gifts and business entertainment to foreign governmental officials, one might reasonably conclude that after 40 years of the FCPA, companies might follow its prescriptions regarding gifts and business entertainment. However, there have been some notable FCPA enforcement actions in this area. The 2020 FCPA Resource Guide clearly stated the FCPA does not ban gifts and entertainment. Indeed, it specified, “A small gift or token of esteem or gratitude is often an appropriate way for business people to display respect for each other. Some hallmarks of appropriate gift-giving are when the gift is given openly and transparently, properly recorded in the giver’s books and records, provided only to reflect esteem or gratitude, and permitted under local law. Items of nominal value, such as cab fare, reasonable meals and entertainment expenses, or company promotional items, are unlikely to improperly influence an official, and, as a result, are not, without more, items that have resulted in enforcement action by DOJ or SEC.” These guidelines must be coupled with active training of all personnel, not only on a company’s compliance policy, but also on the corporate and individual consequences that may arise if the FCPA is violated regarding gifts and business entertainment. Lastly, it is imperative that all such gifts and business entertainment be properly recorded, as required by the books and records component of the FCPA. And, as always, do not forget the gut check test. Three key takeaways: Gifts and business entertainment continue to plague companies for compliance violations. The key is not the amount but of having a policy and procedure and following it. Always remember to record gifts and business entertainment expenses correctly. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 18 Sep 2023 04:00:00 -0000 Day 10 - Policies and procedures on gifts and business entertainment full Thomas Fox What should be your policies around gifts and business entertainment? Find out in today's episode of 31 Days to More Written Standards. If one were to reflect upon the providing of gifts and business entertainment to foreign governmental officials, one might reasonably conclude that after 40 years of the FCPA, companies might follow its prescriptions regarding gifts and business entertainment. However, there have been some notable FCPA enforcement actions in this area. The 2020 FCPA Resource Guide clearly stated the FCPA does not ban gifts and entertainment. Indeed, it specified, “A small gift or token of esteem or gratitude is often an appropriate way for business people to display respect for each other. Some hallmarks of appropriate gift-giving are when the gift is given openly and transparently, properly recorded in the giver’s books and records, provided only to reflect esteem or gratitude, and permitted under local law. Items of nominal value, such as cab fare, reasonable meals and entertainment expenses, or company promotional items, are unlikely to improperly influence an official, and, as a result, are not, without more, items that have resulted in enforcement action by DOJ or SEC.” These guidelines must be coupled with active training of all personnel, not only on a company’s compliance policy, but also on the corporate and individual consequences that may arise if the FCPA is violated regarding gifts and business entertainment. Lastly, it is imperative that all such gifts and business entertainment be properly recorded, as required by the books and records component of the FCPA. And, as always, do not forget the gut check test. Three key takeaways: Gifts and business entertainment continue to plague companies for compliance violations. The key is not the amount but of having a policy and procedure and following it. Always remember to record gifts and business entertainment expenses correctly. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices If one were to reflect upon the providing of gifts and business entertainment to foreign governmental officials, one might reasonably conclude that after 40 years of the FCPA, companies might follow its prescriptions regarding gifts and business entertainment. However, there have been some notable FCPA enforcement actions in this area.

The 2020 FCPA Resource Guide clearly stated the FCPA does not ban gifts and entertainment. Indeed, it specified, “A small gift or token of esteem or gratitude is often an appropriate way for business people to display respect for each other. Some hallmarks of appropriate gift-giving are when the gift is given openly and transparently, properly recorded in the giver’s books and records, provided only to reflect esteem or gratitude, and permitted under local law. Items of nominal value, such as cab fare, reasonable meals and entertainment expenses, or company promotional items, are unlikely to improperly influence an official, and, as a result, are not, without more, items that have resulted in enforcement action by DOJ or SEC.”

These guidelines must be coupled with active training of all personnel, not only on a company’s compliance policy, but also on the corporate and individual consequences that may arise if the FCPA is violated regarding gifts and business entertainment. Lastly, it is imperative that all such gifts and business entertainment be properly recorded, as required by the books and records component of the FCPA.

And, as always, do not forget the gut check test.

Three key takeaways:

  1. Gifts and business entertainment continue to plague companies for compliance violations.
  2. The key is not the amount but of having a policy and procedure and following it.
  3. Always remember to record gifts and business entertainment expenses correctly.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no One Month to More Effective Written Standards: Day 9-Dynamic Compliance Policies One of the key changes coming out of the Covid-19 pandemic is the need for dynamism on corporate policies. This message was driven home in a  MIT Sloan Management Review article,“Turbulent Times Demand Dynamic Rules”. The authors believe, “Circumstances can change rapidly in an uncertain world — organizational rules should be designed to change along with them.” This concept is most appropriate in the compliance arena in the area of risk management. As your risks change, your management of those risks should adapt to the new reality. This is why the DOJ intoned in the 2023 Evaluation of Corporate Compliance Programs (ECCP) that you should assess your risks as they change, modify your risk protocols, monitor your risk management strategy and then update your compliance programs through continuous monitoring.  This dynamic policy process can build dynamic rules to enhance your company’s ability to anticipate and cope with risk changes. When the corporate compliance function embraces experimentation and learning in the creation and reformulation of policies, it builds flexibility into the organization’s structure, processes, and practices. This type of flexibility is essential as we have moved from disaster recovery to business resiliency to business as usual, especially in the field of risk management.  Three key takeaways: 1. After Covid-19, your policies must be as dynamic as your business. 2. There are three general areas to improve the dynamic features of policy creation and improvement; transparency, experimentation and innovation. 3. Garner feedback from your users on the effectiveness of your compliance policies. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 15 Sep 2023 04:00:00 -0000 Day 9-Dynamic Compliance Policies full Thomas Fox Today we look at dynamic compliance policies. One of the key changes coming out of the Covid-19 pandemic is the need for dynamism on corporate policies. This message was driven home in a  MIT Sloan Management Review article,“Turbulent Times Demand Dynamic Rules”. The authors believe, “Circumstances can change rapidly in an uncertain world — organizational rules should be designed to change along with them.” This concept is most appropriate in the compliance arena in the area of risk management. As your risks change, your management of those risks should adapt to the new reality. This is why the DOJ intoned in the 2023 Evaluation of Corporate Compliance Programs (ECCP) that you should assess your risks as they change, modify your risk protocols, monitor your risk management strategy and then update your compliance programs through continuous monitoring.  This dynamic policy process can build dynamic rules to enhance your company’s ability to anticipate and cope with risk changes. When the corporate compliance function embraces experimentation and learning in the creation and reformulation of policies, it builds flexibility into the organization’s structure, processes, and practices. This type of flexibility is essential as we have moved from disaster recovery to business resiliency to business as usual, especially in the field of risk management.  Three key takeaways: 1. After Covid-19, your policies must be as dynamic as your business. 2. There are three general areas to improve the dynamic features of policy creation and improvement; transparency, experimentation and innovation. 3. Garner feedback from your users on the effectiveness of your compliance policies. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the key changes coming out of the Covid-19 pandemic is the need for dynamism on corporate policies. This message was driven home in a  MIT Sloan Management Review article,“Turbulent Times Demand Dynamic Rules”. The authors believe, “Circumstances can change rapidly in an uncertain world — organizational rules should be designed to change along with them.”

This concept is most appropriate in the compliance arena in the area of risk management. As your risks change, your management of those risks should adapt to the new reality. This is why the DOJ intoned in the 2023 Evaluation of Corporate Compliance Programs (ECCP) that you should assess your risks as they change, modify your risk protocols, monitor your risk management strategy and then update your compliance programs through continuous monitoring. 

This dynamic policy process can build dynamic rules to enhance your company’s ability to anticipate and cope with risk changes. When the corporate compliance function embraces experimentation and learning in the creation and reformulation of policies, it builds flexibility into the organization’s structure, processes, and practices. This type of flexibility is essential as we have moved from disaster recovery to business resiliency to business as usual, especially in the field of risk management. 

Three key takeaways:

1. After Covid-19, your policies must be as dynamic as your business.

2. There are three general areas to improve the dynamic features of policy creation and improvement; transparency, experimentation and innovation.

3. Garner feedback from your users on the effectiveness of your compliance policies.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 534 no One Month to More Effective Written Standards: Day 8: Revising Your Policies and Procedures More than simply having a Code of Conduct, compliance policies and procedures are required. As former Assistant Attorney General Lanny Breuer articulated, “Your compliance program is a living entity; it should be constantly evolving.” The 2012 FCPA Guidance stated, “When assessing a compliance program, DOJ and SEC will review whether the company’s Guiding Principles of Enforcement have taken steps to ensure that the Code of Conduct remains current and effective and whether a company has periodically reviewed and updated its code.” After considering these issues, you should benchmark your current policies and procedures against those of other companies in your industry. If you decide to move forward, I suggest a process that can be fully documented to include revisions to your compliance policies and procedures. These points are a useful guide to not only thinking through how to determine if your policies and procedures need updating but also taking practical steps to tackle the problem. You should begin the process now if it has been more than five years since the last update. It is far better to review and update if appropriate than wait for a massive FCPA investigation to go through the process. Three key takeaways: You should do so now if you have not revised your compliance policies and procedures in the past five years. Set a timeline and budget and stick to it in the compliance policy and procedure revision process. Document your process of revision to demonstrate a more complete operationalization of your compliance program. Check out The Compliance Handbook, 4th edition, here for more information. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 14 Sep 2023 04:00:00 -0000 Revising your policies and procedures full Thomas Fox Today we look at revising your policies and procedures. More than simply having a Code of Conduct, compliance policies and procedures are required. As former Assistant Attorney General Lanny Breuer articulated, “Your compliance program is a living entity; it should be constantly evolving.” The 2012 FCPA Guidance stated, “When assessing a compliance program, DOJ and SEC will review whether the company’s Guiding Principles of Enforcement have taken steps to ensure that the Code of Conduct remains current and effective and whether a company has periodically reviewed and updated its code.” After considering these issues, you should benchmark your current policies and procedures against those of other companies in your industry. If you decide to move forward, I suggest a process that can be fully documented to include revisions to your compliance policies and procedures. These points are a useful guide to not only thinking through how to determine if your policies and procedures need updating but also taking practical steps to tackle the problem. You should begin the process now if it has been more than five years since the last update. It is far better to review and update if appropriate than wait for a massive FCPA investigation to go through the process. Three key takeaways: You should do so now if you have not revised your compliance policies and procedures in the past five years. Set a timeline and budget and stick to it in the compliance policy and procedure revision process. Document your process of revision to demonstrate a more complete operationalization of your compliance program. Check out The Compliance Handbook, 4th edition, here for more information. Learn more about your ad choices. Visit megaphone.fm/adchoices More than simply having a Code of Conduct, compliance policies and procedures are required. As former Assistant Attorney General Lanny Breuer articulated, “Your compliance program is a living entity; it should be constantly evolving.” The 2012 FCPA Guidance stated, “When assessing a compliance program, DOJ and SEC will review whether the company’s Guiding Principles of Enforcement have taken steps to ensure that the Code of Conduct remains current and effective and whether a company has periodically reviewed and updated its code.”

After considering these issues, you should benchmark your current policies and procedures against those of other companies in your industry. If you decide to move forward, I suggest a process that can be fully documented to include revisions to your compliance policies and procedures. These points are a useful guide to not only thinking through how to determine if your policies and procedures need updating but also taking practical steps to tackle the problem. You should begin the process now if it has been more than five years since the last update. It is far better to review and update if appropriate than wait for a massive FCPA investigation to go through the process.

Three key takeaways:

  1. You should do so now if you have not revised your compliance policies and procedures in the past five years.
  2. Set a timeline and budget and stick to it in the compliance policy and procedure revision process.
  3. Document your process of revision to demonstrate a more complete operationalization of your compliance program.


Check out The Compliance Handbook, 4th edition, here for more information.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 561 no One Month to More Effective Written Standards: Day 7 - Policies and Procedures There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2020 Update made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as part of its risk assessment process.” This statement made clear that the regulators will take a strong view against a company that does not have well-thought-out and articulated policies and procedures against bribery and corruption, which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital communication layer and acts as an internal control. Together with a signed acknowledgment, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to policies and procedures in anti-corruption compliance. The specific written policies and procedures required for a best practices compliance program are well-known and long-established. According to the 2020 FCPA Resources Guide 2nd edition, some of the risks companies should keep in mind include the nature and extent of transactions with foreign governments (including payments to foreign officials), use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments. Policies help form the basis of expectations for standards of conduct in your company. Procedures are the documents that implement these standards of conduct. Three key takeaways: 1. Written compliance policies and procedures, together with the Code of Conduct, form the backbone of your compliance program. 2. The DOJ and SEC expected well-thought-out and articulated compliance policies and procedures to be adequately communicated throughout your organization. 3. Institutional fairness for the application of policies and procedures demands the consistent application of your policies and procedures across the globe. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 13 Sep 2023 04:00:00 -0000 Day 7 - Policies and Procedures full Thomas Fox Today we consider policies and procedures. There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2020 Update made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as part of its risk assessment process.” This statement made clear that the regulators will take a strong view against a company that does not have well-thought-out and articulated policies and procedures against bribery and corruption, which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital communication layer and acts as an internal control. Together with a signed acknowledgment, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to policies and procedures in anti-corruption compliance. The specific written policies and procedures required for a best practices compliance program are well-known and long-established. According to the 2020 FCPA Resources Guide 2nd edition, some of the risks companies should keep in mind include the nature and extent of transactions with foreign governments (including payments to foreign officials), use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments. Policies help form the basis of expectations for standards of conduct in your company. Procedures are the documents that implement these standards of conduct. Three key takeaways: 1. Written compliance policies and procedures, together with the Code of Conduct, form the backbone of your compliance program. 2. The DOJ and SEC expected well-thought-out and articulated compliance policies and procedures to be adequately communicated throughout your organization. 3. Institutional fairness for the application of policies and procedures demands the consistent application of your policies and procedures across the globe. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2020 Update made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as part of its risk assessment process.”

This statement made clear that the regulators will take a strong view against a company that does not have well-thought-out and articulated policies and procedures against bribery and corruption, which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital communication layer and acts as an internal control. Together with a signed acknowledgment, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to policies and procedures in anti-corruption compliance.

The specific written policies and procedures required for a best practices compliance program are well-known and long-established. According to the 2020 FCPA Resources Guide 2nd edition, some of the risks companies should keep in mind include the nature and extent of transactions with foreign governments (including payments to foreign officials), use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments. Policies help form the basis of expectations for standards of conduct in your company. Procedures are the documents that implement these standards of conduct.

Three key takeaways:

1. Written compliance policies and procedures, together with the Code of Conduct, form the backbone of your compliance program.

2. The DOJ and SEC expected well-thought-out and articulated compliance policies and procedures to be adequately communicated throughout your organization.

3. Institutional fairness for the application of policies and procedures demands the consistent application of your policies and procedures across the globe.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 501 no One Month to More Effective Written Standards: Day 6 - Operationalization of your Code of Conduct How can you work to operationalize your Code of Conduct as articulated in the DOJ 2023 Evaluation of Corporate Compliance Programs (ECCP)? The 2023 ECCP focuses not on whether a company has a paper compliance program but whether a company is actually doing compliance. A company does compliance by moving it into the functional business units as a part of an overall business process. That is what makes a compliance program effective at the business level. There are several different parts of the 2023 ECCP that touch upon your Code of Conduct. The Code of Conduct design and implementation process enshrine your company’s values. Those are set by senior management and their input and support for any code project, whether initial draft or update, is critical. This gets to the heart of operationalization and demonstrates how a Code of Conduct can work to meet the DOJ requirements. As an early part of your design and drafting process, you should assemble a cross-functional team. This is important for several reasons. First, diversity in your team will help produce a more well-rounded final product. But having such team diversity will also assist in your benchmarking effort, coupled with those who are going to help you out looking at designs and maybe helping forge the design of the code. Finally, you can use a group to help in the drafting, redrafting and editing process. This diversity will help you to answer all of the DOJ questions from the 2023 ECCP in a manner consistent to support operationalization. All of these requirements point to getting out and making your Code of Conduct a part of the very fabric of your organization. By using some or all of these strategies, you will have a good starting point. But it is more than simply rollout and training. There must be ongoing communications as well. Three key takeaways: What has been the role of senior management in the creation or update of your Code of Conduct? How have you worked with employees outside the compliance function to lay the groundwork for fully operationalizing your Code of Conduct? How have you measured the effectiveness of your Code of Conduct training? For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 12 Sep 2023 04:00:00 -0000 Day 6 - Operationalization of your Code of Conduct full Thomas Fox Today we consider the operationalization of your Code of Conduct. How can you work to operationalize your Code of Conduct as articulated in the DOJ 2023 Evaluation of Corporate Compliance Programs (ECCP)? The 2023 ECCP focuses not on whether a company has a paper compliance program but whether a company is actually doing compliance. A company does compliance by moving it into the functional business units as a part of an overall business process. That is what makes a compliance program effective at the business level. There are several different parts of the 2023 ECCP that touch upon your Code of Conduct. The Code of Conduct design and implementation process enshrine your company’s values. Those are set by senior management and their input and support for any code project, whether initial draft or update, is critical. This gets to the heart of operationalization and demonstrates how a Code of Conduct can work to meet the DOJ requirements. As an early part of your design and drafting process, you should assemble a cross-functional team. This is important for several reasons. First, diversity in your team will help produce a more well-rounded final product. But having such team diversity will also assist in your benchmarking effort, coupled with those who are going to help you out looking at designs and maybe helping forge the design of the code. Finally, you can use a group to help in the drafting, redrafting and editing process. This diversity will help you to answer all of the DOJ questions from the 2023 ECCP in a manner consistent to support operationalization. All of these requirements point to getting out and making your Code of Conduct a part of the very fabric of your organization. By using some or all of these strategies, you will have a good starting point. But it is more than simply rollout and training. There must be ongoing communications as well. Three key takeaways: What has been the role of senior management in the creation or update of your Code of Conduct? How have you worked with employees outside the compliance function to lay the groundwork for fully operationalizing your Code of Conduct? How have you measured the effectiveness of your Code of Conduct training? For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices How can you work to operationalize your Code of Conduct as articulated in the DOJ 2023 Evaluation of Corporate Compliance Programs (ECCP)? The 2023 ECCP focuses not on whether a company has a paper compliance program but whether a company is actually doing compliance. A company does compliance by moving it into the functional business units as a part of an overall business process. That is what makes a compliance program effective at the business level. There are several different parts of the 2023 ECCP that touch upon your Code of Conduct.

The Code of Conduct design and implementation process enshrine your company’s values. Those are set by senior management and their input and support for any code project, whether initial draft or update, is critical. This gets to the heart of operationalization and demonstrates how a Code of Conduct can work to meet the DOJ requirements. As an early part of your design and drafting process, you should assemble a cross-functional team. This is important for several reasons. First, diversity in your team will help produce a more well-rounded final product. But having such team diversity will also assist in your benchmarking effort, coupled with those who are going to help you out looking at designs and maybe helping forge the design of the code. Finally, you can use a group to help in the drafting, redrafting and editing process. This diversity will help you to answer all of the DOJ questions from the 2023 ECCP in a manner consistent to support operationalization.

All of these requirements point to getting out and making your Code of Conduct a part of the very fabric of your organization. By using some or all of these strategies, you will have a good starting point. But it is more than simply rollout and training. There must be ongoing communications as well.

Three key takeaways:

  1. What has been the role of senior management in the creation or update of your Code of Conduct?
  2. How have you worked with employees outside the compliance function to lay the groundwork for fully operationalizing your Code of Conduct?
  3. How have you measured the effectiveness of your Code of Conduct training?

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 575 no One Month to More Effective Written Standards: Day 5 - Training on your Code of Conduct What about the training on your finalized Code of Conduct? While there have been criticisms of code training, if you consider training as one source of your 360-degrees of compliance communications, the rollout of a new or updated code can be an opportunity. This rollout fits directly into the concept of 360-degrees of compliance communications as rollout is part of both communications and engagement. The delivery of a Code of Conduct is a key element of its effectiveness. By allowing your employees and other stakeholders to engage and interact with the code, through live or interactive training, the effectiveness can be better monitored and measured. Beginning with the DOJ’s 2017 Evaluation and continuing into the 2019 Guidance, is the DOJ’s emphasis in the effectiveness of training. I think everyone would understand you do need to train but now the government’s talking to us about effective training. Begin with live training that can be held at the corporate headquarters with senior management and executive involvement. Many companies will videotape a message from the CEO to help celebrate the rollout. Then there is the opportunity for localized training that gives employees an opportunity to see, meet, and speak directly with a compliance officer, not an insignificant dynamic in the corporate environment. Such personal training also sends a strong message of commitment to the Code of Conduct. It gives employees the opportunity to interact with the compliance officer by asking questions which are relevant to markets and locations outside the corporate office, which can often provide employees with the opportunity to have confidential in-person discussions. However, your Code of Conduct training should be an extension of the way you communicate compliance in your organization. If it is divorced from your 360-degrees of compliance communications style, you may well be missing an opportunity to drive better understanding of the code and denigrate the effectiveness of the training. Whatever approach is used, one of the critical factors is the length of time of the training session. Although lawyers and ethics and compliance professionals can (sometimes) sit through a multi-hour Code of Conduct lesson, it is almost impossible to keep the attention of business and operations employees for such a length of time. The presentation and number of PowerPoint slides must be kept to a manageable length before the attendee’s eyes start to glaze over.  Three key takeaways: Consider a video message from your CEO to help roll out your Code of Conduct initiation or update. Tailor your Code of Conduct training to your workforce. Consider interactive and modular approaches to Code of Conduct training. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 11 Sep 2023 04:00:00 -0000 Day 5 - Training on your Code of Conduct full 5 Thomas Fox Today we look at training on your Code of Conduct What about the training on your finalized Code of Conduct? While there have been criticisms of code training, if you consider training as one source of your 360-degrees of compliance communications, the rollout of a new or updated code can be an opportunity. This rollout fits directly into the concept of 360-degrees of compliance communications as rollout is part of both communications and engagement. The delivery of a Code of Conduct is a key element of its effectiveness. By allowing your employees and other stakeholders to engage and interact with the code, through live or interactive training, the effectiveness can be better monitored and measured. Beginning with the DOJ’s 2017 Evaluation and continuing into the 2019 Guidance, is the DOJ’s emphasis in the effectiveness of training. I think everyone would understand you do need to train but now the government’s talking to us about effective training. Begin with live training that can be held at the corporate headquarters with senior management and executive involvement. Many companies will videotape a message from the CEO to help celebrate the rollout. Then there is the opportunity for localized training that gives employees an opportunity to see, meet, and speak directly with a compliance officer, not an insignificant dynamic in the corporate environment. Such personal training also sends a strong message of commitment to the Code of Conduct. It gives employees the opportunity to interact with the compliance officer by asking questions which are relevant to markets and locations outside the corporate office, which can often provide employees with the opportunity to have confidential in-person discussions. However, your Code of Conduct training should be an extension of the way you communicate compliance in your organization. If it is divorced from your 360-degrees of compliance communications style, you may well be missing an opportunity to drive better understanding of the code and denigrate the effectiveness of the training. Whatever approach is used, one of the critical factors is the length of time of the training session. Although lawyers and ethics and compliance professionals can (sometimes) sit through a multi-hour Code of Conduct lesson, it is almost impossible to keep the attention of business and operations employees for such a length of time. The presentation and number of PowerPoint slides must be kept to a manageable length before the attendee’s eyes start to glaze over.  Three key takeaways: Consider a video message from your CEO to help roll out your Code of Conduct initiation or update. Tailor your Code of Conduct training to your workforce. Consider interactive and modular approaches to Code of Conduct training. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices What about the training on your finalized Code of Conduct? While there have been criticisms of code training, if you consider training as one source of your 360-degrees of compliance communications, the rollout of a new or updated code can be an opportunity. This rollout fits directly into the concept of 360-degrees of compliance communications as rollout is part of both communications and engagement. The delivery of a Code of Conduct is a key element of its effectiveness. By allowing your employees and other stakeholders to engage and interact with the code, through live or interactive training, the effectiveness can be better monitored and measured.

Beginning with the DOJ’s 2017 Evaluation and continuing into the 2019 Guidance, is the DOJ’s emphasis in the effectiveness of training. I think everyone would understand you do need to train but now the government’s talking to us about effective training. Begin with live training that can be held at the corporate headquarters with senior management and executive involvement. Many companies will videotape a message from the CEO to help celebrate the rollout. Then there is the opportunity for localized training that gives employees an opportunity to see, meet, and speak directly with a compliance officer, not an insignificant dynamic in the corporate environment. Such personal training also sends a strong message of commitment to the Code of Conduct. It gives employees the opportunity to interact with the compliance officer by asking questions which are relevant to markets and locations outside the corporate office, which can often provide employees with the opportunity to have confidential in-person discussions.

However, your Code of Conduct training should be an extension of the way you communicate compliance in your organization. If it is divorced from your 360-degrees of compliance communications style, you may well be missing an opportunity to drive better understanding of the code and denigrate the effectiveness of the training. Whatever approach is used, one of the critical factors is the length of time of the training session. Although lawyers and ethics and compliance professionals can (sometimes) sit through a multi-hour Code of Conduct lesson, it is almost impossible to keep the attention of business and operations employees for such a length of time. The presentation and number of PowerPoint slides must be kept to a manageable length before the attendee’s eyes start to glaze over.

 Three key takeaways:

  1. Consider a video message from your CEO to help roll out your Code of Conduct initiation or update.
  2. Tailor your Code of Conduct training to your workforce.
  3. Consider interactive and modular approaches to Code of Conduct training.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no One Month to More Effective Written Standards: Day 4-Code of Conduct: Structure and format Next comes the evolution of the structure and format of a best practices Code of Conduct. Initially, my experience with this is that they were written by lawyers, largely for lawyers. This included ‘thou shalts’ and ‘thou shalt nots’ liberally sprinkled throughout a lengthy written document. This was what is now referred to as Code 1.0. The compliance community then evolved to Code 2.0, where the writing was less turgid, moved to more employee-friendly language, and then somewhere along the line we started putting in hyperlinks, pictures, and videos. There are two factors that a company should consider in the structure of a Code of Conduct. The first is to consider how your organization generally communicates, overlaid with the most effective way to communicate with the various stakeholders who will read and use it. These stakeholders can include such diverse groups as employees, shareholders, and third parties on both the sales and supply side of your business. This may require multiple approaches. Be sure to make your code readable. This is beyond simply eliminating legalese. It is writing English at a grade level that is sufficient for your employee population. It may be that an eighth-grade language level is appropriate for your workforce. However, if you have a population consisting primarily of professionals, translating it into the appropriate languages it might be appropriate to aim for a higher level of language. Finally, you do not have to say the same thing, in multiple different ways. Three key takeaways: Companies have moved past having a Code of Conduct written by lawyers for lawyers to a fully interactive code for all employees. Consider how information is distributed at your organization as a basis for communication in your Code of Conduct. Your Code of Conduct must be readable, in both in English and native language for non-English speaking employees. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 08 Sep 2023 04:00:00 -0000 Day 4-Code of Conduct: Structure and format full Thomas Fox Today we look at the structure and format of your Code of Conduct. Next comes the evolution of the structure and format of a best practices Code of Conduct. Initially, my experience with this is that they were written by lawyers, largely for lawyers. This included ‘thou shalts’ and ‘thou shalt nots’ liberally sprinkled throughout a lengthy written document. This was what is now referred to as Code 1.0. The compliance community then evolved to Code 2.0, where the writing was less turgid, moved to more employee-friendly language, and then somewhere along the line we started putting in hyperlinks, pictures, and videos. There are two factors that a company should consider in the structure of a Code of Conduct. The first is to consider how your organization generally communicates, overlaid with the most effective way to communicate with the various stakeholders who will read and use it. These stakeholders can include such diverse groups as employees, shareholders, and third parties on both the sales and supply side of your business. This may require multiple approaches. Be sure to make your code readable. This is beyond simply eliminating legalese. It is writing English at a grade level that is sufficient for your employee population. It may be that an eighth-grade language level is appropriate for your workforce. However, if you have a population consisting primarily of professionals, translating it into the appropriate languages it might be appropriate to aim for a higher level of language. Finally, you do not have to say the same thing, in multiple different ways. Three key takeaways: Companies have moved past having a Code of Conduct written by lawyers for lawyers to a fully interactive code for all employees. Consider how information is distributed at your organization as a basis for communication in your Code of Conduct. Your Code of Conduct must be readable, in both in English and native language for non-English speaking employees. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Next comes the evolution of the structure and format of a best practices Code of Conduct. Initially, my experience with this is that they were written by lawyers, largely for lawyers. This included ‘thou shalts’ and ‘thou shalt nots’ liberally sprinkled throughout a lengthy written document. This was what is now referred to as Code 1.0. The compliance community then evolved to Code 2.0, where the writing was less turgid, moved to more employee-friendly language, and then somewhere along the line we started putting in hyperlinks, pictures, and videos.

There are two factors that a company should consider in the structure of a Code of Conduct. The first is to consider how your organization generally communicates, overlaid with the most effective way to communicate with the various stakeholders who will read and use it. These stakeholders can include such diverse groups as employees, shareholders, and third parties on both the sales and supply side of your business. This may require multiple approaches.

Be sure to make your code readable. This is beyond simply eliminating legalese. It is writing English at a grade level that is sufficient for your employee population. It may be that an eighth-grade language level is appropriate for your workforce. However, if you have a population consisting primarily of professionals, translating it into the appropriate languages it might be appropriate to aim for a higher level of language. Finally, you do not have to say the same thing, in multiple different ways.

Three key takeaways:

  1. Companies have moved past having a Code of Conduct written by lawyers for lawyers to a fully interactive code for all employees.
  2. Consider how information is distributed at your organization as a basis for communication in your Code of Conduct.
  3. Your Code of Conduct must be readable, in both in English and native language for non-English speaking employees.


For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no One Month to More Effective Written Standards: Day 3-Code of Conduct What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in the regulator’s face during an enforcement action as proof of overall ethical behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal in creating your company’s Code of Conduct? Indeed violation of your Code of Conduct can form the basis of a domestic FCPA enforcement action. In an enforcement action involving United Airlines, Inc., a breach of the Code of Conduct by the Company CEO was determined to be an FCPA internal controls violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey. This public government entity has authority over, among other things, United’s operations at the company’s huge east coast hub in Newark, NJ. Your Code of Conduct should be tailored to your company’s culture, industry, and corporate identity. It should provide a mechanism by which employees trying to do the right thing in the compliance and business ethics arena can do so. The Code of Conduct can be used for employee review and evaluation. It should certainly be invoked if there is a violation. Your company’s disciplinary procedures must be stated in the Code. These would include all forms of disciplines, up to and including dismissal, for serious violations of the Code. Further, your company’s Code should emphasize it will comply with all applicable laws and regulations wherever it does business. The code must be written in plain English and translated into other languages so all applicable persons can understand it. Three key takeaways: 1 A Code of Conduct is a foundational document in any compliance regime. 2 The substance of your Code of Conduct should be tailored to the company’s culture, industry, and corporate identity. 3 “Document, Document, and Document” your training and communication efforts regarding your Code of Conduct. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 07 Sep 2023 04:00:00 -0000 Day 3-Code of Conduct full Thomas Fox Today we consider the Code of Conduct. What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in the regulator’s face during an enforcement action as proof of overall ethical behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal in creating your company’s Code of Conduct? Indeed violation of your Code of Conduct can form the basis of a domestic FCPA enforcement action. In an enforcement action involving United Airlines, Inc., a breach of the Code of Conduct by the Company CEO was determined to be an FCPA internal controls violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey. This public government entity has authority over, among other things, United’s operations at the company’s huge east coast hub in Newark, NJ. Your Code of Conduct should be tailored to your company’s culture, industry, and corporate identity. It should provide a mechanism by which employees trying to do the right thing in the compliance and business ethics arena can do so. The Code of Conduct can be used for employee review and evaluation. It should certainly be invoked if there is a violation. Your company’s disciplinary procedures must be stated in the Code. These would include all forms of disciplines, up to and including dismissal, for serious violations of the Code. Further, your company’s Code should emphasize it will comply with all applicable laws and regulations wherever it does business. The code must be written in plain English and translated into other languages so all applicable persons can understand it. Three key takeaways: 1 A Code of Conduct is a foundational document in any compliance regime. 2 The substance of your Code of Conduct should be tailored to the company’s culture, industry, and corporate identity. 3 “Document, Document, and Document” your training and communication efforts regarding your Code of Conduct. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in the regulator’s face during an enforcement action as proof of overall ethical behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal in creating your company’s Code of Conduct?

Indeed violation of your Code of Conduct can form the basis of a domestic FCPA enforcement action. In an enforcement action involving United Airlines, Inc., a breach of the Code of Conduct by the Company CEO was determined to be an FCPA internal controls violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey. This public government entity has authority over, among other things, United’s operations at the company’s huge east coast hub in Newark, NJ.

Your Code of Conduct should be tailored to your company’s culture, industry, and corporate identity. It should provide a mechanism by which employees trying to do the right thing in the compliance and business ethics arena can do so. The Code of Conduct can be used for employee review and evaluation. It should certainly be invoked if there is a violation. Your company’s disciplinary procedures must be stated in the Code. These would include all forms of disciplines, up to and including dismissal, for serious violations of the Code. Further, your company’s Code should emphasize it will comply with all applicable laws and regulations wherever it does business. The code must be written in plain English and translated into other languages so all applicable persons can understand it.

Three key takeaways:

1 A Code of Conduct is a foundational document in any compliance regime.

2 The substance of your Code of Conduct should be tailored to the company’s culture, industry, and corporate identity.

3 “Document, Document, and Document” your training and communication efforts regarding your Code of Conduct.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 529 no One Month to More Effective Written Standards: Day 2-Clearly Articulated Written Standards The written standard requirements have long been memorialized in the U.S. Sentencing Guidelines, which contain seven basic compliance elements that can be tailored to fit the needs and financial realities of any given organization. From these seven compliance elements, the DOJ has crafted its minimum best practices compliance program, which is now attached to every DPA and NPA issued. These requirements were incorporated into the 2012 FCPA Guidance and brought forward in the 2023 ECCP and FCPA Corporate Enforcement Policy. The U.S. Sentencing Guidelines assumes that every effective compliance and ethics program begins with a written standard of conduct; i.e., a Code of Conduct. Following your Code of Conduct is written policies and procedures required for a best practices compliance program are well- known and long established. The role of compliance policies is to provide guidance and to protect companies, despite an occasional hick-up. Policies provide a basic set of guidelines for employees to follow. They can include general do’s and don’ts, work process flows, specific issue guidelines. By establishing what is and is not acceptable compliance behavior, a company can mitigate the compliance risks posed by employees who might make foolish decisions or otherwise engage in unethical behavior. There are numerous reasons to put some serious work into your Code of Conduct, policies and procedures. They are certainly a first line of defense when the government comes knocking. This means the regulators will take a strong view against a company that does not have well thought out and articulated policies, procedures or Code of Conduct; all of which are systematically reviewed and updated. Written policies, signed by employees provide a vital layer of communication. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, Document” mantra applies just as strongly to this area of anti-corruption compliance. Three key takeaways: A Code of Conduct, together with policies and procedures, have long been recognized as cornerstones of a best practices compliance policy. Each level of written standards builds upon one another, so consider this integration step. The Fair Process Doctrine applies to your written standards. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 06 Sep 2023 11:05:49 -0000 Day 2-Clearly Articulated Written Standards full Thomas Fox What are clearly articulated written standards? Find out in this episode. The written standard requirements have long been memorialized in the U.S. Sentencing Guidelines, which contain seven basic compliance elements that can be tailored to fit the needs and financial realities of any given organization. From these seven compliance elements, the DOJ has crafted its minimum best practices compliance program, which is now attached to every DPA and NPA issued. These requirements were incorporated into the 2012 FCPA Guidance and brought forward in the 2023 ECCP and FCPA Corporate Enforcement Policy. The U.S. Sentencing Guidelines assumes that every effective compliance and ethics program begins with a written standard of conduct; i.e., a Code of Conduct. Following your Code of Conduct is written policies and procedures required for a best practices compliance program are well- known and long established. The role of compliance policies is to provide guidance and to protect companies, despite an occasional hick-up. Policies provide a basic set of guidelines for employees to follow. They can include general do’s and don’ts, work process flows, specific issue guidelines. By establishing what is and is not acceptable compliance behavior, a company can mitigate the compliance risks posed by employees who might make foolish decisions or otherwise engage in unethical behavior. There are numerous reasons to put some serious work into your Code of Conduct, policies and procedures. They are certainly a first line of defense when the government comes knocking. This means the regulators will take a strong view against a company that does not have well thought out and articulated policies, procedures or Code of Conduct; all of which are systematically reviewed and updated. Written policies, signed by employees provide a vital layer of communication. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, Document” mantra applies just as strongly to this area of anti-corruption compliance. Three key takeaways: A Code of Conduct, together with policies and procedures, have long been recognized as cornerstones of a best practices compliance policy. Each level of written standards builds upon one another, so consider this integration step. The Fair Process Doctrine applies to your written standards. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices The written standard requirements have long been memorialized in the U.S. Sentencing Guidelines, which contain seven basic compliance elements that can be tailored to fit the needs and financial realities of any given organization. From these seven compliance elements, the DOJ has crafted its minimum best practices compliance program, which is now attached to every DPA and NPA issued. These requirements were incorporated into the 2012 FCPA Guidance and brought forward in the 2023 ECCP and FCPA Corporate Enforcement Policy. The U.S. Sentencing Guidelines assumes that every effective compliance and ethics program begins with a written standard of conduct; i.e., a Code of Conduct.

Following your Code of Conduct is written policies and procedures required for a best practices compliance program are well- known and long established. The role of compliance policies is to provide guidance and to protect companies, despite an occasional hick-up. Policies provide a basic set of guidelines for employees to follow. They can include general do’s and don’ts, work process flows, specific issue guidelines. By establishing what is and is not acceptable compliance behavior, a company can mitigate the compliance risks posed by employees who might make foolish decisions or otherwise engage in unethical behavior.

There are numerous reasons to put some serious work into your Code of Conduct, policies and procedures. They are certainly a first line of defense when the government comes knocking. This means the regulators will take a strong view against a company that does not have well thought out and articulated policies, procedures or Code of Conduct; all of which are systematically reviewed and updated. Written policies, signed by employees provide a vital layer of communication. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, Document” mantra applies just as strongly to this area of anti-corruption compliance.

Three key takeaways:

  1. A Code of Conduct, together with policies and procedures, have long been recognized as cornerstones of a best practices compliance policy.
  2. Each level of written standards builds upon one another, so consider this integration step.
  3. The Fair Process Doctrine applies to your written standards.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 544 no One Month to More Effective Written Standards: Day 1 - Introduction to Written Standards Welcome to the September edition of One Month to a More Effective Compliance Program. In this month, we will consider written standards. his month we're going to be taking up written standards so codes of Conduct training on your Codes of Conduct policies and procedures. Then we're going to take a deep dive into some specific policies that you should have in your compliance program. This is really the nuts and bolts of compliance, and you'll get a lot out of this month. In this first edition, we're going to introduce written standards. Effective communication of policies and procedures for compliance is a critical aspect of any successful organization. It is the backbone of a robust Code of Conduct, which serves as a written representation of a company's ethical principles. Tom Fox, a renowned expert in the field, offers unique insights into this topic. He emphasizes the importance of written standards, including codes of conduct, policies, and procedures, as the cornerstone of any best practices compliance program. Fox's perspective is informed by the Department of Justice's Evaluation of Corporate Compliance Programs, which provides a framework for companies to assess the effectiveness of their policies and procedures. He underscores the need for comprehensive, accessible, and well-communicated written protocols to prevent, detect, and remediate compliance issues. Join Tom Fox on this episode of the 31 Days to a More Effective Compliance Program podcast to delve deeper into this crucial topic. Three key takeaways:  The cornerstone of any best practices compliance program is its written protocols. Written standards work to prevent, detect and remediate. What are the specific written protocols you should have in your compliance program? For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 05 Sep 2023 04:00:00 -0000 Day 1 - Introduction to Written Standards full Thomas Fox In the month of September, we take up written standards. Welcome to the September edition of One Month to a More Effective Compliance Program. In this month, we will consider written standards. his month we're going to be taking up written standards so codes of Conduct training on your Codes of Conduct policies and procedures. Then we're going to take a deep dive into some specific policies that you should have in your compliance program. This is really the nuts and bolts of compliance, and you'll get a lot out of this month. In this first edition, we're going to introduce written standards. Effective communication of policies and procedures for compliance is a critical aspect of any successful organization. It is the backbone of a robust Code of Conduct, which serves as a written representation of a company's ethical principles. Tom Fox, a renowned expert in the field, offers unique insights into this topic. He emphasizes the importance of written standards, including codes of conduct, policies, and procedures, as the cornerstone of any best practices compliance program. Fox's perspective is informed by the Department of Justice's Evaluation of Corporate Compliance Programs, which provides a framework for companies to assess the effectiveness of their policies and procedures. He underscores the need for comprehensive, accessible, and well-communicated written protocols to prevent, detect, and remediate compliance issues. Join Tom Fox on this episode of the 31 Days to a More Effective Compliance Program podcast to delve deeper into this crucial topic. Three key takeaways:  The cornerstone of any best practices compliance program is its written protocols. Written standards work to prevent, detect and remediate. What are the specific written protocols you should have in your compliance program? For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to the September edition of One Month to a More Effective Compliance Program. In this month, we will consider written standards. his month we're going to be taking up written standards so codes of Conduct training on your Codes of Conduct policies and procedures. Then we're going to take a deep dive into some specific policies that you should have in your compliance program. This is really the nuts and bolts of compliance, and you'll get a lot out of this month. In this first edition, we're going to introduce written standards.

Effective communication of policies and procedures for compliance is a critical aspect of any successful organization. It is the backbone of a robust Code of Conduct, which serves as a written representation of a company's ethical principles. Tom Fox, a renowned expert in the field, offers unique insights into this topic. He emphasizes the importance of written standards, including codes of conduct, policies, and procedures, as the cornerstone of any best practices compliance program. Fox's perspective is informed by the Department of Justice's Evaluation of Corporate Compliance Programs, which provides a framework for companies to assess the effectiveness of their policies and procedures. He underscores the need for comprehensive, accessible, and well-communicated written protocols to prevent, detect, and remediate compliance issues. Join Tom Fox on this episode of the 31 Days to a More Effective Compliance Program podcast to delve deeper into this crucial topic.

Three key takeaways: 

  1. The cornerstone of any best practices compliance program is its written protocols.
  2. Written standards work to prevent, detect and remediate.
  3. What are the specific written protocols you should have in your compliance program?


For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 482 no One Month to a More Effective Compliance Program: Day 21 - Ten Compliance Questions To Pose To HR As we end this month on the intersection of HR and compliance, I have developed a series of goals and objectives which you might want to use as a starting point for operationalizing your compliance initiatives through your corporate HR function. How are compliance goals cascaded down to individual workers? Does anyone complain that your compliance targets are too complex? How do you deal with repeated compliance failures in a specific business segment or compliance program area? How does your company show that attracting and developing talent who will engage in ethical business conduct is a top priority? How long is compliance underperforming tolerated? What makes it distinctive to work at your company? How do compliance programs that are not working typically get exposed and remediated? What key compliance indicators do you use for compliance tracking? For a given compliance problem, how do you identify the root cause? What are you doing to retain your top employees from the compliance perspective? Compliance practitioners continually face the challenge of keeping up with the ever-evolving compliance best practices with little or no budget increase. By asking yourself and of your compliance program these questions you may create a road map to more fully operationalize your compliance regime. Three key takeaways: What are the unique compliance targets you have set and how interconnected are they to your business unit goals? Use a root cause analysis to determine why compliance initiatives are not successful. Retraining employees in compliance is an under-utilized tool. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 29 Aug 2023 04:00:00 -0000 Day 21 - Ten Compliance Questions To Pose To HR full 21 Thomas Fox Today we conclude this month's series on 31 Days with ten compliance questions to pose to HR. As we end this month on the intersection of HR and compliance, I have developed a series of goals and objectives which you might want to use as a starting point for operationalizing your compliance initiatives through your corporate HR function. How are compliance goals cascaded down to individual workers? Does anyone complain that your compliance targets are too complex? How do you deal with repeated compliance failures in a specific business segment or compliance program area? How does your company show that attracting and developing talent who will engage in ethical business conduct is a top priority? How long is compliance underperforming tolerated? What makes it distinctive to work at your company? How do compliance programs that are not working typically get exposed and remediated? What key compliance indicators do you use for compliance tracking? For a given compliance problem, how do you identify the root cause? What are you doing to retain your top employees from the compliance perspective? Compliance practitioners continually face the challenge of keeping up with the ever-evolving compliance best practices with little or no budget increase. By asking yourself and of your compliance program these questions you may create a road map to more fully operationalize your compliance regime. Three key takeaways: What are the unique compliance targets you have set and how interconnected are they to your business unit goals? Use a root cause analysis to determine why compliance initiatives are not successful. Retraining employees in compliance is an under-utilized tool. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices As we end this month on the intersection of HR and compliance, I have developed a series of goals and objectives which you might want to use as a starting point for operationalizing your compliance initiatives through your corporate HR function.

  1. How are compliance goals cascaded down to individual workers?
  2. Does anyone complain that your compliance targets are too complex?
  3. How do you deal with repeated compliance failures in a specific business segment or compliance program area?
  4. How does your company show that attracting and developing talent who will engage in ethical business conduct is a top priority?
  5. How long is compliance underperforming tolerated?
  6. What makes it distinctive to work at your company?
  7. How do compliance programs that are not working typically get exposed and remediated?
  8. What key compliance indicators do you use for compliance tracking?
  9. For a given compliance problem, how do you identify the root cause?
  10. What are you doing to retain your top employees from the compliance perspective?

Compliance practitioners continually face the challenge of keeping up with the ever-evolving compliance best practices with little or no budget increase. By asking yourself and of your compliance program these questions you may create a road map to more fully operationalize your compliance regime.

Three key takeaways:

  1. What are the unique compliance targets you have set and how interconnected are they to your business unit goals?
  2. Use a root cause analysis to determine why compliance initiatives are not successful.
  3. Retraining employees in compliance is an under-utilized tool.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 565 no One Month to a More Effective Compliance Program: Day 20-Gap Analysis for HR Join Tom Fox in this episode of the 31 Days to a More Effective Compliance Program podcast to delve deeper into the significant role of HR in implementing compliance programs. Hopefully you now understand that many of the traditional functions of Human Resources (HR) can be seen as compliance internal controls. At every touchpoint in the lifecycle of the employment relationship there is a HR touchpoint. Fulfilling those touchpoints can be controls for compliance. If you think of multiple HR functions as compliance internal controls, one of the questions becomes how can you determine if HR is meeting the standards of a best practices compliance program? One place to start is with a gap analysis to determine what HR has in place that can facilitate your company’s compliance program. The role of HR in implementing compliance programs is a critical aspect of maintaining best practices within an organization. Traditional HR functions can serve as compliance internal controls, and that every touch point in the employment relationship can serve as a control for compliance. Fox's insights are derived from his extensive experience and deep understanding of the compliance and HR environment. He emphasizes the importance of conducting a comprehensive gap analysis and fostering collaboration between HR and business units to enhance the compliance program. Finally, work with HR to create a consolidated Human Resources Compliance Audit Checklist that can be used to audit (and document) the company’s HR Compliance Program. The key to compliance, in my opinion, is having the proper structure to identify the issues, implement policies and procedures to address the issues, audit for compliance and “Document, Document, and Document”.  Three key takeaways: A gap analysis is a key component in the risk assessment process. The ultimate responsibility should lie with the business units and functional discipline to fully operationalize compliance. The role of the compliance department is to oversee, provide subject matter expertise and coordinate.   For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 28 Aug 2023 04:00:00 -0000 Day 20-Gap Analysis for HR full 20 Thomas Fox Today we discuss why you need to perform a gap analysis for HR. Join Tom Fox in this episode of the 31 Days to a More Effective Compliance Program podcast to delve deeper into the significant role of HR in implementing compliance programs. Hopefully you now understand that many of the traditional functions of Human Resources (HR) can be seen as compliance internal controls. At every touchpoint in the lifecycle of the employment relationship there is a HR touchpoint. Fulfilling those touchpoints can be controls for compliance. If you think of multiple HR functions as compliance internal controls, one of the questions becomes how can you determine if HR is meeting the standards of a best practices compliance program? One place to start is with a gap analysis to determine what HR has in place that can facilitate your company’s compliance program. The role of HR in implementing compliance programs is a critical aspect of maintaining best practices within an organization. Traditional HR functions can serve as compliance internal controls, and that every touch point in the employment relationship can serve as a control for compliance. Fox's insights are derived from his extensive experience and deep understanding of the compliance and HR environment. He emphasizes the importance of conducting a comprehensive gap analysis and fostering collaboration between HR and business units to enhance the compliance program. Finally, work with HR to create a consolidated Human Resources Compliance Audit Checklist that can be used to audit (and document) the company’s HR Compliance Program. The key to compliance, in my opinion, is having the proper structure to identify the issues, implement policies and procedures to address the issues, audit for compliance and “Document, Document, and Document”.  Three key takeaways: A gap analysis is a key component in the risk assessment process. The ultimate responsibility should lie with the business units and functional discipline to fully operationalize compliance. The role of the compliance department is to oversee, provide subject matter expertise and coordinate.   For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Join Tom Fox in this episode of the 31 Days to a More Effective Compliance Program podcast to delve deeper into the significant role of HR in implementing compliance programs. Hopefully you now understand that many of the traditional functions of Human Resources (HR) can be seen as compliance internal controls. At every touchpoint in the lifecycle of the employment relationship there is a HR touchpoint. Fulfilling those touchpoints can be controls for compliance. If you think of multiple HR functions as compliance internal controls, one of the questions becomes how can you determine if HR is meeting the standards of a best practices compliance program? One place to start is with a gap analysis to determine what HR has in place that can facilitate your company’s compliance program.

The role of HR in implementing compliance programs is a critical aspect of maintaining best practices within an organization. Traditional HR functions can serve as compliance internal controls, and that every touch point in the employment relationship can serve as a control for compliance. Fox's insights are derived from his extensive experience and deep understanding of the compliance and HR environment. He emphasizes the importance of conducting a comprehensive gap analysis and fostering collaboration between HR and business units to enhance the compliance program.

Finally, work with HR to create a consolidated Human Resources Compliance Audit Checklist that can be used to audit (and document) the company’s HR Compliance Program. The key to compliance, in my opinion, is having the proper structure to identify the issues, implement policies and procedures to address the issues, audit for compliance and “Document, Document, and Document”.

 Three key takeaways:

  1. A gap analysis is a key component in the risk assessment process.
  2. The ultimate responsibility should lie with the business units and functional discipline to fully operationalize compliance.
  3. The role of the compliance department is to oversee, provide subject matter expertise and coordinate.

 

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 153 no One Month to a More Effective Compliance Program: Day 19 - Compliance Culture At The Bottom One of the most important focuses of the DOJ’s 2023 ECCP was around culture. This means how far has the culture of compliance been driven down into an organization. The 2019 Guidance posed the following: Culture of Compliance – How often and how does the company measure its culture of compliance? Does the company seek input from all levels of employees to determine whether they perceive senior and middle management’s commitment to compliance? What steps has the company taken in response to its measurement of the compliance culture? These questions point to a CCO or compliance practitioner demonstrating how a culture of compliance is being burned into the very fabric of an organization. While leadership at and from the top has long been considered by both the DOJ and compliance professionals as a key element to move compliance forward, the 2019 Evaluation has also crystalized thinking around compliance culture throughout the organization, including at the bottom Too often, strategies to move a compliance program or even an initiative come from the top of an organization and are pushed down. To fully operationalize compliance, you must have leadership in compliance further down the organization which (hopefully) has been a part of the design process and can lead the implementation throughout an organization. Three key takeaways: While tone at the top is critical, the tone at the bottom can work to more fully operationalize compliance. 95% of the work is done at this bottom level. Use HR to come up with a strategy to move compliance into the bottom for more complete operationalization. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 25 Aug 2023 13:23:00 -0000 Day 19 - Compliance Culture At The Bottom full 19 Thomas Fox Today we look at moving compliance culture to the bottom of your organization. One of the most important focuses of the DOJ’s 2023 ECCP was around culture. This means how far has the culture of compliance been driven down into an organization. The 2019 Guidance posed the following: Culture of Compliance – How often and how does the company measure its culture of compliance? Does the company seek input from all levels of employees to determine whether they perceive senior and middle management’s commitment to compliance? What steps has the company taken in response to its measurement of the compliance culture? These questions point to a CCO or compliance practitioner demonstrating how a culture of compliance is being burned into the very fabric of an organization. While leadership at and from the top has long been considered by both the DOJ and compliance professionals as a key element to move compliance forward, the 2019 Evaluation has also crystalized thinking around compliance culture throughout the organization, including at the bottom Too often, strategies to move a compliance program or even an initiative come from the top of an organization and are pushed down. To fully operationalize compliance, you must have leadership in compliance further down the organization which (hopefully) has been a part of the design process and can lead the implementation throughout an organization. Three key takeaways: While tone at the top is critical, the tone at the bottom can work to more fully operationalize compliance. 95% of the work is done at this bottom level. Use HR to come up with a strategy to move compliance into the bottom for more complete operationalization. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the most important focuses of the DOJ’s 2023 ECCP was around culture. This means how far has the culture of compliance been driven down into an organization. The 2019 Guidance posed the following:

Culture of Compliance – How often and how does the company measure its culture of compliance? Does the company seek input from all levels of employees to determine whether they perceive senior and middle management’s commitment to compliance? What steps has the company taken in response to its measurement of the compliance culture?

These questions point to a CCO or compliance practitioner demonstrating how a culture of compliance is being burned into the very fabric of an organization. While leadership at and from the top has long been considered by both the DOJ and compliance professionals as a key element to move compliance forward, the 2019 Evaluation has also crystalized thinking around compliance culture throughout the organization, including at the bottom

Too often, strategies to move a compliance program or even an initiative come from the top of an organization and are pushed down. To fully operationalize compliance, you must have leadership in compliance further down the organization which (hopefully) has been a part of the design process and can lead the implementation throughout an organization.

Three key takeaways:

  1. While tone at the top is critical, the tone at the bottom can work to more fully operationalize compliance.
  2. 95% of the work is done at this bottom level.
  3. Use HR to come up with a strategy to move compliance into the bottom for more complete operationalization.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 554 no One Month to a More Effective Compliance Program: Day 18 - Operationalizing Compliance in the Middle The DOJ has clarified that middle management is critical to any compliance program’s success. While it does all start at the top, with the Board of Directors and senior executives setting the tone for the rest of the company, prosecutors are mandated, under the 2023 Evaluation of Corporate Compliance Programs (ECCP), to show how middle management, in turn, has reinforced those standards and encouraged employees to abide by them. Moreover, the ECCP posed several questions to middle management, including the following: What actions have middle-management stakeholders taken to demonstrate their commitment to compliance or compliance personnel, including their remediation efforts? Have they persisted in that commitment in the face of competing interests or business objectives? The DOJ expects compliance to be operationalized down to the middle management level. Further experience has shown that employees prefer to speak to their direct supervisors about issues or potential compliance violations they become aware of. The question is: how can a corporate compliance function reach middle management? This is a key area of assistance that Human Resources can provide, as one of the ways that HR can help to operationalize compliance is to assist each level of an organization to have a proper tone, specifically the middle of an organization. You must think about your communication lines and communication skills when conveying your message of compliance from the top into the middle of your organization. Three key takeaways: While the tone at the top is critical, the tone in the middle can work more fully to operationalize compliance. How do you train middle managers? What compliance tool kit do you provide to middle managers? For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 24 Aug 2023 04:00:00 -0000 Day 18 - Operationalizing Compliance in the Middle full 18 Thomas Fox In this episode, we look at tone in the middle. The DOJ has clarified that middle management is critical to any compliance program’s success. While it does all start at the top, with the Board of Directors and senior executives setting the tone for the rest of the company, prosecutors are mandated, under the 2023 Evaluation of Corporate Compliance Programs (ECCP), to show how middle management, in turn, has reinforced those standards and encouraged employees to abide by them. Moreover, the ECCP posed several questions to middle management, including the following: What actions have middle-management stakeholders taken to demonstrate their commitment to compliance or compliance personnel, including their remediation efforts? Have they persisted in that commitment in the face of competing interests or business objectives? The DOJ expects compliance to be operationalized down to the middle management level. Further experience has shown that employees prefer to speak to their direct supervisors about issues or potential compliance violations they become aware of. The question is: how can a corporate compliance function reach middle management? This is a key area of assistance that Human Resources can provide, as one of the ways that HR can help to operationalize compliance is to assist each level of an organization to have a proper tone, specifically the middle of an organization. You must think about your communication lines and communication skills when conveying your message of compliance from the top into the middle of your organization. Three key takeaways: While the tone at the top is critical, the tone in the middle can work more fully to operationalize compliance. How do you train middle managers? What compliance tool kit do you provide to middle managers? For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices The DOJ has clarified that middle management is critical to any compliance program’s success. While it does all start at the top, with the Board of Directors and senior executives setting the tone for the rest of the company, prosecutors are mandated, under the 2023 Evaluation of Corporate Compliance Programs (ECCP), to show how middle management, in turn, has reinforced those standards and encouraged employees to abide by them. Moreover, the ECCP posed several questions to middle management, including the following: What actions have middle-management stakeholders taken to demonstrate their commitment to compliance or compliance personnel, including their remediation efforts? Have they persisted in that commitment in the face of competing interests or business objectives?

The DOJ expects compliance to be operationalized down to the middle management level. Further experience has shown that employees prefer to speak to their direct supervisors about issues or potential compliance violations they become aware of. The question is: how can a corporate compliance function reach middle management? This is a key area of assistance that Human Resources can provide, as one of the ways that HR can help to operationalize compliance is to assist each level of an organization to have a proper tone, specifically the middle of an organization.

You must think about your communication lines and communication skills when conveying your message of compliance from the top into the middle of your organization.

Three key takeaways:

  1. While the tone at the top is critical, the tone in the middle can work more fully to operationalize compliance.
  2. How do you train middle managers?
  3. What compliance tool kit do you provide to middle managers?


For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 148 no One Month to a More Effective Compliance Program: Day 17 – Promotions to Operationalize Compliance Welcome back as we dive into the role of HR in compliance and ethics. Today, we will explore the significant role of HR in operationalizing compliance within organizations. Join us as we uncover practical advice and data-driven insights on how HR can promote ethical behavior and create effective internal controls. According to the Department of Justice, promotions demonstrate a company’s commitment to compliance and ethics. By using advertisements to reinforce these values, organizations can showcase their dedication to fostering a culture of integrity and accountability. The role of HR in corporate compliance programs should be more recognized. Suppose your company has a culture where compliance is perceived to compete or, worse yet, antithetical to HR. In that case, the company must hit all cylinders and may be moving towards dysfunction. Another way you can operationalize compliance is through HR’s involvement in employee promotion. Such compliance embedded into the promotion process can also be considered an internal compliance control. By doing so, your compliance may work to create an effective internal controls regime as mandated by the FCPA and other anti-corruption laws. Three key takeaways: Denying a promotion or award due to an employee’s ethical lapses. Use promotions to reinforce your company’s commitment to compliance and ethics. Should you wait for great? For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 23 Aug 2023 04:00:00 -0000 Day 17 – Promotions to Operationalize Compliance full Thomas Fox Today we consider using promotions to help operationalize compliance programs. Welcome back as we dive into the role of HR in compliance and ethics. Today, we will explore the significant role of HR in operationalizing compliance within organizations. Join us as we uncover practical advice and data-driven insights on how HR can promote ethical behavior and create effective internal controls. According to the Department of Justice, promotions demonstrate a company’s commitment to compliance and ethics. By using advertisements to reinforce these values, organizations can showcase their dedication to fostering a culture of integrity and accountability. The role of HR in corporate compliance programs should be more recognized. Suppose your company has a culture where compliance is perceived to compete or, worse yet, antithetical to HR. In that case, the company must hit all cylinders and may be moving towards dysfunction. Another way you can operationalize compliance is through HR’s involvement in employee promotion. Such compliance embedded into the promotion process can also be considered an internal compliance control. By doing so, your compliance may work to create an effective internal controls regime as mandated by the FCPA and other anti-corruption laws. Three key takeaways: Denying a promotion or award due to an employee’s ethical lapses. Use promotions to reinforce your company’s commitment to compliance and ethics. Should you wait for great? For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome back as we dive into the role of HR in compliance and ethics. Today, we will explore the significant role of HR in operationalizing compliance within organizations. Join us as we uncover practical advice and data-driven insights on how HR can promote ethical behavior and create effective internal controls. According to the Department of Justice, promotions demonstrate a company’s commitment to compliance and ethics. By using advertisements to reinforce these values, organizations can showcase their dedication to fostering a culture of integrity and accountability.

The role of HR in corporate compliance programs should be more recognized. Suppose your company has a culture where compliance is perceived to compete or, worse yet, antithetical to HR. In that case, the company must hit all cylinders and may be moving towards dysfunction. Another way you can operationalize compliance is through HR’s involvement in employee promotion. Such compliance embedded into the promotion process can also be considered an internal compliance control. By doing so, your compliance may work to create an effective internal controls regime as mandated by the FCPA and other anti-corruption laws.

Three key takeaways:

  1. Denying a promotion or award due to an employee’s ethical lapses.
  2. Use promotions to reinforce your company’s commitment to compliance and ethics.
  3. Should you wait for great?


For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 552 One Month to a More Effective Compliance Program: Day 16 - The Exit Interview  Today, we're diving into the significance of exit interviews in fully operationalizing a best practices compliance program. Exit interviews provide a valuable opportunity to gather unfiltered insights from departing employees, allowing organizations to enhance motivation, efficiency, and effectiveness. In this blog post, we'll explore the practical benefits of conducting exit interviews and how they can transform departing employees into lifelong advocates for your organization. The exit interview can be a further mechanism to operationalize compliance. This type of interview is used when someone voluntarily departs from a company, as opposed to a lay-off or reduction in force exercise. Typically departing employees are more willing to share about their experiences, concerns and issues which led to their employment departure. Exit interviews are a powerful tool for fully operationalizing a best practices compliance program. They provide organizations with invaluable insights into employee perceptions, job design, and culture. By treating departing employees with dignity and respect, organizations can transform them into lifelong advocates, defending the organization's reputation and recommending it to potential employees. Compliance ambassadors play a crucial role in strengthening compliance efforts, providing additional resources and support in regulatory issues. By asking detailed questions and fostering collaboration between compliance and HR, organizations can harness the power of exit interviews to enhance motivation, efficiency, and effectiveness in their compliance programs. Three key takeaways: The exit interview is an excellent opportunity to obtain information to inform your compliance program. Use the exit interview to create advocates from departing employees. Use the exit interview for probing and insightful questions around compliance. For more information, check out The Compliance Handbook, 4th edition here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 22 Aug 2023 04:00:00 -0000 Day 16 - The Exit Interview full 16 Thomas Fox Today we consider how compliance can use the exit interview.  Today, we're diving into the significance of exit interviews in fully operationalizing a best practices compliance program. Exit interviews provide a valuable opportunity to gather unfiltered insights from departing employees, allowing organizations to enhance motivation, efficiency, and effectiveness. In this blog post, we'll explore the practical benefits of conducting exit interviews and how they can transform departing employees into lifelong advocates for your organization. The exit interview can be a further mechanism to operationalize compliance. This type of interview is used when someone voluntarily departs from a company, as opposed to a lay-off or reduction in force exercise. Typically departing employees are more willing to share about their experiences, concerns and issues which led to their employment departure. Exit interviews are a powerful tool for fully operationalizing a best practices compliance program. They provide organizations with invaluable insights into employee perceptions, job design, and culture. By treating departing employees with dignity and respect, organizations can transform them into lifelong advocates, defending the organization's reputation and recommending it to potential employees. Compliance ambassadors play a crucial role in strengthening compliance efforts, providing additional resources and support in regulatory issues. By asking detailed questions and fostering collaboration between compliance and HR, organizations can harness the power of exit interviews to enhance motivation, efficiency, and effectiveness in their compliance programs. Three key takeaways: The exit interview is an excellent opportunity to obtain information to inform your compliance program. Use the exit interview to create advocates from departing employees. Use the exit interview for probing and insightful questions around compliance. For more information, check out The Compliance Handbook, 4th edition here. Learn more about your ad choices. Visit megaphone.fm/adchoices  Today, we're diving into the significance of exit interviews in fully operationalizing a best practices compliance program. Exit interviews provide a valuable opportunity to gather unfiltered insights from departing employees, allowing organizations to enhance motivation, efficiency, and effectiveness. In this blog post, we'll explore the practical benefits of conducting exit interviews and how they can transform departing employees into lifelong advocates for your organization.

The exit interview can be a further mechanism to operationalize compliance. This type of interview is used when someone voluntarily departs from a company, as opposed to a lay-off or reduction in force exercise. Typically departing employees are more willing to share about their experiences, concerns and issues which led to their employment departure.

Exit interviews are a powerful tool for fully operationalizing a best practices compliance program. They provide organizations with invaluable insights into employee perceptions, job design, and culture. By treating departing employees with dignity and respect, organizations can transform them into lifelong advocates, defending the organization's reputation and recommending it to potential employees. Compliance ambassadors play a crucial role in strengthening compliance efforts, providing additional resources and support in regulatory issues. By asking detailed questions and fostering collaboration between compliance and HR, organizations can harness the power of exit interviews to enhance motivation, efficiency, and effectiveness in their compliance programs.

Three key takeaways:

  1. The exit interview is an excellent opportunity to obtain information to inform your compliance program.
  2. Use the exit interview to create advocates from departing employees.
  3. Use the exit interview for probing and insightful questions around compliance.

For more information, check out The Compliance Handbook, 4th edition here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 557 no One Month to a More Effective Compliance Program: Day 15 - Employment Separation Issues and Compliance Employment separation and layoffs can present some unique challenges for the compliance practitioner. Employees can use layoffs to claim that they were retaliated against for a wide variety of complaints, including those for concerns that impact the compliance practitioner. Yet there are several ways that operationalization will help to protect your company as much as possible. The reasons for these actions are to allow you to demonstrate that any laid off employee was not separated because of a hotline or whistleblower allegation but due to your overall layoff scheme. However, it could be that you may need this person to provide your compliance department additional information, to be a resource to you going forward, or even a witness that you can reasonably anticipate the government may want to interview. If any of these situations exist, if you do not plan for their eventuality before you lay off the employee, said (now) ex-employee may not be inclined to cooperate with you going forward. Also, if you do demonstrate that you are sincerely interested in a meritorious hotline complaint, it may keep this person from becoming a SEC whistleblower. Three key takeaways: Treat departing employees with dignity. Make sure your separation documents meet SEC requirements regarding disclosures re: whistleblowing. You must check your hotline and anonymous reporting systems to make sure you do not lay off a whistleblower. For more information, check out The Compliance Handbook, 4th edition here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 21 Aug 2023 04:00:00 -0000 Day 15 - Employment Separation Issues and Compliance full 15 Thomas Fox Today we consider employment separation issues and compliance. Employment separation and layoffs can present some unique challenges for the compliance practitioner. Employees can use layoffs to claim that they were retaliated against for a wide variety of complaints, including those for concerns that impact the compliance practitioner. Yet there are several ways that operationalization will help to protect your company as much as possible. The reasons for these actions are to allow you to demonstrate that any laid off employee was not separated because of a hotline or whistleblower allegation but due to your overall layoff scheme. However, it could be that you may need this person to provide your compliance department additional information, to be a resource to you going forward, or even a witness that you can reasonably anticipate the government may want to interview. If any of these situations exist, if you do not plan for their eventuality before you lay off the employee, said (now) ex-employee may not be inclined to cooperate with you going forward. Also, if you do demonstrate that you are sincerely interested in a meritorious hotline complaint, it may keep this person from becoming a SEC whistleblower. Three key takeaways: Treat departing employees with dignity. Make sure your separation documents meet SEC requirements regarding disclosures re: whistleblowing. You must check your hotline and anonymous reporting systems to make sure you do not lay off a whistleblower. For more information, check out The Compliance Handbook, 4th edition here. Learn more about your ad choices. Visit megaphone.fm/adchoices Employment separation and layoffs can present some unique challenges for the compliance practitioner. Employees can use layoffs to claim that they were retaliated against for a wide variety of complaints, including those for concerns that impact the compliance practitioner. Yet there are several ways that operationalization will help to protect your company as much as possible.

The reasons for these actions are to allow you to demonstrate that any laid off employee was not separated because of a hotline or whistleblower allegation but due to your overall layoff scheme. However, it could be that you may need this person to provide your compliance department additional information, to be a resource to you going forward, or even a witness that you can reasonably anticipate the government may want to interview. If any of these situations exist, if you do not plan for their eventuality before you lay off the employee, said (now) ex-employee may not be inclined to cooperate with you going forward. Also, if you do demonstrate that you are sincerely interested in a meritorious hotline complaint, it may keep this person from becoming a SEC whistleblower.

Three key takeaways:

  1. Treat departing employees with dignity.
  2. Make sure your separation documents meet SEC requirements regarding disclosures re: whistleblowing.
  3. You must check your hotline and anonymous reporting systems to make sure you do not lay off a whistleblower.

For more information, check out The Compliance Handbook, 4th edition here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no One Month to a More Effective Compliance Program: Day 14 - Hiring A CCO: Developing The Job Profile What should a company do when it desires to hire a CCO? To do so, a company needs to fully understand and appreciate what it needs from such a position going forward. Unfortunately, many companies do not have this insight at the beginning of the recruitment process. The key company stakeholders need to understand the full hiring process. Obviously, this will include HR and others involved in the hiring process for a CCO for the company. It could include the CEO, COO, CFO, CISO, Head of IA and others. They may need to rethink their approach to focus on what they will ask the new hire to accomplish because typically there is a disconnect between what the company thinks it needs and what it really needs. Tom highlights the importance of developing a comprehensive job profile. Maurice Gilbert provides insights on the topic, emphasizing the need for companies to understand their specific needs and risks when creating a job profile for the CCO position. The podcast also discusses the importance of involving key stakeholders, setting realistic expectations, and considering professional growth opportunities and an attractive package for potential candidates. By involving key stakeholders in defining the role of the CCO and seeking the assistance of a professional executive recruiter, companies can find the right fit for their compliance program's success. Three key takeaways: Bring in your key stakeholders to flesh out the job description. Consider the top four things you would like a new CCO to accomplish in the first year. For a new CCO to succeed, the company must have a realistic expectation developed before the process begins. For more information, check out The Compliance Handbook, 4th edition here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 18 Aug 2023 04:00:00 -0000 Day 14 - Hiring A CCO: Developing The Job Profile full 14 Thomas Fox Today we consider how to develop a job profile to hire a CCO. What should a company do when it desires to hire a CCO? To do so, a company needs to fully understand and appreciate what it needs from such a position going forward. Unfortunately, many companies do not have this insight at the beginning of the recruitment process. The key company stakeholders need to understand the full hiring process. Obviously, this will include HR and others involved in the hiring process for a CCO for the company. It could include the CEO, COO, CFO, CISO, Head of IA and others. They may need to rethink their approach to focus on what they will ask the new hire to accomplish because typically there is a disconnect between what the company thinks it needs and what it really needs. Tom highlights the importance of developing a comprehensive job profile. Maurice Gilbert provides insights on the topic, emphasizing the need for companies to understand their specific needs and risks when creating a job profile for the CCO position. The podcast also discusses the importance of involving key stakeholders, setting realistic expectations, and considering professional growth opportunities and an attractive package for potential candidates. By involving key stakeholders in defining the role of the CCO and seeking the assistance of a professional executive recruiter, companies can find the right fit for their compliance program's success. Three key takeaways: Bring in your key stakeholders to flesh out the job description. Consider the top four things you would like a new CCO to accomplish in the first year. For a new CCO to succeed, the company must have a realistic expectation developed before the process begins. For more information, check out The Compliance Handbook, 4th edition here. Learn more about your ad choices. Visit megaphone.fm/adchoices What should a company do when it desires to hire a CCO? To do so, a company needs to fully understand and appreciate what it needs from such a position going forward. Unfortunately, many companies do not have this insight at the beginning of the recruitment process. The key company stakeholders need to understand the full hiring process. Obviously, this will include HR and others involved in the hiring process for a CCO for the company. It could include the CEO, COO, CFO, CISO, Head of IA and others. They may need to rethink their approach to focus on what they will ask the new hire to accomplish because typically there is a disconnect between what the company thinks it needs and what it really needs.

Tom highlights the importance of developing a comprehensive job profile. Maurice Gilbert provides insights on the topic, emphasizing the need for companies to understand their specific needs and risks when creating a job profile for the CCO position. The podcast also discusses the importance of involving key stakeholders, setting realistic expectations, and considering professional growth opportunities and an attractive package for potential candidates. By involving key stakeholders in defining the role of the CCO and seeking the assistance of a professional executive recruiter, companies can find the right fit for their compliance program's success.

Three key takeaways:

  1. Bring in your key stakeholders to flesh out the job description.
  2. Consider the top four things you would like a new CCO to accomplish in the first year.
  3. For a new CCO to succeed, the company must have a realistic expectation developed before the process begins.

For more information, check out The Compliance Handbook, 4th edition here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 562 no One Month to a More Effective Compliance Program: Day 13 - Compliance Performance Appraisal Review One of the ways to operationalize compliance and to drive it into the DNA of an organization is through a performance review. Indeed, the 2023 ECCP stated: Incentive System…Have there been specific examples of actions taken (e.g., promotions or awards denied) as a result of compliance and ethics considerations? Who determines the compensation, including bonuses, as well as discipline and promotion of compliance personnel? Most HR experts will opine that properly executed performance appraisals are crucial to organizational productivity as well as the development of employee skills and employee morale. Moreover, they can serve a couple of different functions for a best practices compliance program. First, and foremost, they communicate to each employee their job performance from a compliance perspective. Tom emphasizes the vital role of human resources in incorporating compliance into performance reviews and appraisals, ensuring it becomes ingrained in an organization's DNA. He discusses the need for concrete examples of actions taken as a result of compliance considerations to demonstrate the seriousness of compliance. Fox provides practical tips for conducting effective compliance employee appraisals, including giving constructive feedback and addressing compliance shortcomings. The episodes stress the continuous nature of performance appraisals and their impact on compensation and incentives within a compliance program. By conducting multiple appraisals throughout the year, compliance can be embedded into the company culture and compliance failures can be promptly addressed. Three key takeaways: To incentivize compliance, you must be able to accurately appraise senior managers and employees around compliance. Clearly communicate your compliance expectations, then fairly evaluate employees on them. Consider conducting an ongoing review. For more information, check out The Compliance Handbook, 4th edition here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 17 Aug 2023 04:00:00 -0000 Day 13 - Compliance Performance Appraisal Review full 13 Thomas Fox Today we consider the compliance performance appraisal review. One of the ways to operationalize compliance and to drive it into the DNA of an organization is through a performance review. Indeed, the 2023 ECCP stated: Incentive System…Have there been specific examples of actions taken (e.g., promotions or awards denied) as a result of compliance and ethics considerations? Who determines the compensation, including bonuses, as well as discipline and promotion of compliance personnel? Most HR experts will opine that properly executed performance appraisals are crucial to organizational productivity as well as the development of employee skills and employee morale. Moreover, they can serve a couple of different functions for a best practices compliance program. First, and foremost, they communicate to each employee their job performance from a compliance perspective. Tom emphasizes the vital role of human resources in incorporating compliance into performance reviews and appraisals, ensuring it becomes ingrained in an organization's DNA. He discusses the need for concrete examples of actions taken as a result of compliance considerations to demonstrate the seriousness of compliance. Fox provides practical tips for conducting effective compliance employee appraisals, including giving constructive feedback and addressing compliance shortcomings. The episodes stress the continuous nature of performance appraisals and their impact on compensation and incentives within a compliance program. By conducting multiple appraisals throughout the year, compliance can be embedded into the company culture and compliance failures can be promptly addressed. Three key takeaways: To incentivize compliance, you must be able to accurately appraise senior managers and employees around compliance. Clearly communicate your compliance expectations, then fairly evaluate employees on them. Consider conducting an ongoing review. For more information, check out The Compliance Handbook, 4th edition here. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the ways to operationalize compliance and to drive it into the DNA of an organization is through a performance review. Indeed, the 2023 ECCP stated:

Incentive System…Have there been specific examples of actions taken (e.g., promotions or awards denied) as a result of compliance and ethics considerations? Who determines the compensation, including bonuses, as well as discipline and promotion of compliance personnel?

Most HR experts will opine that properly executed performance appraisals are crucial to organizational productivity as well as the development of employee skills and employee morale. Moreover, they can serve a couple of different functions for a best practices compliance program. First, and foremost, they communicate to each employee their job performance from a compliance perspective.

Tom emphasizes the vital role of human resources in incorporating compliance into performance reviews and appraisals, ensuring it becomes ingrained in an organization's DNA. He discusses the need for concrete examples of actions taken as a result of compliance considerations to demonstrate the seriousness of compliance. Fox provides practical tips for conducting effective compliance employee appraisals, including giving constructive feedback and addressing compliance shortcomings. The episodes stress the continuous nature of performance appraisals and their impact on compensation and incentives within a compliance program. By conducting multiple appraisals throughout the year, compliance can be embedded into the company culture and compliance failures can be promptly addressed.

Three key takeaways:

  1. To incentivize compliance, you must be able to accurately appraise senior managers and employees around compliance.
  2. Clearly communicate your compliance expectations, then fairly evaluate employees on them.
  3. Consider conducting an ongoing review.

For more information, check out The Compliance Handbook, 4th edition here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 561 no One Month to a More Effective Compliance Program: Day 12 - Succession Planning Around Compliance Another area where Human Resources can help to more fully operationalize compliance is in succession planning. Succession planning is just as important as governance, enterprise risk management and strategic oversight. In other words, it is just as important. Sadly, many companies fail to give it the attention it requires. A PricewaterhouseCoopers (PwC) survey, found nearly one-half of the more than 1,000 directors gauged reported dissatisfaction with their companies’ succession plans. Imagine what that number would be if they took into account the compliance aspect of succession planning. Some of the questions you might consider are the following. How did you fully operationalize compliance into the business unit that you managed? What controls did you put in place? And then what did you do when you found out about it? Succession planning in compliance is a critical and ongoing process that should not be left until the last minute, according to Tom Fox in this podcast episode. With a focus on prevention, detection, and response to compliance issues, evaluation and engagement of the Board of Directors are crucial. The importance of transparency, communication, and fully operationalizing compliance into the business unit is emphasized. HR's role in assessing candidates' views on business ethics and inculcating compliance values is highlighted. Continuous controls monitoring and sophisticated tools can help ensure compliance programs evolve effectively. Overall, these episodes provide valuable insights into the importance of succession planning and continuous evaluation in maintaining a successful organization. Three key takeaways: Succession planning is just as important as governance, enterprise risk and strategic oversight. Do not begin your succession planning when a senior manager announces their retirement. You are always being evaluated (or you should be). For more information, check out The Compliance Handbook, 4th edition here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 16 Aug 2023 04:00:00 -0000 Day 12 - Succession Planning Around Compliance full 12 Thomas Fox Today we consider the role of compliance in succession planning. Another area where Human Resources can help to more fully operationalize compliance is in succession planning. Succession planning is just as important as governance, enterprise risk management and strategic oversight. In other words, it is just as important. Sadly, many companies fail to give it the attention it requires. A PricewaterhouseCoopers (PwC) survey, found nearly one-half of the more than 1,000 directors gauged reported dissatisfaction with their companies’ succession plans. Imagine what that number would be if they took into account the compliance aspect of succession planning. Some of the questions you might consider are the following. How did you fully operationalize compliance into the business unit that you managed? What controls did you put in place? And then what did you do when you found out about it? Succession planning in compliance is a critical and ongoing process that should not be left until the last minute, according to Tom Fox in this podcast episode. With a focus on prevention, detection, and response to compliance issues, evaluation and engagement of the Board of Directors are crucial. The importance of transparency, communication, and fully operationalizing compliance into the business unit is emphasized. HR's role in assessing candidates' views on business ethics and inculcating compliance values is highlighted. Continuous controls monitoring and sophisticated tools can help ensure compliance programs evolve effectively. Overall, these episodes provide valuable insights into the importance of succession planning and continuous evaluation in maintaining a successful organization. Three key takeaways: Succession planning is just as important as governance, enterprise risk and strategic oversight. Do not begin your succession planning when a senior manager announces their retirement. You are always being evaluated (or you should be). For more information, check out The Compliance Handbook, 4th edition here. Learn more about your ad choices. Visit megaphone.fm/adchoices Another area where Human Resources can help to more fully operationalize compliance is in succession planning. Succession planning is just as important as governance, enterprise risk management and strategic oversight. In other words, it is just as important. Sadly, many companies fail to give it the attention it requires. A PricewaterhouseCoopers (PwC) survey, found nearly one-half of the more than 1,000 directors gauged reported dissatisfaction with their companies’ succession plans. Imagine what that number would be if they took into account the compliance aspect of succession planning. Some of the questions you might consider are the following. How did you fully operationalize compliance into the business unit that you managed? What controls did you put in place? And then what did you do when you found out about it?

Succession planning in compliance is a critical and ongoing process that should not be left until the last minute, according to Tom Fox in this podcast episode. With a focus on prevention, detection, and response to compliance issues, evaluation and engagement of the Board of Directors are crucial. The importance of transparency, communication, and fully operationalizing compliance into the business unit is emphasized. HR's role in assessing candidates' views on business ethics and inculcating compliance values is highlighted. Continuous controls monitoring and sophisticated tools can help ensure compliance programs evolve effectively. Overall, these episodes provide valuable insights into the importance of succession planning and continuous evaluation in maintaining a successful organization.

Three key takeaways:

  1. Succession planning is just as important as governance, enterprise risk and strategic oversight.
  2. Do not begin your succession planning when a senior manager announces their retirement.
  3. You are always being evaluated (or you should be).

For more information, check out The Compliance Handbook, 4th edition here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 560 no One Month to a More Effective Compliance Program: Day 11 - Institutional Justice and Institutional Fairness Companies have finally come to realize that institutional justice and fairness are perhaps the most basic tenet of any successful workplace. If employees believe they will be treated fairly, it will engender a level of trust that can work to not simply motivate employees but lead to a more successful workplace and, at the end of the day, a more profitable company. This encompasses the entire lifecycle of the employment relationship, from hiring through separation. It works in areas as seemingly disparate as compensation and incentives, discipline, promotion, and internal reporting. One key aspect discussed is the need for a robust whistleblower reporting system that encourages employees to come forward with concerns without fear of retaliation. Discipline and clear disciplinary procedures are also highlighted as crucial for maintaining credibility and preventing compliance violations. The fair process doctrine is discussed, emphasizing the importance of consistent and fair administration of discipline and the inclusion of compliance in employee evaluations and promotions. The episodes also emphasize the need for fair and impartial internal investigations to maintain employee trust. Overall, HR is shown to be instrumental in promoting a culture of compliance and ethical behavior. Three key takeaways: The DOJ and SEC have long called for appropriate and consistent application of both incentives and discipline. The Fair Process Doctrine will help set institutional justice as the norm in your organization. Inconsistent application of discipline will destroy your compliance program credibility. For more information, check out The Compliance Handbook, 4th edition here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 15 Aug 2023 04:00:00 -0000 Day 11 - Institutional Justice and Institutional Fairness full 11 Thomas Fox In this episode we take up Institutional Justice and Institutional Fairness. Companies have finally come to realize that institutional justice and fairness are perhaps the most basic tenet of any successful workplace. If employees believe they will be treated fairly, it will engender a level of trust that can work to not simply motivate employees but lead to a more successful workplace and, at the end of the day, a more profitable company. This encompasses the entire lifecycle of the employment relationship, from hiring through separation. It works in areas as seemingly disparate as compensation and incentives, discipline, promotion, and internal reporting. One key aspect discussed is the need for a robust whistleblower reporting system that encourages employees to come forward with concerns without fear of retaliation. Discipline and clear disciplinary procedures are also highlighted as crucial for maintaining credibility and preventing compliance violations. The fair process doctrine is discussed, emphasizing the importance of consistent and fair administration of discipline and the inclusion of compliance in employee evaluations and promotions. The episodes also emphasize the need for fair and impartial internal investigations to maintain employee trust. Overall, HR is shown to be instrumental in promoting a culture of compliance and ethical behavior. Three key takeaways: The DOJ and SEC have long called for appropriate and consistent application of both incentives and discipline. The Fair Process Doctrine will help set institutional justice as the norm in your organization. Inconsistent application of discipline will destroy your compliance program credibility. For more information, check out The Compliance Handbook, 4th edition here. Learn more about your ad choices. Visit megaphone.fm/adchoices Companies have finally come to realize that institutional justice and fairness are perhaps the most basic tenet of any successful workplace. If employees believe they will be treated fairly, it will engender a level of trust that can work to not simply motivate employees but lead to a more successful workplace and, at the end of the day, a more profitable company. This encompasses the entire lifecycle of the employment relationship, from hiring through separation. It works in areas as seemingly disparate as compensation and incentives, discipline, promotion, and internal reporting.


One key aspect discussed is the need for a robust whistleblower reporting system that encourages employees to come forward with concerns without fear of retaliation. Discipline and clear disciplinary procedures are also highlighted as crucial for maintaining credibility and preventing compliance violations. The fair process doctrine is discussed, emphasizing the importance of consistent and fair administration of discipline and the inclusion of compliance in employee evaluations and promotions. The episodes also emphasize the need for fair and impartial internal investigations to maintain employee trust. Overall, HR is shown to be instrumental in promoting a culture of compliance and ethical behavior.

Three key takeaways:

  1. The DOJ and SEC have long called for appropriate and consistent application of both incentives and discipline.
  2. The Fair Process Doctrine will help set institutional justice as the norm in your organization.
  3. Inconsistent application of discipline will destroy your compliance program credibility.


For more information, check out The Compliance Handbook, 4th edition here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 566 no One Month to a More Effective Compliance Program: Day 10 - Sales Incentives and Compliance In the DOJ’s 2023 ECCP, Incentives and Disciplinary Measures it stated: Incentive System – Has the company considered the implications of its incentives and rewards on compliance? How does the company incentivize compliance and ethical behavior? Have there been specific examples of actions taken (e.g., promotions or awards denied) as a result of compliance and ethics considerations? Who determines the compensation, including bonuses, as well as discipline and promotion of compliance personnel? In this podcast episode titled "Sales Incentives and Compliance," Tom Fox explores the risks and consequences of misaligned sales incentives. Using the Wells Fargo scandal as an example, Fox discusses how a flawed incentive program can lead to compliance failures. He emphasizes the importance of aligning incentives with compliance goals and highlights the role of human resources in implementing effective compliance programs. The podcast warns that sales incentive programs can become high risk or even illegal if not properly designed and monitored. It concludes by emphasizing the significance of HR's involvement in creating a more effective compliance program and its impact on overall organizational success. Three key takeaways: Even a benign sales incentive program came become skewed. A sales incentive program can become high risk or illegal if not properly monitored. If there is alignment between the strategy, purpose and structure of an incentive system, it often makes the difference between a good and a bad one. For more information, check out The Compliance Handbook, 4th edition here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 14 Aug 2023 04:00:00 -0000 Day 10 - Sales Incentives and Compliance full 10 Thomas Fox In this episode I look at sales incentives. In the DOJ’s 2023 ECCP, Incentives and Disciplinary Measures it stated: Incentive System – Has the company considered the implications of its incentives and rewards on compliance? How does the company incentivize compliance and ethical behavior? Have there been specific examples of actions taken (e.g., promotions or awards denied) as a result of compliance and ethics considerations? Who determines the compensation, including bonuses, as well as discipline and promotion of compliance personnel? In this podcast episode titled "Sales Incentives and Compliance," Tom Fox explores the risks and consequences of misaligned sales incentives. Using the Wells Fargo scandal as an example, Fox discusses how a flawed incentive program can lead to compliance failures. He emphasizes the importance of aligning incentives with compliance goals and highlights the role of human resources in implementing effective compliance programs. The podcast warns that sales incentive programs can become high risk or even illegal if not properly designed and monitored. It concludes by emphasizing the significance of HR's involvement in creating a more effective compliance program and its impact on overall organizational success. Three key takeaways: Even a benign sales incentive program came become skewed. A sales incentive program can become high risk or illegal if not properly monitored. If there is alignment between the strategy, purpose and structure of an incentive system, it often makes the difference between a good and a bad one. For more information, check out The Compliance Handbook, 4th edition here. Learn more about your ad choices. Visit megaphone.fm/adchoices In the DOJ’s 2023 ECCP, Incentives and Disciplinary Measures it stated:

Incentive System – Has the company considered the implications of its incentives and rewards on compliance? How does the company incentivize compliance and ethical behavior? Have there been specific examples of actions taken (e.g., promotions or awards denied) as a result of compliance and ethics considerations? Who determines the compensation, including bonuses, as well as discipline and promotion of compliance personnel?

In this podcast episode titled "Sales Incentives and Compliance," Tom Fox explores the risks and consequences of misaligned sales incentives. Using the Wells Fargo scandal as an example, Fox discusses how a flawed incentive program can lead to compliance failures. He emphasizes the importance of aligning incentives with compliance goals and highlights the role of human resources in implementing effective compliance programs. The podcast warns that sales incentive programs can become high risk or even illegal if not properly designed and monitored. It concludes by emphasizing the significance of HR's involvement in creating a more effective compliance program and its impact on overall organizational success.

Three key takeaways:

  1. Even a benign sales incentive program came become skewed.
  2. A sales incentive program can become high risk or illegal if not properly monitored.
  3. If there is alignment between the strategy, purpose and structure of an incentive system, it often makes the difference between a good and a bad one.

For more information, check out The Compliance Handbook, 4th edition here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 513 no One Month to a More Effective Compliance Program: Day 9 - Clawbacks In this podcast series, host Tom Fox explores the growing emphasis on clawback provisions in compliance programs and employee compensation. The Department of Justice and Securities and Exchange Commission now prioritize holding individuals accountable for misconduct, making clawbacks essential for promoting ethical behavior. These provisions allow organizations to reclaim incentive or bonus funds from employees who engage in misconduct, serving as a deterrent and ensuring accountability. The SEC has issued guidance through a final rule that requires companies to develop policies for recovering incentive-based compensation in the event of accounting restatements, while also prohibiting indemnity insurance for executives. These episodes provide valuable insights into the evolving landscape of compliance and FCPA enforcement, emphasizing the importance of clawbacks in promoting ethical practices and compliance with regulations.  Three key takeaways: 1. The DOJ now mandates clawbacks in a compliance program. 2. The SEC has passed a clawback rule apart from the Monaco Memo. 3. Your clawback program should be well-documented.  For more information, check out The Compliance Handbook, 4th edition, available on LexisNexis.com. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 11 Aug 2023 04:00:00 -0000 Day 9 - Clawbacks full Thomas Fox In this episode, Tom looks at the new DOJ requirement around clawbacks. In this podcast series, host Tom Fox explores the growing emphasis on clawback provisions in compliance programs and employee compensation. The Department of Justice and Securities and Exchange Commission now prioritize holding individuals accountable for misconduct, making clawbacks essential for promoting ethical behavior. These provisions allow organizations to reclaim incentive or bonus funds from employees who engage in misconduct, serving as a deterrent and ensuring accountability. The SEC has issued guidance through a final rule that requires companies to develop policies for recovering incentive-based compensation in the event of accounting restatements, while also prohibiting indemnity insurance for executives. These episodes provide valuable insights into the evolving landscape of compliance and FCPA enforcement, emphasizing the importance of clawbacks in promoting ethical practices and compliance with regulations.  Three key takeaways: 1. The DOJ now mandates clawbacks in a compliance program. 2. The SEC has passed a clawback rule apart from the Monaco Memo. 3. Your clawback program should be well-documented.  For more information, check out The Compliance Handbook, 4th edition, available on LexisNexis.com. Learn more about your ad choices. Visit megaphone.fm/adchoices In this podcast series, host Tom Fox explores the growing emphasis on clawback provisions in compliance programs and employee compensation. The Department of Justice and Securities and Exchange Commission now prioritize holding individuals accountable for misconduct, making clawbacks essential for promoting ethical behavior. These provisions allow organizations to reclaim incentive or bonus funds from employees who engage in misconduct, serving as a deterrent and ensuring accountability. The SEC has issued guidance through a final rule that requires companies to develop policies for recovering incentive-based compensation in the event of accounting restatements, while also prohibiting indemnity insurance for executives. These episodes provide valuable insights into the evolving landscape of compliance and FCPA enforcement, emphasizing the importance of clawbacks in promoting ethical practices and compliance with regulations.

 Three key takeaways:

1. The DOJ now mandates clawbacks in a compliance program.

2. The SEC has passed a clawback rule apart from the Monaco Memo.

3. Your clawback program should be well-documented. 

For more information, check out The Compliance Handbook, 4th edition, available on LexisNexis.com.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 568 no One Month to a More Effective Compliance Program: Day 8-Executives and Compliance Compensation Incentives The lack of personal consequences for senior executives responsible for corporate malfeasance is explored in this podcast episode. Executives are incentivized to take excessive risks, knowing they won't have to pay any fines, while shareholders bear the brunt of penalties. Proposed solutions include the concept of "skin in the game," where executives contribute a portion of their compensation to a pool of money that can be used to pay penalties. Another suggestion involves forfeiting the performance bond of senior management in the case of large fines. A third approach suggests creating a contract that would enforce a reduction in pay for failures of corporate governance. These proposals aim to hold senior executives personally accountable for compliance failures and align executive compensation with compliance objectives. HR professionals play a crucial role in designing and implementing positive incentives to foster a culture of compliance and ethical conduct within organizations. Three key takeaways: 1. Perverse incentives are named that for a reason; they really are bad. 2. How can you create positive incentives in your organization? 3. There is a business response to this legal issue. Employ it. For more information, check out The Compliance Handbook, 4th edition, available on LexisNexis.com. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 10 Aug 2023 04:00:00 -0000 Day 8-Executives and Compliance Compensation Incentives full Thomas Fox Today we consider compliance incentives through executive comp. The lack of personal consequences for senior executives responsible for corporate malfeasance is explored in this podcast episode. Executives are incentivized to take excessive risks, knowing they won't have to pay any fines, while shareholders bear the brunt of penalties. Proposed solutions include the concept of "skin in the game," where executives contribute a portion of their compensation to a pool of money that can be used to pay penalties. Another suggestion involves forfeiting the performance bond of senior management in the case of large fines. A third approach suggests creating a contract that would enforce a reduction in pay for failures of corporate governance. These proposals aim to hold senior executives personally accountable for compliance failures and align executive compensation with compliance objectives. HR professionals play a crucial role in designing and implementing positive incentives to foster a culture of compliance and ethical conduct within organizations. Three key takeaways: 1. Perverse incentives are named that for a reason; they really are bad. 2. How can you create positive incentives in your organization? 3. There is a business response to this legal issue. Employ it. For more information, check out The Compliance Handbook, 4th edition, available on LexisNexis.com. Learn more about your ad choices. Visit megaphone.fm/adchoices The lack of personal consequences for senior executives responsible for corporate malfeasance is explored in this podcast episode. Executives are incentivized to take excessive risks, knowing they won't have to pay any fines, while shareholders bear the brunt of penalties. Proposed solutions include the concept of "skin in the game," where executives contribute a portion of their compensation to a pool of money that can be used to pay penalties. Another suggestion involves forfeiting the performance bond of senior management in the case of large fines. A third approach suggests creating a contract that would enforce a reduction in pay for failures of corporate governance. These proposals aim to hold senior executives personally accountable for compliance failures and align executive compensation with compliance objectives. HR professionals play a crucial role in designing and implementing positive incentives to foster a culture of compliance and ethical conduct within organizations.

Three key takeaways:

1. Perverse incentives are named that for a reason; they really are bad.

2. How can you create positive incentives in your organization?

3. There is a business response to this legal issue. Employ it.

For more information, check out The Compliance Handbook, 4th edition, available on LexisNexis.com.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 513 no One Month to a More Effective Compliance Program: Day 7-Designing compensation to operationalize compliance In this podcast episode, Tom Fox highlights the importance of incorporating compensation systems into a company's compliance program. He discusses how the DOJ and SEC view monetary structures as a way to reinforce compliance and reward employees who adhere to compliance programs. Fox advises compliance practitioners to revise incentive systems to align with the goals of the compliance program, ensuring simplicity, alignment with company values, and immediate behavior change. He also emphasizes the need to align compensation programs with compliance goals and shares examples of how this can be done effectively. These episodes provide valuable insights into the role of compensation in promoting compliance and integrating compliance into HR practices, emphasizing the importance of transparency and immediate action in implementing effective compensation structures for compliance. Three key takeaways: The DOJ and SEC have long advocated compensation to motivate employees into ethical and compliant behaviors. Keep the compliance aspects of your compensation structure simple and easy for your employees to understand. Have full transparency in the frame of your compensation structure. For more information, check out The Compliance Handbook, 4th edition, available on LexisNexis.com. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 09 Aug 2023 04:00:00 -0000 Day 7-Designing compensation to operationalize compliance full Thomas Fox Today we consider designing compensation to operationalize compliance. In this podcast episode, Tom Fox highlights the importance of incorporating compensation systems into a company's compliance program. He discusses how the DOJ and SEC view monetary structures as a way to reinforce compliance and reward employees who adhere to compliance programs. Fox advises compliance practitioners to revise incentive systems to align with the goals of the compliance program, ensuring simplicity, alignment with company values, and immediate behavior change. He also emphasizes the need to align compensation programs with compliance goals and shares examples of how this can be done effectively. These episodes provide valuable insights into the role of compensation in promoting compliance and integrating compliance into HR practices, emphasizing the importance of transparency and immediate action in implementing effective compensation structures for compliance. Three key takeaways: The DOJ and SEC have long advocated compensation to motivate employees into ethical and compliant behaviors. Keep the compliance aspects of your compensation structure simple and easy for your employees to understand. Have full transparency in the frame of your compensation structure. For more information, check out The Compliance Handbook, 4th edition, available on LexisNexis.com. Learn more about your ad choices. Visit megaphone.fm/adchoices In this podcast episode, Tom Fox highlights the importance of incorporating compensation systems into a company's compliance program. He discusses how the DOJ and SEC view monetary structures as a way to reinforce compliance and reward employees who adhere to compliance programs. Fox advises compliance practitioners to revise incentive systems to align with the goals of the compliance program, ensuring simplicity, alignment with company values, and immediate behavior change. He also emphasizes the need to align compensation programs with compliance goals and shares examples of how this can be done effectively. These episodes provide valuable insights into the role of compensation in promoting compliance and integrating compliance into HR practices, emphasizing the importance of transparency and immediate action in implementing effective compensation structures for compliance.

Three key takeaways:

  1. The DOJ and SEC have long advocated compensation to motivate employees into ethical and compliant behaviors.
  2. Keep the compliance aspects of your compensation structure simple and easy for your employees to understand.
  3. Have full transparency in the frame of your compensation structure.


For more information, check out The Compliance Handbook, 4th edition, available on LexisNexis.com.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 510 no One Month to a More Effective Compliance Program: Day 6-Six Core Principles for Compliance Incentives In these podcast episodes, Tom discusses the importance of incorporating incentives and support systems into a company's compliance program. He presents six core principles for effective compliance incentives, emphasizing the need for simplicity, visibility, and institutional mechanisms to ensure their longevity. Fox also highlights the role of human resources in implementing compliance programs and the positive impact it can have on organizations. By understanding and implementing these principles, companies can create a culture of compliance, reduce the risk of unethical behavior, and enhance their credibility. 1.     Compliance incentives don’t have to be elaborate or novel.  2.     Compliance incentives need supporting systems if they are to stick. 3.     Support systems are needed to reinforce compliance incentives. 4.     Compliance incentives need a “counterweight” to endure. 5.     Compliance incentive alignment works in an oblique, not linear, way. 6.     Compliance incentive initiatives can be implemented at all levels. Obviously, this list is not exhaustive. Yet it is now more important than ever that you demonstrate tangible incentives for your employees to gain benefits, both financial and hierarchical, through doing business ethically, in compliance with your own Code of Conduct and most certainly in compliance with relevant anti-bribery laws. It is also a requirement that such actions be documented so they can be demonstrated to the regulators, if they come knocking.  Three key takeaways: Compliance incentives do not have to be elaborate or novel. You must create support systems for your compliance incentives.  Compliance incentives should be implemented at all levels.  Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 08 Aug 2023 04:00:00 -0000 Day 6-Six Core Principles for Compliance Incentives full Thomas Fox In this episode we review 6 core principles for compliance incentives. In these podcast episodes, Tom discusses the importance of incorporating incentives and support systems into a company's compliance program. He presents six core principles for effective compliance incentives, emphasizing the need for simplicity, visibility, and institutional mechanisms to ensure their longevity. Fox also highlights the role of human resources in implementing compliance programs and the positive impact it can have on organizations. By understanding and implementing these principles, companies can create a culture of compliance, reduce the risk of unethical behavior, and enhance their credibility. 1.     Compliance incentives don’t have to be elaborate or novel.  2.     Compliance incentives need supporting systems if they are to stick. 3.     Support systems are needed to reinforce compliance incentives. 4.     Compliance incentives need a “counterweight” to endure. 5.     Compliance incentive alignment works in an oblique, not linear, way. 6.     Compliance incentive initiatives can be implemented at all levels. Obviously, this list is not exhaustive. Yet it is now more important than ever that you demonstrate tangible incentives for your employees to gain benefits, both financial and hierarchical, through doing business ethically, in compliance with your own Code of Conduct and most certainly in compliance with relevant anti-bribery laws. It is also a requirement that such actions be documented so they can be demonstrated to the regulators, if they come knocking.  Three key takeaways: Compliance incentives do not have to be elaborate or novel. You must create support systems for your compliance incentives.  Compliance incentives should be implemented at all levels.  Learn more about your ad choices. Visit megaphone.fm/adchoices In these podcast episodes, Tom discusses the importance of incorporating incentives and support systems into a company's compliance program. He presents six core principles for effective compliance incentives, emphasizing the need for simplicity, visibility, and institutional mechanisms to ensure their longevity. Fox also highlights the role of human resources in implementing compliance programs and the positive impact it can have on organizations. By understanding and implementing these principles, companies can create a culture of compliance, reduce the risk of unethical behavior, and enhance their credibility.

1.     Compliance incentives don’t have to be elaborate or novel. 

2.     Compliance incentives need supporting systems if they are to stick.

3.     Support systems are needed to reinforce compliance incentives.

4.     Compliance incentives need a “counterweight” to endure.

5.     Compliance incentive alignment works in an oblique, not linear, way.

6.     Compliance incentive initiatives can be implemented at all levels.

Obviously, this list is not exhaustive. Yet it is now more important than ever that you demonstrate tangible incentives for your employees to gain benefits, both financial and hierarchical, through doing business ethically, in compliance with your own Code of Conduct and most certainly in compliance with relevant anti-bribery laws. It is also a requirement that such actions be documented so they can be demonstrated to the regulators, if they come knocking. 

Three key takeaways:

  1. Compliance incentives do not have to be elaborate or novel.
  2. You must create support systems for your compliance incentives. 
  3. Compliance incentives should be implemented at all levels. 


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 516 no One Month to More Effective HR in Compliance: Day 5 - Role of HR in Incentivizing Compliance Welcome to the August edition of One Month to a More Effective Compliance Program. In the month of August, 2023 we will consider the role of Human Resources in a best practices compliance program. In this episode, Tom Fox explores the role of HR in implementing effective compliance programs within companies. The episode focuses on the importance of incentivizing compliance and ethical behavior through both financial and non-financial incentives. The Department of Justice's guidance emphasizes the need for positive incentives, such as personal evaluations, promotions, and rewards for ethics and compliance leadership. The podcast discusses various avenues for implementing incentives, including cash bonuses and non-compensation rewards like t-shirts or ethical awards. It emphasizes the role of HR in driving the right behavior through incentive structures and warns against solely promoting based on financial targets. Overall, the podcast highlights the significance of HR in creating a fully operationalized compliance program that fosters an ethical work environment.  Three key takeaways: The DOJ 2023 ECCP specifically calls out incentives for doing business ethically and in compliance. HR can lead the efforts around incentives. Incentives go beyond financial rewards. For more information, check out The Compliance Handbook, 4th edition, available on LexisNexis.com. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 07 Aug 2023 04:00:00 -0000 Day 5 - Role of HR in Incentivizing Compliance full 5 Thomas Fox In this episode, we consider the role of HR in incentivizing compliance. Welcome to the August edition of One Month to a More Effective Compliance Program. In the month of August, 2023 we will consider the role of Human Resources in a best practices compliance program. In this episode, Tom Fox explores the role of HR in implementing effective compliance programs within companies. The episode focuses on the importance of incentivizing compliance and ethical behavior through both financial and non-financial incentives. The Department of Justice's guidance emphasizes the need for positive incentives, such as personal evaluations, promotions, and rewards for ethics and compliance leadership. The podcast discusses various avenues for implementing incentives, including cash bonuses and non-compensation rewards like t-shirts or ethical awards. It emphasizes the role of HR in driving the right behavior through incentive structures and warns against solely promoting based on financial targets. Overall, the podcast highlights the significance of HR in creating a fully operationalized compliance program that fosters an ethical work environment.  Three key takeaways: The DOJ 2023 ECCP specifically calls out incentives for doing business ethically and in compliance. HR can lead the efforts around incentives. Incentives go beyond financial rewards. For more information, check out The Compliance Handbook, 4th edition, available on LexisNexis.com. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to the August edition of One Month to a More Effective Compliance Program. In the month of August, 2023 we will consider the role of Human Resources in a best practices compliance program.

In this episode, Tom Fox explores the role of HR in implementing effective compliance programs within companies. The episode focuses on the importance of incentivizing compliance and ethical behavior through both financial and non-financial incentives. The Department of Justice's guidance emphasizes the need for positive incentives, such as personal evaluations, promotions, and rewards for ethics and compliance leadership. The podcast discusses various avenues for implementing incentives, including cash bonuses and non-compensation rewards like t-shirts or ethical awards. It emphasizes the role of HR in driving the right behavior through incentive structures and warns against solely promoting based on financial targets. Overall, the podcast highlights the significance of HR in creating a fully operationalized compliance program that fosters an ethical work environment.

 Three key takeaways:

  1. The DOJ 2023 ECCP specifically calls out incentives for doing business ethically and in compliance.
  2. HR can lead the efforts around incentives.
  3. Incentives go beyond financial rewards.

For more information, check out The Compliance Handbook, 4th edition, available on LexisNexis.com.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 511 no One Month to a More Effective Compliance Program: Day 4-The Reference Check As far back as 2004, in Opinion Release 04-02, the DOJ realized this was an important part of an overall compliance program when it approved a proposed compliance program that had the following requirement, "Clearly articulated procedures which ensure that discretionary authority is not delegated to persons who the company knows have a propensity to engage in illegal or improper activities." One tool that is often overlooked in the hiring process is the reference check. Many practitioners feel that a reference is not of value because prospective candidates will only list references that they believe will provide glowing recommendations of character. This leads to a pro forma reference check. The hiring of someone who will perform business activities in compliance with anti-corruption laws such as the FCPA will continue to be as much art as science because the hiring of quality employees for senior management positions is similarly situated. But that does not mean a company cannot work to not hire those persons who might have a propensity to engage in bribery and corruption if the situation presented itself. The hiring process is just one more tool that can be utilized to build an effective and operationalized compliance program.  Three key takeaways: The hiring process is the first step in operationalizing your compliance program. The DOJ spoke to hiring as part of a best practices compliance program as far back as 2004. Reference checks are an underutilized part of the hiring process and a key internal HR control.  For more information, check out The Compliance Handbook, 4th edition, available on LexisNexis.com. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 04 Aug 2023 04:00:00 -0000 Day 4-The Reference Check full Thomas Fox Why is the humble reference check such a powerful tool for compliance? Find out in this episode. As far back as 2004, in Opinion Release 04-02, the DOJ realized this was an important part of an overall compliance program when it approved a proposed compliance program that had the following requirement, "Clearly articulated procedures which ensure that discretionary authority is not delegated to persons who the company knows have a propensity to engage in illegal or improper activities." One tool that is often overlooked in the hiring process is the reference check. Many practitioners feel that a reference is not of value because prospective candidates will only list references that they believe will provide glowing recommendations of character. This leads to a pro forma reference check. The hiring of someone who will perform business activities in compliance with anti-corruption laws such as the FCPA will continue to be as much art as science because the hiring of quality employees for senior management positions is similarly situated. But that does not mean a company cannot work to not hire those persons who might have a propensity to engage in bribery and corruption if the situation presented itself. The hiring process is just one more tool that can be utilized to build an effective and operationalized compliance program.  Three key takeaways: The hiring process is the first step in operationalizing your compliance program. The DOJ spoke to hiring as part of a best practices compliance program as far back as 2004. Reference checks are an underutilized part of the hiring process and a key internal HR control.  For more information, check out The Compliance Handbook, 4th edition, available on LexisNexis.com. Learn more about your ad choices. Visit megaphone.fm/adchoices As far back as 2004, in Opinion Release 04-02, the DOJ realized this was an important part of an overall compliance program when it approved a proposed compliance program that had the following requirement, "Clearly articulated procedures which ensure that discretionary authority is not delegated to persons who the company knows have a propensity to engage in illegal or improper activities." One tool that is often overlooked in the hiring process is the reference check. Many practitioners feel that a reference is not of value because prospective candidates will only list references that they believe will provide glowing recommendations of character. This leads to a pro forma reference check.

The hiring of someone who will perform business activities in compliance with anti-corruption laws such as the FCPA will continue to be as much art as science because the hiring of quality employees for senior management positions is similarly situated. But that does not mean a company cannot work to not hire those persons who might have a propensity to engage in bribery and corruption if the situation presented itself. The hiring process is just one more tool that can be utilized to build an effective and operationalized compliance program. 

Three key takeaways:

  1. The hiring process is the first step in operationalizing your compliance program.
  2. The DOJ spoke to hiring as part of a best practices compliance program as far back as 2004.
  3. Reference checks are an underutilized part of the hiring process and a key internal HR control. 

For more information, check out The Compliance Handbook, 4th edition, available on LexisNexis.com.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 515 no One Month to a More Effective Compliance Program: Day 3-the Hiring Process and Compliance One of the conventional wisdoms about compliance training is that you will never be able to reach 5% of your workforce with compliance training because they are predisposed to lie, cheat and steal anyway. Whether they are simply sociopaths, scumbags or just bad people; it really does not matter. No amount of training is going to convince them to follow the rules, as they do not think such laws apply to them. They will lie, cheat and steal no matter what industry they are in and what training you provide to them. But knowing such people exist and they may be able to lie, con or otherwise dissimilate their way into your organization does not protect your company from FCPA liability when they inevitably violate the law by engaging in bribery and corruption. It is still the responsibility of your company to prevent and detect such conduct and then remediate if it occurs. This is where your HR function has a dual role, with both their traditional hiring role and in a compliance function. They can work to help weed out such miscreants and to communicate your corporate values of doing business ethically, in compliance and aligned with your corporate values of integrity. Through a structured series of questions, however, a properly trained HR professional can begin to assess whether an employee might have a propensity to engage in bribery and corruption. By adding information about your company’s values towards doing business ethically and in compliance, you can introduce this topic at either the interview evaluating process or in the promotion process. While true sociopaths will most certainly lie to you, perhaps even convincingly, by introducing the topic at such a pre-employment stage, they may be encouraged to take their skills elsewhere Three key takeaways: Use the interview process to determine who will be an ethical and compliance fit for your organization. Consider the skill, will and fit approach. Ask open-ended questions. For more information, check out The Compliance Handbook, 4th edition, available on LexisNexis.com. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 03 Aug 2023 04:00:00 -0000 Day 3-the Hiring Process and Compliance full Thomas Fox How does your hiring process operationalize compliance? Find out in today's episode. One of the conventional wisdoms about compliance training is that you will never be able to reach 5% of your workforce with compliance training because they are predisposed to lie, cheat and steal anyway. Whether they are simply sociopaths, scumbags or just bad people; it really does not matter. No amount of training is going to convince them to follow the rules, as they do not think such laws apply to them. They will lie, cheat and steal no matter what industry they are in and what training you provide to them. But knowing such people exist and they may be able to lie, con or otherwise dissimilate their way into your organization does not protect your company from FCPA liability when they inevitably violate the law by engaging in bribery and corruption. It is still the responsibility of your company to prevent and detect such conduct and then remediate if it occurs. This is where your HR function has a dual role, with both their traditional hiring role and in a compliance function. They can work to help weed out such miscreants and to communicate your corporate values of doing business ethically, in compliance and aligned with your corporate values of integrity. Through a structured series of questions, however, a properly trained HR professional can begin to assess whether an employee might have a propensity to engage in bribery and corruption. By adding information about your company’s values towards doing business ethically and in compliance, you can introduce this topic at either the interview evaluating process or in the promotion process. While true sociopaths will most certainly lie to you, perhaps even convincingly, by introducing the topic at such a pre-employment stage, they may be encouraged to take their skills elsewhere Three key takeaways: Use the interview process to determine who will be an ethical and compliance fit for your organization. Consider the skill, will and fit approach. Ask open-ended questions. For more information, check out The Compliance Handbook, 4th edition, available on LexisNexis.com. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the conventional wisdoms about compliance training is that you will never be able to reach 5% of your workforce with compliance training because they are predisposed to lie, cheat and steal anyway. Whether they are simply sociopaths, scumbags or just bad people; it really does not matter. No amount of training is going to convince them to follow the rules, as they do not think such laws apply to them. They will lie, cheat and steal no matter what industry they are in and what training you provide to them. But knowing such people exist and they may be able to lie, con or otherwise dissimilate their way into your organization does not protect your company from FCPA liability when they inevitably violate the law by engaging in bribery and corruption. It is still the responsibility of your company to prevent and detect such conduct and then remediate if it occurs.

This is where your HR function has a dual role, with both their traditional hiring role and in a compliance function. They can work to help weed out such miscreants and to communicate your corporate values of doing business ethically, in compliance and aligned with your corporate values of integrity.

Through a structured series of questions, however, a properly trained HR professional can begin to assess whether an employee might have a propensity to engage in bribery and corruption. By adding information about your company’s values towards doing business ethically and in compliance, you can introduce this topic at either the interview evaluating process or in the promotion process. While true sociopaths will most certainly lie to you, perhaps even convincingly, by introducing the topic at such a pre-employment stage, they may be encouraged to take their skills elsewhere

Three key takeaways:

  1. Use the interview process to determine who will be an ethical and compliance fit for your organization.
  2. Consider the skill, will and fit approach.
  3. Ask open-ended questions.

For more information, check out The Compliance Handbook, 4th edition, available on LexisNexis.com.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 513 no One Month to More Effective HR in Compliance: Day 2-The Role of HR in Creating an Ethical Culture The 2023 Evaluation of Corporate Compliance Programs, (ECCP), made clear that operationalization of compliance into an organization should be done at multiple levels. The ECCP also called out culture as a key indicia for an ethical culture. Creating an ethical culture is an important step for any company to burn compliance into the DNA of a business. It must be done at every level of an organization on a continuous basis. Human Resources (HR) can play a key role in both the creation and maintenance of an ethical culture. Ethics and compliance blend together in the corporate world. It is not just the responsibility of CCOs and compliance practitioners but of HR to support those employees who want to do the right thing. While written protocols are significant in both detection and prevention, one should never lose sight of a corporate culture as a way to positively impact your workforce and company going forward. Three key takeaways: Beware of the three obstacles to creating an ethical culture. What really matters in your company? A speak up culture will improve the operational performance of your business. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 02 Aug 2023 04:00:00 -0000 Day 2-The Role of HR in Creating an Ethical Culture full Thomas Fox We consider the role of HR in creating an ethical culture The 2023 Evaluation of Corporate Compliance Programs, (ECCP), made clear that operationalization of compliance into an organization should be done at multiple levels. The ECCP also called out culture as a key indicia for an ethical culture. Creating an ethical culture is an important step for any company to burn compliance into the DNA of a business. It must be done at every level of an organization on a continuous basis. Human Resources (HR) can play a key role in both the creation and maintenance of an ethical culture. Ethics and compliance blend together in the corporate world. It is not just the responsibility of CCOs and compliance practitioners but of HR to support those employees who want to do the right thing. While written protocols are significant in both detection and prevention, one should never lose sight of a corporate culture as a way to positively impact your workforce and company going forward. Three key takeaways: Beware of the three obstacles to creating an ethical culture. What really matters in your company? A speak up culture will improve the operational performance of your business. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2023 Evaluation of Corporate Compliance Programs, (ECCP), made clear that operationalization of compliance into an organization should be done at multiple levels. The ECCP also called out culture as a key indicia for an ethical culture. Creating an ethical culture is an important step for any company to burn compliance into the DNA of a business. It must be done at every level of an organization on a continuous basis. Human Resources (HR) can play a key role in both the creation and maintenance of an ethical culture.

Ethics and compliance blend together in the corporate world. It is not just the responsibility of CCOs and compliance practitioners but of HR to support those employees who want to do the right thing. While written protocols are significant in both detection and prevention, one should never lose sight of a corporate culture as a way to positively impact your workforce and company going forward.

Three key takeaways:

  1. Beware of the three obstacles to creating an ethical culture.
  2. What really matters in your company?
  3. A speak up culture will improve the operational performance of your business.


For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 502 no One Month to More Effective HR in Compliance: Day 1-The Role of HR in Compliance I have long advocated for a greater role of Human Resources (HR) in compliance. Indeed, one sign of a mature compliance and ethics program is the extent to which a company’s HR Department is involved in implementing a compliance solution. While many practitioners do not immediately consider HR as a key component of a best practices compliance solution, it can be one of the lynch pins in spreading a company’s commitment to compliance throughout the employee base. HR can also be used to ‘connect the dots’ in many divergent elements of a compliance and ethics program. Even more important is the operationalization of compliance into the fabric of the business. One of the key indicia of compliance program effectiveness is how thoroughly each separate corporate discipline incorporates compliance into its everyday job functions. An active and functioning compliance program will literally be alive in each department in an organization. HR has as many touchpoints as any other corporation function with employees. From interviews to onboarding, through evaluations and performance appraisals, even to the separation process; HR leads many of the corporate touchpoints. Each one of these touchpoints can be used to teach, educate and reinforce the message of doing business ethically and in compliance with anti-corruption laws Three key takeaways: What are the HR-employee touchpoints at your company? HR professionals can bring new, dynamic and innovative techniques to compliance Go down and have a cup of coffee with the head of your corporate HR department. Find out what they do and how they do it. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 01 Aug 2023 04:00:00 -0000 Day 1-The Role of HR in Compliance full Thomas Fox Today we begin a one month look at the role of HR in compliance. I have long advocated for a greater role of Human Resources (HR) in compliance. Indeed, one sign of a mature compliance and ethics program is the extent to which a company’s HR Department is involved in implementing a compliance solution. While many practitioners do not immediately consider HR as a key component of a best practices compliance solution, it can be one of the lynch pins in spreading a company’s commitment to compliance throughout the employee base. HR can also be used to ‘connect the dots’ in many divergent elements of a compliance and ethics program. Even more important is the operationalization of compliance into the fabric of the business. One of the key indicia of compliance program effectiveness is how thoroughly each separate corporate discipline incorporates compliance into its everyday job functions. An active and functioning compliance program will literally be alive in each department in an organization. HR has as many touchpoints as any other corporation function with employees. From interviews to onboarding, through evaluations and performance appraisals, even to the separation process; HR leads many of the corporate touchpoints. Each one of these touchpoints can be used to teach, educate and reinforce the message of doing business ethically and in compliance with anti-corruption laws Three key takeaways: What are the HR-employee touchpoints at your company? HR professionals can bring new, dynamic and innovative techniques to compliance Go down and have a cup of coffee with the head of your corporate HR department. Find out what they do and how they do it. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices I have long advocated for a greater role of Human Resources (HR) in compliance. Indeed, one sign of a mature compliance and ethics program is the extent to which a company’s HR Department is involved in implementing a compliance solution. While many practitioners do not immediately consider HR as a key component of a best practices compliance solution, it can be one of the lynch pins in spreading a company’s commitment to compliance throughout the employee base. HR can also be used to ‘connect the dots’ in many divergent elements of a compliance and ethics program.

Even more important is the operationalization of compliance into the fabric of the business. One of the key indicia of compliance program effectiveness is how thoroughly each separate corporate discipline incorporates compliance into its everyday job functions. An active and functioning compliance program will literally be alive in each department in an organization.

HR has as many touchpoints as any other corporation function with employees. From interviews to onboarding, through evaluations and performance appraisals, even to the separation process; HR leads many of the corporate touchpoints. Each one of these touchpoints can be used to teach, educate and reinforce the message of doing business ethically and in compliance with anti-corruption laws

Three key takeaways:

  1. What are the HR-employee touchpoints at your company?
  2. HR professionals can bring new, dynamic and innovative techniques to compliance
  3. Go down and have a cup of coffee with the head of your corporate HR department. Find out what they do and how they do it.


For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 484 no One Month to More Effective Reporting and Investigations - the Parameters of Privilege The concept of privilege in an internal investigation is critical. Two important privileges are the attorney-client privilege and the work product privilege. Unfortunately, both are often misunderstood, miss-applied and consequently lost. To determine whether you have a valid privilege claim, it is incumbent to understand the parameters of the attorney-client privilege. In presentation, entitled “Attorney-Client Privilege ”, David E. Keltner, Kelly Hart & Hallman LLP, Elizabeth Brummett and Adrienne Parham, both from University of Texas Law School, wrote that under U.S. federal law, the attorney-client privilege applies when the following are present:  A client is seeking legal advice or a lawyer’s services; The person to whom the communication is made is a lawyer or his or her representative; The communication relates to a fact disclosed from a client (a representative) to a lawyer (a representative); Strangers are not present; A client requires confidentiality. In addition to the attorney-client privilege there is another privilege which can come into play around internal investigations. It is the attorney work-product doctrine. Keltner noted, “The attorney-client privilege and the attorney work-product doctrine are often asserted interchangeably. While there is some overlap between the two, the attorney-client privilege is significantly different than the attorney work-product doctrine.” Moreover as “codified in Fed R.Civ. P. 26(b)(3), [the attorney/work product] provides a qualified protection to materials prepared by party’s counsel or other representative in the anticipation of litigation.” The doctrine exists “because it permits lawyers to “work with a certain degree of privacy, free from unnecessary intrusion by opposing parties . . .”” Three key takeaways: Note the differences in the attorney-client privilege and attorney work-product doctrine. Both can be waived intentionally or through inadvertent conduct. Take care on attorney work-product outside the U.S., where there may be no privilege at all. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 31 Jul 2023 04:00:00 -0000 The Parameters of Privilege full Thomas Fox In this episode we consider the Parameters of Privilege. The concept of privilege in an internal investigation is critical. Two important privileges are the attorney-client privilege and the work product privilege. Unfortunately, both are often misunderstood, miss-applied and consequently lost. To determine whether you have a valid privilege claim, it is incumbent to understand the parameters of the attorney-client privilege. In presentation, entitled “Attorney-Client Privilege ”, David E. Keltner, Kelly Hart & Hallman LLP, Elizabeth Brummett and Adrienne Parham, both from University of Texas Law School, wrote that under U.S. federal law, the attorney-client privilege applies when the following are present:  A client is seeking legal advice or a lawyer’s services; The person to whom the communication is made is a lawyer or his or her representative; The communication relates to a fact disclosed from a client (a representative) to a lawyer (a representative); Strangers are not present; A client requires confidentiality. In addition to the attorney-client privilege there is another privilege which can come into play around internal investigations. It is the attorney work-product doctrine. Keltner noted, “The attorney-client privilege and the attorney work-product doctrine are often asserted interchangeably. While there is some overlap between the two, the attorney-client privilege is significantly different than the attorney work-product doctrine.” Moreover as “codified in Fed R.Civ. P. 26(b)(3), [the attorney/work product] provides a qualified protection to materials prepared by party’s counsel or other representative in the anticipation of litigation.” The doctrine exists “because it permits lawyers to “work with a certain degree of privacy, free from unnecessary intrusion by opposing parties . . .”” Three key takeaways: Note the differences in the attorney-client privilege and attorney work-product doctrine. Both can be waived intentionally or through inadvertent conduct. Take care on attorney work-product outside the U.S., where there may be no privilege at all. Learn more about your ad choices. Visit megaphone.fm/adchoices The concept of privilege in an internal investigation is critical. Two important privileges are the attorney-client privilege and the work product privilege. Unfortunately, both are often misunderstood, miss-applied and consequently lost. To determine whether you have a valid privilege claim, it is incumbent to understand the parameters of the attorney-client privilege. In presentation, entitled “Attorney-Client Privilege ”, David E. Keltner, Kelly Hart & Hallman LLP, Elizabeth Brummett and Adrienne Parham, both from University of Texas Law School, wrote that under U.S. federal law, the attorney-client privilege applies when the following are present:

  1.  A client is seeking legal advice or a lawyer’s services;
  2. The person to whom the communication is made is a lawyer or his or her representative;
  3. The communication relates to a fact disclosed from a client (a representative) to a lawyer (a representative);
  4. Strangers are not present;
  5. A client requires confidentiality.

In addition to the attorney-client privilege there is another privilege which can come into play around internal investigations. It is the attorney work-product doctrine. Keltner noted, “The attorney-client privilege and the attorney work-product doctrine are often asserted interchangeably. While there is some overlap between the two, the attorney-client privilege is significantly different than the attorney work-product doctrine.” Moreover as “codified in Fed R.Civ. P. 26(b)(3), [the attorney/work product] provides a qualified protection to materials prepared by party’s counsel or other representative in the anticipation of litigation.” The doctrine exists “because it permits lawyers to “work with a certain degree of privacy, free from unnecessary intrusion by opposing parties . . .””

Three key takeaways:

  1. Note the differences in the attorney-client privilege and attorney work-product doctrine.
  2. Both can be waived intentionally or through inadvertent conduct.
  3. Take care on attorney work-product outside the U.S., where there may be no privilege at all.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 532 no One Month to More Effective Reporting and Investigations - Miranda Warnings for Employees? Must an investigator warn an employee that concealing information from company lawyers conducting an internal FCPA investigation could be a federal crime? Even if the company attorneys provided the now standard corporate attorney Upjohn warning? Does a company attorney asking questions morph into a de facto federal agent during an internal company investigation regarding alleged FCPA violations and is the attorney thereby required to provide a Mirandawarning to employees during said investigation? Employees who are subject to being interviewed or otherwise required to cooperate in an internal investigation may find themselves on the sharp horns of a dilemma requiring either (1) cooperating with the internal investigation or (2) losing their jobs for failure to cooperate by providing documents, testimony or other evidence. Many U.S. businesses mandate full employee cooperation with internal investigations or those handled by outside counsel on behalf of a corporation. These requirements can exert a coercive force, “often inducing employees to act contrary to their personal legal interests in favor of candidly disclosing wrongdoing to corporate counsel.” Moreover, such a corporate policy may permit a company to claim to the government a spirit of cooperation in the hopes of avoiding prosecution in addition to increasing the chances of earning meaningful credit under the U.S. Sentencing Guidelines or the FCPA Corporate Enforcement Policy. Three key takeaways: Make sure you provide an Upjohn warning. If an employee demands counsel to represent them during an internal investigation, who bears the cost? Always check state law requirements around internal investigations. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 28 Jul 2023 04:00:00 -0000 Miranda Warnings for Employees? full Thomas Fox In this episode we consider if employees are entitled to Miranda Warnings. Must an investigator warn an employee that concealing information from company lawyers conducting an internal FCPA investigation could be a federal crime? Even if the company attorneys provided the now standard corporate attorney Upjohn warning? Does a company attorney asking questions morph into a de facto federal agent during an internal company investigation regarding alleged FCPA violations and is the attorney thereby required to provide a Mirandawarning to employees during said investigation? Employees who are subject to being interviewed or otherwise required to cooperate in an internal investigation may find themselves on the sharp horns of a dilemma requiring either (1) cooperating with the internal investigation or (2) losing their jobs for failure to cooperate by providing documents, testimony or other evidence. Many U.S. businesses mandate full employee cooperation with internal investigations or those handled by outside counsel on behalf of a corporation. These requirements can exert a coercive force, “often inducing employees to act contrary to their personal legal interests in favor of candidly disclosing wrongdoing to corporate counsel.” Moreover, such a corporate policy may permit a company to claim to the government a spirit of cooperation in the hopes of avoiding prosecution in addition to increasing the chances of earning meaningful credit under the U.S. Sentencing Guidelines or the FCPA Corporate Enforcement Policy. Three key takeaways: Make sure you provide an Upjohn warning. If an employee demands counsel to represent them during an internal investigation, who bears the cost? Always check state law requirements around internal investigations. Learn more about your ad choices. Visit megaphone.fm/adchoices Must an investigator warn an employee that concealing information from company lawyers conducting an internal FCPA investigation could be a federal crime? Even if the company attorneys provided the now standard corporate attorney Upjohn warning? Does a company attorney asking questions morph into a de facto federal agent during an internal company investigation regarding alleged FCPA violations and is the attorney thereby required to provide a Mirandawarning to employees during said investigation?

Employees who are subject to being interviewed or otherwise required to cooperate in an internal investigation may find themselves on the sharp horns of a dilemma requiring either (1) cooperating with the internal investigation or (2) losing their jobs for failure to cooperate by providing documents, testimony or other evidence. Many U.S. businesses mandate full employee cooperation with internal investigations or those handled by outside counsel on behalf of a corporation. These requirements can exert a coercive force, “often inducing employees to act contrary to their personal legal interests in favor of candidly disclosing wrongdoing to corporate counsel.” Moreover, such a corporate policy may permit a company to claim to the government a spirit of cooperation in the hopes of avoiding prosecution in addition to increasing the chances of earning meaningful credit under the U.S. Sentencing Guidelines or the FCPA Corporate Enforcement Policy.

Three key takeaways:

  1. Make sure you provide an Upjohn warning.
  2. If an employee demands counsel to represent them during an internal investigation, who bears the cost?
  3. Always check state law requirements around internal investigations.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 550 no One Month to More Effective Reporting and Investigations - Board Investigations In their article, “Successful Board Investigations”, David Bayless and Tammy Albarrán, offered seven considerations to facilitate a successful Board investigation.  Consider whether you need independent outside counsel.  Consider hiring an experienced investigator to lead the internal investigation.  Consider the need to retain outside experts.  Analyze potential conflicts of interest at the outset and during the investigation.  Carefully evaluate whistleblower allegations.  Request regular updates from outside counsel, without limiting the investigation.  Consider whether an oral report at the conclusion of the investigation is sufficient.  The authors conclude their piece by stating, “By keeping in mind the issues addressed above, the Board will be better prepared for the investigation and readily able to exercise good judgment throughout the review. A well-conducted investigation by the Board may spare the company further disruption and costs associated with follow-on investigations by the regulators, or at the very least minimize the company’s exposure.” Three key takeaways: Retain the right counsel. Consider conflicts and appearance. Carefully evaluate all whistleblower allegations and reject retaliation. Consider receiving oral reports on an ongoing basis and one lengthy oral report at the end of the investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 27 Jul 2023 04:00:00 -0000 Board Investigations full Thomas Fox Today we look at the Board Investigations. In their article, “Successful Board Investigations”, David Bayless and Tammy Albarrán, offered seven considerations to facilitate a successful Board investigation.  Consider whether you need independent outside counsel.  Consider hiring an experienced investigator to lead the internal investigation.  Consider the need to retain outside experts.  Analyze potential conflicts of interest at the outset and during the investigation.  Carefully evaluate whistleblower allegations.  Request regular updates from outside counsel, without limiting the investigation.  Consider whether an oral report at the conclusion of the investigation is sufficient.  The authors conclude their piece by stating, “By keeping in mind the issues addressed above, the Board will be better prepared for the investigation and readily able to exercise good judgment throughout the review. A well-conducted investigation by the Board may spare the company further disruption and costs associated with follow-on investigations by the regulators, or at the very least minimize the company’s exposure.” Three key takeaways: Retain the right counsel. Consider conflicts and appearance. Carefully evaluate all whistleblower allegations and reject retaliation. Consider receiving oral reports on an ongoing basis and one lengthy oral report at the end of the investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices In their article, “Successful Board Investigations”, David Bayless and Tammy Albarrán, offered seven considerations to facilitate a successful Board investigation. 

  • Consider whether you need independent outside counsel. 
  • Consider hiring an experienced investigator to lead the internal investigation. 
  • Consider the need to retain outside experts. 
  • Analyze potential conflicts of interest at the outset and during the investigation. 
  • Carefully evaluate whistleblower allegations. 
  • Request regular updates from outside counsel, without limiting the investigation. 
  • Consider whether an oral report at the conclusion of the investigation is sufficient. 

The authors conclude their piece by stating, “By keeping in mind the issues addressed above, the Board will be better prepared for the investigation and readily able to exercise good judgment throughout the review. A well-conducted investigation by the Board may spare the company further disruption and costs associated with follow-on investigations by the regulators, or at the very least minimize the company’s exposure.”

Three key takeaways:

  1. Retain the right counsel. Consider conflicts and appearance.
  2. Carefully evaluate all whistleblower allegations and reject retaliation.
  3. Consider receiving oral reports on an ongoing basis and one lengthy oral report at the end of the investigation.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 554 no One Month to More Effective Reporting and Investigations - Board Investigation Protocols Many companies have an investigation protocol in place when a potential compliance violation or other legal issue arises. However, many Boards of Directors do not have the same rigor when it comes to an investigation, which should be conducted or led by the Board itself. The consequences of this lack of foresight can be problematic, because if a Board does handle an investigation right, the consequences to the company, its reputation and value can be quite severe. The SEC considers a variety of factors around corporate investigations including: Did management, the board or committees consisting solely of outside directors oversee the review? Did company employees or outside persons perform the review? If outside persons, have they done other work for the company? Dan Chapman has said this is the time for a very frank conversation with your Board about what such an investigation will entail. Costs must be adequately discussed to set proper expectations. These include both direct costs and, what Chapman believes may be even more important, a discussion of indirect costs to the company. He noted, “the biggest cost to a company during an investigation is the diversion of management resources” and, as he further explained, “everything stops to focus on the investigation.” This indirect cost comes through largely the time commitment of senior management. He further explained, “if senior management has to commit 20% of their time to the investigation, that’s 20% that’s not going towards revenue generating, shareholder value protecting activities.” Finally, Jonathan Marks has noted after notification of serious allegations, Boards should take the following steps: • Consider creating a Special Committee to conduct the investigation; • Establish a committee charter; • Preserve the electronic and hardcopy documentation environment; • Communicate with external auditors; and • Plan potential communication with the SEC, DOJ, and the relevant stock exchange. Marks also notes that while a special committee might be necessary in certain rare circumstances, the Board should try to avoid forming a special investigative committee to oversee the investigation if the Audit Committee is composed of independent and disinterested directors that are suited for the task. A special committee must be disbanded at some point (usually once the investigation is completed and before the restatement process begins), and the disbanding could become a complicated news item. Conversely, if the Audit Committee oversees the investigation, then, once the investigation is complete, they can pivot back to their normal role, which would include overseeing the actual restatement process. Investigations overseen by the Audit Committee also benefit from the positive relationship that the committee chair usually has with the audit partner of the company’s external auditor.  Three key takeaways: 1. The Board should have a written protocol for investigations prepared in advance. 2. Any Board led investigation must be both credible and objective. 3. The investigation must be thorough but the Board can be cost effective. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 26 Jul 2023 04:00:00 -0000 Board Investigation Protocols full Thomas Fox Today we take up the Board investigation protocol. Many companies have an investigation protocol in place when a potential compliance violation or other legal issue arises. However, many Boards of Directors do not have the same rigor when it comes to an investigation, which should be conducted or led by the Board itself. The consequences of this lack of foresight can be problematic, because if a Board does handle an investigation right, the consequences to the company, its reputation and value can be quite severe. The SEC considers a variety of factors around corporate investigations including: Did management, the board or committees consisting solely of outside directors oversee the review? Did company employees or outside persons perform the review? If outside persons, have they done other work for the company? Dan Chapman has said this is the time for a very frank conversation with your Board about what such an investigation will entail. Costs must be adequately discussed to set proper expectations. These include both direct costs and, what Chapman believes may be even more important, a discussion of indirect costs to the company. He noted, “the biggest cost to a company during an investigation is the diversion of management resources” and, as he further explained, “everything stops to focus on the investigation.” This indirect cost comes through largely the time commitment of senior management. He further explained, “if senior management has to commit 20% of their time to the investigation, that’s 20% that’s not going towards revenue generating, shareholder value protecting activities.” Finally, Jonathan Marks has noted after notification of serious allegations, Boards should take the following steps: • Consider creating a Special Committee to conduct the investigation; • Establish a committee charter; • Preserve the electronic and hardcopy documentation environment; • Communicate with external auditors; and • Plan potential communication with the SEC, DOJ, and the relevant stock exchange. Marks also notes that while a special committee might be necessary in certain rare circumstances, the Board should try to avoid forming a special investigative committee to oversee the investigation if the Audit Committee is composed of independent and disinterested directors that are suited for the task. A special committee must be disbanded at some point (usually once the investigation is completed and before the restatement process begins), and the disbanding could become a complicated news item. Conversely, if the Audit Committee oversees the investigation, then, once the investigation is complete, they can pivot back to their normal role, which would include overseeing the actual restatement process. Investigations overseen by the Audit Committee also benefit from the positive relationship that the committee chair usually has with the audit partner of the company’s external auditor.  Three key takeaways: 1. The Board should have a written protocol for investigations prepared in advance. 2. Any Board led investigation must be both credible and objective. 3. The investigation must be thorough but the Board can be cost effective. Learn more about your ad choices. Visit megaphone.fm/adchoices Many companies have an investigation protocol in place when a potential compliance violation or other legal issue arises. However, many Boards of Directors do not have the same rigor when it comes to an investigation, which should be conducted or led by the Board itself. The consequences of this lack of foresight can be problematic, because if a Board does handle an investigation right, the consequences to the company, its reputation and value can be quite severe. The SEC considers a variety of factors around corporate investigations including: Did management, the board or committees consisting solely of outside directors oversee the review? Did company employees or outside persons perform the review? If outside persons, have they done other work for the company?

Dan Chapman has said this is the time for a very frank conversation with your Board about what such an investigation will entail. Costs must be adequately discussed to set proper expectations. These include both direct costs and, what Chapman believes may be even more important, a discussion of indirect costs to the company. He noted, “the biggest cost to a company during an investigation is the diversion of management resources” and, as he further explained, “everything stops to focus on the investigation.” This indirect cost comes through largely the time commitment of senior management. He further explained, “if senior management has to commit 20% of their time to the investigation, that’s 20% that’s not going towards revenue generating, shareholder value protecting activities.”

Finally, Jonathan Marks has noted after notification of serious allegations, Boards should take the following steps:

• Consider creating a Special Committee to conduct the investigation;

• Establish a committee charter;

• Preserve the electronic and hardcopy documentation environment;

• Communicate with external auditors; and

• Plan potential communication with the SEC, DOJ, and the relevant stock exchange.

Marks also notes that while a special committee might be necessary in certain rare circumstances, the Board should try to avoid forming a special investigative committee to oversee the investigation if the Audit Committee is composed of independent and disinterested directors that are suited for the task. A special committee must be disbanded at some point (usually once the investigation is completed and before the restatement process begins), and the disbanding could become a complicated news item. Conversely, if the Audit Committee oversees the investigation, then, once the investigation is complete, they can pivot back to their normal role, which would include overseeing the actual restatement process. Investigations overseen by the Audit Committee also benefit from the positive relationship that the committee chair usually has with the audit partner of the company’s external auditor.

 Three key takeaways:

1. The Board should have a written protocol for investigations prepared in advance.

2. Any Board led investigation must be both credible and objective.

3. The investigation must be thorough but the Board can be cost effective.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 554 One Month to Better Reporting and Investigations - How an investigation informs remediation There is nothing like an internal whistleblower report about a FCPA violation, the finding of such an issue or (even worse) a subpoena from the DOJ to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check. In addition to robust investigation, a company must engage in remediation of the offending conduct. The 2020 Update to the Evaluation of Corporate Compliance Programs mandated the additional significance of this by providing that this process must be considered “both at the time of the offense and at the time of the charging decision and resolution”. When you consider the strictures around continuous monitoring and continuous improvement in compliance programs it is clear why this analysis is so important. Obviously, a key test of any compliance program is when a deficiency is found and a violation occurs. The question then becomes, what did you do about it. But from the DOJ (and Securities and Exchange Commission) perspective, the key is to use the information to both fix the problem so that it does not occur again but also improve your compliance regime. Three key takeaways: How does your investigation inform your remediation plan? A compliance program failure offers a way to upgrade your regime. Your investigative team must inform your remediation team. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 25 Jul 2023 04:00:00 -0000 How an investigation informs remediation full Thomas Fox Today we consider How an investigation informs remediation. There is nothing like an internal whistleblower report about a FCPA violation, the finding of such an issue or (even worse) a subpoena from the DOJ to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check. In addition to robust investigation, a company must engage in remediation of the offending conduct. The 2020 Update to the Evaluation of Corporate Compliance Programs mandated the additional significance of this by providing that this process must be considered “both at the time of the offense and at the time of the charging decision and resolution”. When you consider the strictures around continuous monitoring and continuous improvement in compliance programs it is clear why this analysis is so important. Obviously, a key test of any compliance program is when a deficiency is found and a violation occurs. The question then becomes, what did you do about it. But from the DOJ (and Securities and Exchange Commission) perspective, the key is to use the information to both fix the problem so that it does not occur again but also improve your compliance regime. Three key takeaways: How does your investigation inform your remediation plan? A compliance program failure offers a way to upgrade your regime. Your investigative team must inform your remediation team. Learn more about your ad choices. Visit megaphone.fm/adchoices There is nothing like an internal whistleblower report about a FCPA violation, the finding of such an issue or (even worse) a subpoena from the DOJ to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check.

In addition to robust investigation, a company must engage in remediation of the offending conduct. The 2020 Update to the Evaluation of Corporate Compliance Programs mandated the additional significance of this by providing that this process must be considered “both at the time of the offense and at the time of the charging decision and resolution”. When you consider the strictures around continuous monitoring and continuous improvement in compliance programs it is clear why this analysis is so important. Obviously, a key test of any compliance program is when a deficiency is found and a violation occurs. The question then becomes, what did you do about it.

But from the DOJ (and Securities and Exchange Commission) perspective, the key is to use the information to both fix the problem so that it does not occur again but also improve your compliance regime.

Three key takeaways:

  1. How does your investigation inform your remediation plan?
  2. A compliance program failure offers a way to upgrade your regime.
  3. Your investigative team must inform your remediation team.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 546 no One Month to More Effective Reporting and Investigations – Issues in Cross Border Investigations In an article, entitled “Internal Investigations, How to Conduct an Anti-Corruption Investigation: Developing and Implementing the Investigation Plan”, Mara Senn, now Director & Senior Counsel, Global Compliance Investigations at Zimmer Biomet and Michelle K. Albert, former lawyer at Arnold & Porter discussed cross-border investigations. They considered the following issues. Offer interview translations. Avoid cultural pitfalls. Observe data privacy restrictions. Comply with labor requirements. Be aware of other local requirements. Put forms in native translations. Preserve the attorney-client privilege. Prepare for local enforcement actions. Prepare for security risks. Protect whistleblowers. Three key takeaways: Use translators and translations of key documents in witness interviews. Use local counsel to facilitate the investigation and to help navigate any local anti-corruption investigation issues. Never, never, never retaliate. The SEC will pay whistleblower bounties for non-U.S. citizens. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 24 Jul 2023 04:00:00 -0000 Issues in Cross Border Investigations full Thomas Fox In this episode we consider Issues in Cross Border Investigations. In an article, entitled “Internal Investigations, How to Conduct an Anti-Corruption Investigation: Developing and Implementing the Investigation Plan”, Mara Senn, now Director & Senior Counsel, Global Compliance Investigations at Zimmer Biomet and Michelle K. Albert, former lawyer at Arnold & Porter discussed cross-border investigations. They considered the following issues. Offer interview translations. Avoid cultural pitfalls. Observe data privacy restrictions. Comply with labor requirements. Be aware of other local requirements. Put forms in native translations. Preserve the attorney-client privilege. Prepare for local enforcement actions. Prepare for security risks. Protect whistleblowers. Three key takeaways: Use translators and translations of key documents in witness interviews. Use local counsel to facilitate the investigation and to help navigate any local anti-corruption investigation issues. Never, never, never retaliate. The SEC will pay whistleblower bounties for non-U.S. citizens. Learn more about your ad choices. Visit megaphone.fm/adchoices In an article, entitled “Internal Investigations, How to Conduct an Anti-Corruption Investigation: Developing and Implementing the Investigation Plan”, Mara Senn, now Director & Senior Counsel, Global Compliance Investigations at Zimmer Biomet and Michelle K. Albert, former lawyer at Arnold & Porter discussed cross-border investigations. They considered the following issues.

Offer interview translations.

Avoid cultural pitfalls.

Observe data privacy restrictions.

Comply with labor requirements.

Be aware of other local requirements.

Put forms in native translations.

Preserve the attorney-client privilege.

Prepare for local enforcement actions.

Prepare for security risks.

Protect whistleblowers.

Three key takeaways:

  1. Use translators and translations of key documents in witness interviews.
  2. Use local counsel to facilitate the investigation and to help navigate any local anti-corruption investigation issues.
  3. Never, never, never retaliate. The SEC will pay whistleblower bounties for non-U.S. citizens.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 540 no One Month to More Effective Reporting and Investigations – The Witness Interview https://compliancepodcastnetwork.net/the-witness-interview/ What are the characteristics of a good interview in the context of an internal investigation? Is there one technique you can use which will provide you the results you want to achieve? How should you think through your questions and document review prior to the investigation? At this point in time, how do such issues play out in the time of Coronavirus? There is no one right way to prepare for and conduct an interview. What is important is that you have a plan and execute on that plan. Begin by obtaining an understanding of what the various stakeholders want answers to. This could include the Board of Directors, C-Suite executives, the GC and legal department, the CCO and compliance function or up to government regulators such as the SEC or DOJ. Three key takeaways: There is no one right way to prepare and do an interview. The interview should not be confrontational. The interview, like the entire investigation process, is a chess match. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 21 Jul 2023 04:00:00 -0000 The Witness Interview full Thomas Fox In this episode, we consider the witness interview. What are the characteristics of a good interview in the context of an internal investigation? Is there one technique you can use which will provide you the results you want to achieve? How should you think through your questions and document review prior to the investigation? At this point in time, how do such issues play out in the time of Coronavirus? There is no one right way to prepare for and conduct an interview. What is important is that you have a plan and execute on that plan. Begin by obtaining an understanding of what the various stakeholders want answers to. This could include the Board of Directors, C-Suite executives, the GC and legal department, the CCO and compliance function or up to government regulators such as the SEC or DOJ. Three key takeaways: There is no one right way to prepare and do an interview. The interview should not be confrontational. The interview, like the entire investigation process, is a chess match. Learn more about your ad choices. Visit megaphone.fm/adchoices What are the characteristics of a good interview in the context of an internal investigation? Is there one technique you can use which will provide you the results you want to achieve? How should you think through your questions and document review prior to the investigation? At this point in time, how do such issues play out in the time of Coronavirus?

There is no one right way to prepare for and conduct an interview. What is important is that you have a plan and execute on that plan. Begin by obtaining an understanding of what the various stakeholders want answers to. This could include the Board of Directors, C-Suite executives, the GC and legal department, the CCO and compliance function or up to government regulators such as the SEC or DOJ.

Three key takeaways:

  1. There is no one right way to prepare and do an interview.
  2. The interview should not be confrontational.
  3. The interview, like the entire investigation process, is a chess match.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 537 no One Month to More Effective Reporting and Investigations - Investigative Challenges What are some of the top challenges you may well face during an investigation? Beyond the basics, a company must consider the intake process as a starting point, which Jonathan Marks noted is one of the biggest challenges. Rather surprisingly, he noted there are still companies without a hotline or anonymous reporting system, stating “we still see organizations whereby there is no formal ethics hotline except for the fact that they might send an email to some member of management or some member of the Board.” Planning your investigation, having the right team members involved and meeting the challenges which inevitably arise during an investigation can be difficult. However, beginning with the DOJ’s 2015 Yates Memo, the 2016 FCPA Pilot Program, and the 2017 and 2019 versions Evaluation of Corporate Compliance Programs, together with the 2020 Update, 2023 ECCP and FCPA Corporate Enforcement Policy, the pressure on every CCO and company to get an investigation done quickly, efficiently and, most importantly, right is even greater now. Marks has laid out a concrete way for you to think through how to plan an investigation, staff it properly and meet the inevitable challenges. Three key takeaways: The intake process may seem the most straight-forward but many companies drop the ball at this initial step. You must never retaliate against employees who come forward in good faith. Always think several steps ahead. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 20 Jul 2023 04:00:00 -0000 Investigative Challenges full Thomas Fox Next we consider key investigative challenges. What are some of the top challenges you may well face during an investigation? Beyond the basics, a company must consider the intake process as a starting point, which Jonathan Marks noted is one of the biggest challenges. Rather surprisingly, he noted there are still companies without a hotline or anonymous reporting system, stating “we still see organizations whereby there is no formal ethics hotline except for the fact that they might send an email to some member of management or some member of the Board.” Planning your investigation, having the right team members involved and meeting the challenges which inevitably arise during an investigation can be difficult. However, beginning with the DOJ’s 2015 Yates Memo, the 2016 FCPA Pilot Program, and the 2017 and 2019 versions Evaluation of Corporate Compliance Programs, together with the 2020 Update, 2023 ECCP and FCPA Corporate Enforcement Policy, the pressure on every CCO and company to get an investigation done quickly, efficiently and, most importantly, right is even greater now. Marks has laid out a concrete way for you to think through how to plan an investigation, staff it properly and meet the inevitable challenges. Three key takeaways: The intake process may seem the most straight-forward but many companies drop the ball at this initial step. You must never retaliate against employees who come forward in good faith. Always think several steps ahead. Learn more about your ad choices. Visit megaphone.fm/adchoices What are some of the top challenges you may well face during an investigation? Beyond the basics, a company must consider the intake process as a starting point, which Jonathan Marks noted is one of the biggest challenges. Rather surprisingly, he noted there are still companies without a hotline or anonymous reporting system, stating “we still see organizations whereby there is no formal ethics hotline except for the fact that they might send an email to some member of management or some member of the Board.”

Planning your investigation, having the right team members involved and meeting the challenges which inevitably arise during an investigation can be difficult. However, beginning with the DOJ’s 2015 Yates Memo, the 2016 FCPA Pilot Program, and the 2017 and 2019 versions Evaluation of Corporate Compliance Programs, together with the 2020 Update, 2023 ECCP and FCPA Corporate Enforcement Policy, the pressure on every CCO and company to get an investigation done quickly, efficiently and, most importantly, right is even greater now. Marks has laid out a concrete way for you to think through how to plan an investigation, staff it properly and meet the inevitable challenges.

Three key takeaways:

  1. The intake process may seem the most straight-forward but many companies drop the ball at this initial step.
  2. You must never retaliate against employees who come forward in good faith.
  3. Always think several steps ahead.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 550 no One Month to More Effective Reporting and Investigations - The Investigative Team https://compliancepodcastnetwork.net/one-month-to-more-effective-reporting-and-investigations-the-investigative-team12812-2/ Since 2015, DOJ has put even more pressure on every CCO, compliance practitioner, and indeed company, to get an investigation done quickly, efficiently, and, most importantly, right. This is even more true after the U.S. Supreme Court’s decisions in Digital Realty Trust v. Somers, which limited whistleblower protection and benefits to only those whistleblowers who go to the SEC, rather than initially report internally. What do all these documents tell who should be on your investigation team? As data collection, retention and preservation are critical elements of any significant internal investigation you will need to have the involvement of your IT function. IT can help put a litigation hold on documents that can help with the preservation of data in other areas of the organization. Further, they can assist with certain other aspects as more facts and circumstances are known. HR is often an underutilized function for an internal investigator. HR can provide context about employees’ work history. There may be notes in HR areas as diverse as training and exit interviews. HR can also give the investigator some insight regarding the credibility of the individual who might be making the allegation. For example, are they good and trusted employees? How long have they been there? What’s their general demeanor? What’s been the feedback on that particular individual? Forensic accountants should be a part of your investigation team. Such a skilled set team member can bring an investigative mind that drives them to answer questions about what occurred, when and how it happened, and who was involved. However, most lawyers do not understand how forensic accounting is performed and how they can assist your compliance investigation going forward. Obviously, the GC would be involved to help protect the attorney-client privilege if for no other reason. Further, an investigation needs to have compliance involved, to understand what compliance program was in place at the time of the incident in question, what procedures submission had, and understand if this truly was a gap in the compliance function or maybe there was an area within the compliance function that was not operating as prescribed, or maybe it was a little bit weak.   Three key takeaways: 1. HR plays a key but often underused role in internal investigations. 2. The Board of Directors and senior management have different roles. 3. Use your legal department to protect the privilege. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 19 Jul 2023 04:00:00 -0000 The Investigative Team full Thomas Fox Today we consider who should be on your Investigation Team. Since 2015, DOJ has put even more pressure on every CCO, compliance practitioner, and indeed company, to get an investigation done quickly, efficiently, and, most importantly, right. This is even more true after the U.S. Supreme Court’s decisions in Digital Realty Trust v. Somers, which limited whistleblower protection and benefits to only those whistleblowers who go to the SEC, rather than initially report internally. What do all these documents tell who should be on your investigation team? As data collection, retention and preservation are critical elements of any significant internal investigation you will need to have the involvement of your IT function. IT can help put a litigation hold on documents that can help with the preservation of data in other areas of the organization. Further, they can assist with certain other aspects as more facts and circumstances are known. HR is often an underutilized function for an internal investigator. HR can provide context about employees’ work history. There may be notes in HR areas as diverse as training and exit interviews. HR can also give the investigator some insight regarding the credibility of the individual who might be making the allegation. For example, are they good and trusted employees? How long have they been there? What’s their general demeanor? What’s been the feedback on that particular individual? Forensic accountants should be a part of your investigation team. Such a skilled set team member can bring an investigative mind that drives them to answer questions about what occurred, when and how it happened, and who was involved. However, most lawyers do not understand how forensic accounting is performed and how they can assist your compliance investigation going forward. Obviously, the GC would be involved to help protect the attorney-client privilege if for no other reason. Further, an investigation needs to have compliance involved, to understand what compliance program was in place at the time of the incident in question, what procedures submission had, and understand if this truly was a gap in the compliance function or maybe there was an area within the compliance function that was not operating as prescribed, or maybe it was a little bit weak.   Three key takeaways: 1. HR plays a key but often underused role in internal investigations. 2. The Board of Directors and senior management have different roles. 3. Use your legal department to protect the privilege. Learn more about your ad choices. Visit megaphone.fm/adchoices Since 2015, DOJ has put even more pressure on every CCO, compliance practitioner, and indeed company, to get an investigation done quickly, efficiently, and, most importantly, right. This is even more true after the U.S. Supreme Court’s decisions in Digital Realty Trust v. Somers, which limited whistleblower protection and benefits to only those whistleblowers who go to the SEC, rather than initially report internally. What do all these documents tell who should be on your investigation team?

As data collection, retention and preservation are critical elements of any significant internal investigation you will need to have the involvement of your IT function. IT can help put a litigation hold on documents that can help with the preservation of data in other areas of the organization. Further, they can assist with certain other aspects as more facts and circumstances are known.

HR is often an underutilized function for an internal investigator. HR can provide context about employees’ work history. There may be notes in HR areas as diverse as training and exit interviews. HR can also give the investigator some insight regarding the credibility of the individual who might be making the allegation. For example, are they good and trusted employees? How long have they been there? What’s their general demeanor? What’s been the feedback on that particular individual?

Forensic accountants should be a part of your investigation team. Such a skilled set team member can bring an investigative mind that drives them to answer questions about what occurred, when and how it happened, and who was involved. However, most lawyers do not understand how forensic accounting is performed and how they can assist your compliance investigation going forward.

Obviously, the GC would be involved to help protect the attorney-client privilege if for no other reason. Further, an investigation needs to have compliance involved, to understand what compliance program was in place at the time of the incident in question, what procedures submission had, and understand if this truly was a gap in the compliance function or maybe there was an area within the compliance function that was not operating as prescribed, or maybe it was a little bit weak.

 

Three key takeaways:

1. HR plays a key but often underused role in internal investigations.

2. The Board of Directors and senior management have different roles.

3. Use your legal department to protect the privilege.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 549 no One Month to Better Reporting and Investigations - Selection of Investigative Counsel https://compliancepodcastnetwork.net/selection-of-investigative-counsel/ Dan Dunne, in a Compliance and Ethics Professional article, entitled “Foxes and henhouses: The importance of independent counsel”, discussed what he termed a “critical element” in any investigation, which he denominated as “fair and objective evaluation.” Dunne wrote that a key component of this fair and objective evaluation is the Who question: who should supervise the investigation and who should handle the study? Dunne’s clear conclusion is that independent counsel should handle any serious investigation. There are three reasons for a company to retain independent counsel for internal investigations of severe whistleblower complaints. First, André Agassi was right, perception is reality. Secondly, if regular outside counsel investigates their own prior legal work or legal advice, a very large and potentially messy number of loyalty and privilege issues can arise in the internal investigation. The third reason is the relationship of the regular outside counsel or law firm with regulatory authorities. If a company’s regular outside counsel performs the internal investigation and the results turn out favorably for the company, the regulators may ask if the investigation was a whitewash or at the very least, less than robust. If the SEC or DOJ cannot rely on a company’s own internal investigation, it may perform the investigation all over again with its own personnel. Further, these regulators may believe that the company, and its law firm, have engaged in a cover-up. This is certainly not the way to buy credibility. Three key takeaways: Serious allegations demand a serious response, with seriously good lawyers leading the investigation. Credibility is the biggest thing that any person or company brings to the table when sitting across from the DOJ or SEC. The use of regular corporate counsel can negatively impact your investigation because of the issues of loyalty and privilege. For more information, check out The Compliance Handbook, 4th edition. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 18 Jul 2023 04:00:00 -0000 Selection of Investigative Counsel full 10 Thomas Fox Today we consider the selection of investigative counsel. Dan Dunne, in a Compliance and Ethics Professional article, entitled “Foxes and henhouses: The importance of independent counsel”, discussed what he termed a “critical element” in any investigation, which he denominated as “fair and objective evaluation.” Dunne wrote that a key component of this fair and objective evaluation is the Who question: who should supervise the investigation and who should handle the study? Dunne’s clear conclusion is that independent counsel should handle any serious investigation. There are three reasons for a company to retain independent counsel for internal investigations of severe whistleblower complaints. First, André Agassi was right, perception is reality. Secondly, if regular outside counsel investigates their own prior legal work or legal advice, a very large and potentially messy number of loyalty and privilege issues can arise in the internal investigation. The third reason is the relationship of the regular outside counsel or law firm with regulatory authorities. If a company’s regular outside counsel performs the internal investigation and the results turn out favorably for the company, the regulators may ask if the investigation was a whitewash or at the very least, less than robust. If the SEC or DOJ cannot rely on a company’s own internal investigation, it may perform the investigation all over again with its own personnel. Further, these regulators may believe that the company, and its law firm, have engaged in a cover-up. This is certainly not the way to buy credibility. Three key takeaways: Serious allegations demand a serious response, with seriously good lawyers leading the investigation. Credibility is the biggest thing that any person or company brings to the table when sitting across from the DOJ or SEC. The use of regular corporate counsel can negatively impact your investigation because of the issues of loyalty and privilege. For more information, check out The Compliance Handbook, 4th edition. Learn more about your ad choices. Visit megaphone.fm/adchoices Dan Dunne, in a Compliance and Ethics Professional article, entitled “Foxes and henhouses: The importance of independent counsel”, discussed what he termed a “critical element” in any investigation, which he denominated as “fair and objective evaluation.” Dunne wrote that a key component of this fair and objective evaluation is the Who question: who should supervise the investigation and who should handle the study? Dunne’s clear conclusion is that independent counsel should handle any serious investigation.

There are three reasons for a company to retain independent counsel for internal investigations of severe whistleblower complaints. First, André Agassi was right, perception is reality. Secondly, if regular outside counsel investigates their own prior legal work or legal advice, a very large and potentially messy number of loyalty and privilege issues can arise in the internal investigation. The third reason is the relationship of the regular outside counsel or law firm with regulatory authorities. If a company’s regular outside counsel performs the internal investigation and the results turn out favorably for the company, the regulators may ask if the investigation was a whitewash or at the very least, less than robust. If the SEC or DOJ cannot rely on a company’s own internal investigation, it may perform the investigation all over again with its own personnel. Further, these regulators may believe that the company, and its law firm, have engaged in a cover-up. This is certainly not the way to buy credibility.

Three key takeaways:

  1. Serious allegations demand a serious response, with seriously good lawyers leading the investigation.
  2. Credibility is the biggest thing that any person or company brings to the table when sitting across from the DOJ or SEC.
  3. The use of regular corporate counsel can negatively impact your investigation because of the issues of loyalty and privilege.


For more information, check out The Compliance Handbook, 4th edition.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 554 no One Month to Better Reporting and Investigations - Preparing for the Investigation https://compliancepodcastnetwork.net/wp-admin/post.php?post=17557&action=edit Under Part 1, Section D. Confidential Reporting Structure and Investigation Process stated in part, Properly Scoped Investigation by Qualified Personnel –What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct research, and who makes that determination? These questions were presaged by the DOJ’s 2015 Yates Memo and the 2016 FCPA Pilot Program. The pressure on every CCO and company to get an investigation done quickly, efficiently and, most importantly, right is even greater now. Jonathan Marks began by cautioning that when considering any well-run internal investigation, a CCO must be cognizant of the strictures laid out in the Evaluation. It all begins with who in-house is looking at the complaint and does the CCO, compliance practitioner, or legal team have the skills and capabilities to handle the matter which has arisen. Obviously, if there are esoteric accounting issues or significant internal control workarounds and overrides, a CCO may not have the skills to really understand all the issues. Similarly, if the matter is a global FCPA or equivalent bribery and corruption matter, Marks related, these “come in different flavors, and because they come in different flavors you may not have the skills or capabilities to do an investigation that would take place in say Brazil or Russia or China or India.” Three key takeaways: Always remember your ultimate audience may be the government. You must understand both the business environment and extended business enterprise. Communication and collaboration in any investigation are critical so you should begin early and continue to do so throughout the investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 17 Jul 2023 04:00:00 -0000 Preparing for the investigation full Thomas Fox Today we look at preparing for the investigation. Under Part 1, Section D. Confidential Reporting Structure and Investigation Process stated in part, Properly Scoped Investigation by Qualified Personnel –What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct research, and who makes that determination? These questions were presaged by the DOJ’s 2015 Yates Memo and the 2016 FCPA Pilot Program. The pressure on every CCO and company to get an investigation done quickly, efficiently and, most importantly, right is even greater now. Jonathan Marks began by cautioning that when considering any well-run internal investigation, a CCO must be cognizant of the strictures laid out in the Evaluation. It all begins with who in-house is looking at the complaint and does the CCO, compliance practitioner, or legal team have the skills and capabilities to handle the matter which has arisen. Obviously, if there are esoteric accounting issues or significant internal control workarounds and overrides, a CCO may not have the skills to really understand all the issues. Similarly, if the matter is a global FCPA or equivalent bribery and corruption matter, Marks related, these “come in different flavors, and because they come in different flavors you may not have the skills or capabilities to do an investigation that would take place in say Brazil or Russia or China or India.” Three key takeaways: Always remember your ultimate audience may be the government. You must understand both the business environment and extended business enterprise. Communication and collaboration in any investigation are critical so you should begin early and continue to do so throughout the investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Under Part 1, Section D. Confidential Reporting Structure and Investigation Process stated in part, Properly Scoped Investigation by Qualified Personnel –What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct research, and who makes that determination? These questions were presaged by the DOJ’s 2015 Yates Memo and the 2016 FCPA Pilot Program. The pressure on every CCO and company to get an investigation done quickly, efficiently and, most importantly, right is even greater now.

Jonathan Marks began by cautioning that when considering any well-run internal investigation, a CCO must be cognizant of the strictures laid out in the Evaluation. It all begins with who in-house is looking at the complaint and does the CCO, compliance practitioner, or legal team have the skills and capabilities to handle the matter which has arisen. Obviously, if there are esoteric accounting issues or significant internal control workarounds and overrides, a CCO may not have the skills to really understand all the issues. Similarly, if the matter is a global FCPA or equivalent bribery and corruption matter, Marks related, these “come in different flavors, and because they come in different flavors you may not have the skills or capabilities to do an investigation that would take place in say Brazil or Russia or China or India.”


Three key takeaways:

  1. Always remember your ultimate audience may be the government.
  2. You must understand both the business environment and extended business enterprise.
  3. Communication and collaboration in any investigation are critical so you should begin early and continue to do so throughout the investigation.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no One Month to Better Reporting and Investigations - The Investigation Protocol After the internal report comes in and you have properly triaged the matter, you need to scope out and investigate it, promptly, thoroughly, and with competent personnel. In the 2020 Update, provided these series of questions about your internal investigations:  Properly Scoped Investigations by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation? How does the company ensure that investigations are properly scoped? What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct an investigation, and who makes that determination?  Investigation Response – Does the company apply timing metrics to ensure responsiveness? Does the company have a process for monitoring the outcome of investigations and ensuring accountability for the response to any findings or recommendations?  Resources and Tracking of Results – Are the reporting and investigating mechanisms sufficiently funded? How has the company collected, tracked, analyzed, and used information from its reporting mechanisms? Does the company periodically analyze the reports or investigation findings for patterns of misconduct or other red flags for compliance weaknesses? Does the company periodically test the effectiveness of the hotline, for example by tracking a report from start to finish? In a presentation, Jay Martin, and Jacki Trevino discussed the specifics of an investigation protocol. It consisted of 1) opening and categorizing the case; 2) planning the investigation; 3) executing the investigation plan; 4) determining appropriate follow-up, and 5) closing the case. If you follow this basic protocol, you should be able to work through most investigations, in a clear, concise, and cost-effective manner. Furthermore, you should have a report at the end of the day which should stand up to later scrutiny if a regulator comes looking. Finally, you will be able to “Document, Document, and Document”, not only the steps you took but why and the outcome obtained. Three key takeaways: A written protocol, created before an investigation, is a key starting point. Create specific steps to follow so there will be full transparency and documentation going forward. Consistency in approach is critical. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 14 Jul 2023 04:00:00 -0000 The Investigation Protocol full Thomas Fox In this episode, we consider your Investigation Protocol. After the internal report comes in and you have properly triaged the matter, you need to scope out and investigate it, promptly, thoroughly, and with competent personnel. In the 2020 Update, provided these series of questions about your internal investigations:  Properly Scoped Investigations by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation? How does the company ensure that investigations are properly scoped? What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct an investigation, and who makes that determination?  Investigation Response – Does the company apply timing metrics to ensure responsiveness? Does the company have a process for monitoring the outcome of investigations and ensuring accountability for the response to any findings or recommendations?  Resources and Tracking of Results – Are the reporting and investigating mechanisms sufficiently funded? How has the company collected, tracked, analyzed, and used information from its reporting mechanisms? Does the company periodically analyze the reports or investigation findings for patterns of misconduct or other red flags for compliance weaknesses? Does the company periodically test the effectiveness of the hotline, for example by tracking a report from start to finish? In a presentation, Jay Martin, and Jacki Trevino discussed the specifics of an investigation protocol. It consisted of 1) opening and categorizing the case; 2) planning the investigation; 3) executing the investigation plan; 4) determining appropriate follow-up, and 5) closing the case. If you follow this basic protocol, you should be able to work through most investigations, in a clear, concise, and cost-effective manner. Furthermore, you should have a report at the end of the day which should stand up to later scrutiny if a regulator comes looking. Finally, you will be able to “Document, Document, and Document”, not only the steps you took but why and the outcome obtained. Three key takeaways: A written protocol, created before an investigation, is a key starting point. Create specific steps to follow so there will be full transparency and documentation going forward. Consistency in approach is critical. Learn more about your ad choices. Visit megaphone.fm/adchoices After the internal report comes in and you have properly triaged the matter, you need to scope out and investigate it, promptly, thoroughly, and with competent personnel. In the 2020 Update, provided these series of questions about your internal investigations:

 Properly Scoped Investigations by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation? How does the company ensure that investigations are properly scoped? What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct an investigation, and who makes that determination?

 Investigation Response – Does the company apply timing metrics to ensure responsiveness? Does the company have a process for monitoring the outcome of investigations and ensuring accountability for the response to any findings or recommendations?

 Resources and Tracking of Results – Are the reporting and investigating mechanisms sufficiently funded? How has the company collected, tracked, analyzed, and used information from its reporting mechanisms? Does the company periodically analyze the reports or investigation findings for patterns of misconduct or other red flags for compliance weaknesses? Does the company periodically test the effectiveness of the hotline, for example by tracking a report from start to finish?

In a presentation, Jay Martin, and Jacki Trevino discussed the specifics of an investigation protocol. It consisted of 1) opening and categorizing the case; 2) planning the investigation; 3) executing the investigation plan; 4) determining appropriate follow-up, and 5) closing the case. If you follow this basic protocol, you should be able to work through most investigations, in a clear, concise, and cost-effective manner. Furthermore, you should have a report at the end of the day which should stand up to later scrutiny if a regulator comes looking. Finally, you will be able to “Document, Document, and Document”, not only the steps you took but why and the outcome obtained.

Three key takeaways:

  1. A written protocol, created before an investigation, is a key starting point.
  2. Create specific steps to follow so there will be full transparency and documentation going forward.
  3. Consistency in approach is critical.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 550 no One Month to Better Reporting and Investigations - Triage of Internally Reported Allegations One of the things that I learned from the television series M*A*S*H was the need for triage. In the hospital setting, triage is the process of determining the priority of patients’ treatments based on the severity of their condition. In the 2012 FCPA Guidance, there is a short but succinct statement, “once an allegation is made, companies should have in place an efficient, reliable, and properly funded process for investigating the allegation and documenting the company’s response, including any disciplinary or remediation measures taken.” This is considered in more expansive language in the 2020 Update to the Evaluation of Corporate Compliance Programs. Under Part 1, Section D. Confidential Reporting Structure and Investigation Process, it stated in part, Properly Scoped Investigation by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation?  Appropriate triage of allegations has several different impacts for any matter which comes to the attention of compliance. Obviously, it will help you to initially determine the seriousness of the matter. From there you can allocate an appropriate level of resources. It will also aid in your discussion with the DOJ if you must go that route. Finally, in the situation where facts come in, it provides the required documented evidence that a process was followed that you can show the government that a claim was properly scoped, as required under the Evaluation. But the key is to be prepared, not only in terms of having your investigation and notification protocols in place before an allegation comes in but also doing the proper triage so that you have an initial understanding of what you may be facing. Three key takeaways: Compliance can learn from M*A*S*H about the need for triage. Initial triage allows you to separate the wheat of serious allegations from the chaff of more inconsequential allegations. A robust triage process allows for greater credibility with government regulators. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 13 Jul 2023 04:00:00 -0000 Triage of Internally Reported Allegations full Thomas Fox Today, we explore the Triage of Internally Reported Allegations. One of the things that I learned from the television series M*A*S*H was the need for triage. In the hospital setting, triage is the process of determining the priority of patients’ treatments based on the severity of their condition. In the 2012 FCPA Guidance, there is a short but succinct statement, “once an allegation is made, companies should have in place an efficient, reliable, and properly funded process for investigating the allegation and documenting the company’s response, including any disciplinary or remediation measures taken.” This is considered in more expansive language in the 2020 Update to the Evaluation of Corporate Compliance Programs. Under Part 1, Section D. Confidential Reporting Structure and Investigation Process, it stated in part, Properly Scoped Investigation by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation?  Appropriate triage of allegations has several different impacts for any matter which comes to the attention of compliance. Obviously, it will help you to initially determine the seriousness of the matter. From there you can allocate an appropriate level of resources. It will also aid in your discussion with the DOJ if you must go that route. Finally, in the situation where facts come in, it provides the required documented evidence that a process was followed that you can show the government that a claim was properly scoped, as required under the Evaluation. But the key is to be prepared, not only in terms of having your investigation and notification protocols in place before an allegation comes in but also doing the proper triage so that you have an initial understanding of what you may be facing. Three key takeaways: Compliance can learn from M*A*S*H about the need for triage. Initial triage allows you to separate the wheat of serious allegations from the chaff of more inconsequential allegations. A robust triage process allows for greater credibility with government regulators. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the things that I learned from the television series M*A*S*H was the need for triage. In the hospital setting, triage is the process of determining the priority of patients’ treatments based on the severity of their condition. In the 2012 FCPA Guidance, there is a short but succinct statement, “once an allegation is made, companies should have in place an efficient, reliable, and properly funded process for investigating the allegation and documenting the company’s response, including any disciplinary or remediation measures taken.” This is considered in more expansive language in the 2020 Update to the Evaluation of Corporate Compliance Programs. Under Part 1, Section D. Confidential Reporting Structure and Investigation Process, it stated in part, Properly Scoped Investigation by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation? 

Appropriate triage of allegations has several different impacts for any matter which comes to the attention of compliance. Obviously, it will help you to initially determine the seriousness of the matter. From there you can allocate an appropriate level of resources. It will also aid in your discussion with the DOJ if you must go that route. Finally, in the situation where facts come in, it provides the required documented evidence that a process was followed that you can show the government that a claim was properly scoped, as required under the Evaluation. But the key is to be prepared, not only in terms of having your investigation and notification protocols in place before an allegation comes in but also doing the proper triage so that you have an initial understanding of what you may be facing.

Three key takeaways:

  1. Compliance can learn from M*A*S*H about the need for triage.
  2. Initial triage allows you to separate the wheat of serious allegations from the chaff of more inconsequential allegations.
  3. A robust triage process allows for greater credibility with government regulators.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 554 no One Month to More Effective Reporting and Investigations - Internal Reporting and Whistleblowers During Layoffs In Houston, we have experienced energy companies laying off upwards of 30% of their workforce, both in the US and abroad. Employment separations can be one of the trickiest maneuvers to manage in the spectrum of the employment relationship. Even when an employee is aware layoffs are coming it can still be quite a shock when Human Resources (HR) shows up at their door and says, “Come with me.” However, layoffs, massive or otherwise, can present some unique challenges for the FCPA compliance practitioner. Employees can use layoffs to claim that they were retaliated against for a wide variety of complaints, including those for concerns that impact the compliance practitioner. Yet there are several actions you can take to protect your company as much as possible. The reason for these actions are to allow you to demonstrate that any laid off employee was not separated because of a hotline or whistleblower allegation but due to your overall layoff scheme. However it could be that you may need this person to provide your compliance department additional information, to be a resource to you going forward, or even a witness that you can reasonably anticipate the government may want to interview. If any of these situations exist, if you do not plan for their eventuality before you layoff the employee, said (now) ex-employee may not be inclined to cooperate with you going forward. Also if you do demonstrate that you are sincerely interested in a meritorious hotline complaint, it may keep this person from becoming a SEC whistleblower. Three Key Takeaways An employment separation is a critical time if an internal report has been made. Have appropriate language in your separation agreement. Treat terminated employees with dignity and respect. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 12 Jul 2023 04:00:00 -0000 Internal Reporting and Whistleblowers During Layoffs full Thomas Fox Today, we look at Internal Reporting and Whistleblowers During Layoffs. In Houston, we have experienced energy companies laying off upwards of 30% of their workforce, both in the US and abroad. Employment separations can be one of the trickiest maneuvers to manage in the spectrum of the employment relationship. Even when an employee is aware layoffs are coming it can still be quite a shock when Human Resources (HR) shows up at their door and says, “Come with me.” However, layoffs, massive or otherwise, can present some unique challenges for the FCPA compliance practitioner. Employees can use layoffs to claim that they were retaliated against for a wide variety of complaints, including those for concerns that impact the compliance practitioner. Yet there are several actions you can take to protect your company as much as possible. The reason for these actions are to allow you to demonstrate that any laid off employee was not separated because of a hotline or whistleblower allegation but due to your overall layoff scheme. However it could be that you may need this person to provide your compliance department additional information, to be a resource to you going forward, or even a witness that you can reasonably anticipate the government may want to interview. If any of these situations exist, if you do not plan for their eventuality before you layoff the employee, said (now) ex-employee may not be inclined to cooperate with you going forward. Also if you do demonstrate that you are sincerely interested in a meritorious hotline complaint, it may keep this person from becoming a SEC whistleblower. Three Key Takeaways An employment separation is a critical time if an internal report has been made. Have appropriate language in your separation agreement. Treat terminated employees with dignity and respect. Learn more about your ad choices. Visit megaphone.fm/adchoices

In Houston, we have experienced energy companies laying off upwards of 30% of their workforce, both in the US and abroad. Employment separations can be one of the trickiest maneuvers to manage in the spectrum of the employment relationship. Even when an employee is aware layoffs are coming it can still be quite a shock when Human Resources (HR) shows up at their door and says, “Come with me.” However, layoffs, massive or otherwise, can present some unique challenges for the FCPA compliance practitioner. Employees can use layoffs to claim that they were retaliated against for a wide variety of complaints, including those for concerns that impact the compliance practitioner. Yet there are several actions you can take to protect your company as much as possible.

The reason for these actions are to allow you to demonstrate that any laid off employee was not separated because of a hotline or whistleblower allegation but due to your overall layoff scheme. However it could be that you may need this person to provide your compliance department additional information, to be a resource to you going forward, or even a witness that you can reasonably anticipate the government may want to interview. If any of these situations exist, if you do not plan for their eventuality before you layoff the employee, said (now) ex-employee may not be inclined to cooperate with you going forward. Also if you do demonstrate that you are sincerely interested in a meritorious hotline complaint, it may keep this person from becoming a SEC whistleblower.

Three Key Takeaways

  1. An employment separation is a critical time if an internal report has been made.
  2. Have appropriate language in your separation agreement.
  3. Treat terminated employees with dignity and respect.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 550 no One Month to More Effective Reporting and Investigations - Answering DOJ Questions on Confidential Reporting What are some best practices regarding an internal reporting system? The 2012 FCPA Guidance stated, “An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation.” This was expanded in the DOJ’s 2020 Guidance, in the section entitled “D. Confidential Reporting Structure and Investigation Process,” with the following language, “Another hallmark of a well-designed compliance program is the existence of an efficient and trusted mechanism by which employees can anonymously or confidentially report allegations of a breach of the company’s code of conduct, company policies, or suspected or actual misconduct. Prosecutors should assess whether the company’s complaint-handling process includes proactive measures to create a workplace atmosphere without fear of retaliation, appropriate processes for submitting complaints, and processes to protect whistleblowers.” Three Key Takeaways: Internal reporting systems indicate a working, operationalized compliance program. There must be a solid communication line between the people doing the investigation and those leading the remediation. Your internal reporting mechanism must be trusted. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 11 Jul 2023 04:00:00 -0000 Answering DOJ Questions on Confidential Reporting full Thomas Fox In this episode, we consider Answering DOJ Questions on Confidential Reporting. What are some best practices regarding an internal reporting system? The 2012 FCPA Guidance stated, “An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation.” This was expanded in the DOJ’s 2020 Guidance, in the section entitled “D. Confidential Reporting Structure and Investigation Process,” with the following language, “Another hallmark of a well-designed compliance program is the existence of an efficient and trusted mechanism by which employees can anonymously or confidentially report allegations of a breach of the company’s code of conduct, company policies, or suspected or actual misconduct. Prosecutors should assess whether the company’s complaint-handling process includes proactive measures to create a workplace atmosphere without fear of retaliation, appropriate processes for submitting complaints, and processes to protect whistleblowers.” Three Key Takeaways: Internal reporting systems indicate a working, operationalized compliance program. There must be a solid communication line between the people doing the investigation and those leading the remediation. Your internal reporting mechanism must be trusted. Learn more about your ad choices. Visit megaphone.fm/adchoices What are some best practices regarding an internal reporting system? The 2012 FCPA Guidance stated, “An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation.”

This was expanded in the DOJ’s 2020 Guidance, in the section entitled “D. Confidential Reporting Structure and Investigation Process,” with the following language, “Another hallmark of a well-designed compliance program is the existence of an efficient and trusted mechanism by which employees can anonymously or confidentially report allegations of a breach of the company’s code of conduct, company policies, or suspected or actual misconduct. Prosecutors should assess whether the company’s complaint-handling process includes proactive measures to create a workplace atmosphere without fear of retaliation, appropriate processes for submitting complaints, and processes to protect whistleblowers.”

Three Key Takeaways:

  1. Internal reporting systems indicate a working, operationalized compliance program.
  2. There must be a solid communication line between the people doing the investigation and those leading the remediation.
  3. Your internal reporting mechanism must be trusted.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 553 no One Month to Better Reporting and Investigations - Internal Reporting System Best Practices What are some best practices regarding an internal reporting system? The 2012 FCPA Guidance stated, “An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation.” The 2019 Guidance further refined this basic requirement for a hotline with inquiries into the effectiveness of your corporate hotline, asking, “Effectiveness of the Reporting Mechanism – Does the company have an anonymous reporting mechanism, and, if not, why not? How is the reporting mechanism publicized to the company’s employees? Has it been used? How has the company assessed the seriousness of the allegations it received? Has the compliance function had full access to reporting and investigative information?” In this podcast, we detail some of the key best practices. Three key takeaways: Get the word out to your employees about your company hotline through a variety of mediums and platforms. Train your employees on the use of the hotline. Use data from your hotline to continually update and improve your compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 10 Jul 2023 04:00:00 -0000 Internal Reporting System Best Practices full Thomas Fox Today we consider Internal Reporting System Best Practices. What are some best practices regarding an internal reporting system? The 2012 FCPA Guidance stated, “An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation.” The 2019 Guidance further refined this basic requirement for a hotline with inquiries into the effectiveness of your corporate hotline, asking, “Effectiveness of the Reporting Mechanism – Does the company have an anonymous reporting mechanism, and, if not, why not? How is the reporting mechanism publicized to the company’s employees? Has it been used? How has the company assessed the seriousness of the allegations it received? Has the compliance function had full access to reporting and investigative information?” In this podcast, we detail some of the key best practices. Three key takeaways: Get the word out to your employees about your company hotline through a variety of mediums and platforms. Train your employees on the use of the hotline. Use data from your hotline to continually update and improve your compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices What are some best practices regarding an internal reporting system? The 2012 FCPA Guidance stated, “An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation.” The 2019 Guidance further refined this basic requirement for a hotline with inquiries into the effectiveness of your corporate hotline, asking, “Effectiveness of the Reporting Mechanism – Does the company have an anonymous reporting mechanism, and, if not, why not? How is the reporting mechanism publicized to the company’s employees? Has it been used? How has the company assessed the seriousness of the allegations it received? Has the compliance function had full access to reporting and investigative information?” In this podcast, we detail some of the key best practices.

Three key takeaways:

  1. Get the word out to your employees about your company hotline through a variety of mediums and platforms.
  2. Train your employees on the use of the hotline.
  3. Use data from your hotline to continually update and improve your compliance program.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 553 no One Month to More Effective Reporting and Investigations - Specific Benefits of a Hotline: A Case Study Is your hotline working for you? In an article, entitled, Promoting Effective Use of the Company Compliance Hotline, José Tabuena provided an excellent example of the power of a hotline. He provided a case study of a company which had not integrated its IT function into its regular compliance and ethics training programs. As such there were zero calls into the hotline by IT employees. This dynamic was changed and IT was integrated into the company’s regular compliance and ethics training. Thereafter, the hotline received several calls from IT employees indicating where there were two major areas of complaints.  The favoritism problem. HR led an investigation that included questioning all IT managers about their direct reports and employees of their unit. The company determined that there was only one instance of a manger hiring a family member (a brother-in-law), but that person did not report to the manager and was in a different section of the IT organization. This finding made clear that there were misperceptions in the IT department, which affected the department morale.  Manipulation of data for bonuses. The company used the hotline to obtain more information from the callers on “isolating the metrics and the managers in question.” It was determined that the bonuses of a select few IT managers were indeed influenced by a questionable data source, which was controlled by a non-manager with minimal oversight and controls.  Basic tenets of an effective hotline. This case study provided three key tenets of an effective internal reporting system: • First, a helpline is of no value if the workforce is not aware of it.  • Second, the ethics and compliance office obtained support from the Chief Information Officer (CIO) which likely influenced the success of the training and communications delivered by the ethics and compliance staff. • Third, the awareness of the helpline is not sufficient to ensure success as you must make sure that issues and allegations are addressed and investigated.  This case study demonstrates the power of a hotline. The company’s Compliance Department “established the credibility of the helpline as a resource to raise issues and report misconduct.   Three key takeaways: 1. Hotlines can be powerful tools for the compliance professional. 2. Simply because you have no hotline complaints does not mean you do not have any compliance or ethics issues which need review and resolution. 3. Adequate follow up is a key part of overall hotline effectiveness. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 07 Jul 2023 04:00:00 -0000 Specific Benefits of a Hotline: A Case Study full Thomas Fox Today, we present a case study of the specific benefits of a hotline. Is your hotline working for you? In an article, entitled, Promoting Effective Use of the Company Compliance Hotline, José Tabuena provided an excellent example of the power of a hotline. He provided a case study of a company which had not integrated its IT function into its regular compliance and ethics training programs. As such there were zero calls into the hotline by IT employees. This dynamic was changed and IT was integrated into the company’s regular compliance and ethics training. Thereafter, the hotline received several calls from IT employees indicating where there were two major areas of complaints.  The favoritism problem. HR led an investigation that included questioning all IT managers about their direct reports and employees of their unit. The company determined that there was only one instance of a manger hiring a family member (a brother-in-law), but that person did not report to the manager and was in a different section of the IT organization. This finding made clear that there were misperceptions in the IT department, which affected the department morale.  Manipulation of data for bonuses. The company used the hotline to obtain more information from the callers on “isolating the metrics and the managers in question.” It was determined that the bonuses of a select few IT managers were indeed influenced by a questionable data source, which was controlled by a non-manager with minimal oversight and controls.  Basic tenets of an effective hotline. This case study provided three key tenets of an effective internal reporting system: • First, a helpline is of no value if the workforce is not aware of it.  • Second, the ethics and compliance office obtained support from the Chief Information Officer (CIO) which likely influenced the success of the training and communications delivered by the ethics and compliance staff. • Third, the awareness of the helpline is not sufficient to ensure success as you must make sure that issues and allegations are addressed and investigated.  This case study demonstrates the power of a hotline. The company’s Compliance Department “established the credibility of the helpline as a resource to raise issues and report misconduct.   Three key takeaways: 1. Hotlines can be powerful tools for the compliance professional. 2. Simply because you have no hotline complaints does not mean you do not have any compliance or ethics issues which need review and resolution. 3. Adequate follow up is a key part of overall hotline effectiveness. Learn more about your ad choices. Visit megaphone.fm/adchoices Is your hotline working for you? In an article, entitled, Promoting Effective Use of the Company Compliance Hotline, José Tabuena provided an excellent example of the power of a hotline. He provided a case study of a company which had not integrated its IT function into its regular compliance and ethics training programs. As such there were zero calls into the hotline by IT employees. This dynamic was changed and IT was integrated into the company’s regular compliance and ethics training. Thereafter, the hotline received several calls from IT employees indicating where there were two major areas of complaints. 

The favoritism problem. HR led an investigation that included questioning all IT managers about their direct reports and employees of their unit. The company determined that there was only one instance of a manger hiring a family member (a brother-in-law), but that person did not report to the manager and was in a different section of the IT organization. This finding made clear that there were misperceptions in the IT department, which affected the department morale. 

Manipulation of data for bonuses. The company used the hotline to obtain more information from the callers on “isolating the metrics and the managers in question.” It was determined that the bonuses of a select few IT managers were indeed influenced by a questionable data source, which was controlled by a non-manager with minimal oversight and controls. 

Basic tenets of an effective hotline. This case study provided three key tenets of an effective internal reporting system:

• First, a helpline is of no value if the workforce is not aware of it. 

• Second, the ethics and compliance office obtained support from the Chief Information Officer (CIO) which likely influenced the success of the training and communications delivered by the ethics and compliance staff.

• Third, the awareness of the helpline is not sufficient to ensure success as you must make sure that issues and allegations are addressed and investigated. 

This case study demonstrates the power of a hotline. The company’s Compliance Department “established the credibility of the helpline as a resource to raise issues and report misconduct. 

 Three key takeaways:

1. Hotlines can be powerful tools for the compliance professional.

2. Simply because you have no hotline complaints does not mean you do not have any compliance or ethics issues which need review and resolution.

3. Adequate follow up is a key part of overall hotline effectiveness.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 547 no One Month to More Effective Reporting and Investigations-Advantages of Internal Reporting While it is clear that the government expects companies to have an internal reporting system, there are benefits far beyond putting you in the government’s good graces. Companies with a more robust internal reporting system generated more reports. Dr. Welch found a group of companies he termed “power users”, which were high level users of whistleblower reporting systems who had more activity than the average entity. These “power user” companies have several interesting characteristics. First they are typically firms with a higher quality earnings reporting. They are more profitable entities. Finally, these “power user” companies were firms with higher quality governance, as rated by the Entrenchment Index, which is used measure how entrenched management is in a company. Conversely, companies which were observed to be a more limited user of whistleblower reporting systems are companies that were seen to have poor governance. They are more prone to financial accounting issues, such as discretionary accruals, which could prove problematic. These tend to be smaller and less mature firms. Their overall compliance programs were generally not seen as robust or as effective as those in larger, more mature organizations. Finally, these firms, probably because they were smaller and less mature, are more prone to extreme growth and the problems associated with trying to scale up quickly. All of this points to one unmistakable conclusion, a robust whistleblower reporting system facilitates a company’s resolution of problems before they become major problems or legal violations bringing the Securities and Exchange Commission (SEC) or DOJ calling. Three Key Takeaways Companies with a robust whistleblower and reporting system had greater profitability and workforce productivity as measured by Return on Assets. There were fewer material lawsuits brought against the company overall and there were lower settlement costs if a lawsuit did occur. There were fewer external whistleblower reports to regulatory agencies and other authorities. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 06 Jul 2023 04:00:00 -0000 Advantages of Internal Reporting full Thomas Fox Today, we consider how internal reporting can be a business advantage. While it is clear that the government expects companies to have an internal reporting system, there are benefits far beyond putting you in the government’s good graces. Companies with a more robust internal reporting system generated more reports. Dr. Welch found a group of companies he termed “power users”, which were high level users of whistleblower reporting systems who had more activity than the average entity. These “power user” companies have several interesting characteristics. First they are typically firms with a higher quality earnings reporting. They are more profitable entities. Finally, these “power user” companies were firms with higher quality governance, as rated by the Entrenchment Index, which is used measure how entrenched management is in a company. Conversely, companies which were observed to be a more limited user of whistleblower reporting systems are companies that were seen to have poor governance. They are more prone to financial accounting issues, such as discretionary accruals, which could prove problematic. These tend to be smaller and less mature firms. Their overall compliance programs were generally not seen as robust or as effective as those in larger, more mature organizations. Finally, these firms, probably because they were smaller and less mature, are more prone to extreme growth and the problems associated with trying to scale up quickly. All of this points to one unmistakable conclusion, a robust whistleblower reporting system facilitates a company’s resolution of problems before they become major problems or legal violations bringing the Securities and Exchange Commission (SEC) or DOJ calling. Three Key Takeaways Companies with a robust whistleblower and reporting system had greater profitability and workforce productivity as measured by Return on Assets. There were fewer material lawsuits brought against the company overall and there were lower settlement costs if a lawsuit did occur. There were fewer external whistleblower reports to regulatory agencies and other authorities. Learn more about your ad choices. Visit megaphone.fm/adchoices While it is clear that the government expects companies to have an internal reporting system, there are benefits far beyond putting you in the government’s good graces. Companies with a more robust internal reporting system generated more reports. Dr. Welch found a group of companies he termed “power users”, which were high level users of whistleblower reporting systems who had more activity than the average entity. These “power user” companies have several interesting characteristics. First they are typically firms with a higher quality earnings reporting. They are more profitable entities. Finally, these “power user” companies were firms with higher quality governance, as rated by the Entrenchment Index, which is used measure how entrenched management is in a company.

Conversely, companies which were observed to be a more limited user of whistleblower reporting systems are companies that were seen to have poor governance. They are more prone to financial accounting issues, such as discretionary accruals, which could prove problematic. These tend to be smaller and less mature firms. Their overall compliance programs were generally not seen as robust or as effective as those in larger, more mature organizations. Finally, these firms, probably because they were smaller and less mature, are more prone to extreme growth and the problems associated with trying to scale up quickly.

All of this points to one unmistakable conclusion, a robust whistleblower reporting system facilitates a company’s resolution of problems before they become major problems or legal violations bringing the Securities and Exchange Commission (SEC) or DOJ calling.

Three Key Takeaways

  1. Companies with a robust whistleblower and reporting system had greater profitability and workforce productivity as measured by Return on Assets.
  2. There were fewer material lawsuits brought against the company overall and there were lower settlement costs if a lawsuit did occur.
  3. There were fewer external whistleblower reports to regulatory agencies and other authorities.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 549 no One Month to More Effective Reporting and Investigations-Introduction The call, email, or tip comes into your office; an employee reports suspicious activity somewhere across the globe. That activity might well turn into an FCPA issue for your company. As the CCO, it will be up to you to begin the process which will determine, in many instances, how the company will respond. This chapter will provide you with the steps you will need to consider going forward. This chapter will detail the two parts; internal reporting and investigations. It would seem axiomatic that organizations understand the benefits of having an internal reporting system, whether it is called a hotline, helpline, or something else. Just as plainly, a company should understand the need for effective investigations after a report comes in which might lead to a potential violation. Three key takeaways: A robust internal reporting system will be one of the key indicia the DOJ considers. Hotline reporting can bring a visibility to problems. Hotline reports must be treated fairly and justly. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 05 Jul 2023 04:00:00 -0000 Introduction full Thomas Fox Today we introduce the topic for July in One Month to a More Effective Compliance Program. The call, email, or tip comes into your office; an employee reports suspicious activity somewhere across the globe. That activity might well turn into an FCPA issue for your company. As the CCO, it will be up to you to begin the process which will determine, in many instances, how the company will respond. This chapter will provide you with the steps you will need to consider going forward. This chapter will detail the two parts; internal reporting and investigations. It would seem axiomatic that organizations understand the benefits of having an internal reporting system, whether it is called a hotline, helpline, or something else. Just as plainly, a company should understand the need for effective investigations after a report comes in which might lead to a potential violation. Three key takeaways: A robust internal reporting system will be one of the key indicia the DOJ considers. Hotline reporting can bring a visibility to problems. Hotline reports must be treated fairly and justly. Learn more about your ad choices. Visit megaphone.fm/adchoices The call, email, or tip comes into your office; an employee reports suspicious activity somewhere across the globe. That activity might well turn into an FCPA issue for your company. As the CCO, it will be up to you to begin the process which will determine, in many instances, how the company will respond. This chapter will provide you with the steps you will need to consider going forward.

This chapter will detail the two parts; internal reporting and investigations. It would seem axiomatic that organizations understand the benefits of having an internal reporting system, whether it is called a hotline, helpline, or something else. Just as plainly, a company should understand the need for effective investigations after a report comes in which might lead to a potential violation.

Three key takeaways:

  1. A robust internal reporting system will be one of the key indicia the DOJ considers.
  2. Hotline reporting can bring a visibility to problems.
  3. Hotline reports must be treated fairly and justly.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 550 no One Month to a More Effective Compliance Program with Boards- 20 Questions Directors Should Ask about the Board Compliance Committee In an area of inquiry entitled Oversight, the 2023 ECCP asks three basic questions which we have explored throughout this chapter: 1. What compliance expertise has been available on the Board of Directors? 2. Have the Board of Directors held executive or private sessions with the compliance function? 3. What types of information has the Board of Directors examined in their exercise of oversight in the area in which the misconduct occurred? To facilitate the answers to these questions, consider this list of 20 questions to reflect the oversight role of directors. These are questions the Board should ask of both senior management and the Board should ask itself. The questions are not intended to be an exact checklist, but rather a way to provide insight and stimulate discussion on the topic of compliance. The questions provide directors with a basis for critically assessing the answers they get and digging deeper as necessary. Although the questions apply to most medium to large organizations, the answers will vary according to the size, complexity and sophistication of each individual organization. Part I: Understanding the Role and Value of the Compliance Committee 1. What are the Compliance Committee’s responsibilities and what value does it bring to the Board? 2. How can the Compliance Committee help the Board enhance its relationship with management? 3. What is the role of the Compliance Committee? Part II: Building an Effective Compliance Committee 4. What skill sets does the Compliance Committee require? 5. Who should sit on the Compliance Committee? 6. Who should chair the Compliance Committee? Part III: Directed to the Board 7. What is the Compliance Committee’s role in building an effective compliance program within the company? How can the Compliance Committee assess potential members and senior leaders of the company’s compliance program? 8. How long should directors serve on the Compliance Committee? 9. How can the Compliance Committee assist directors in retiring from the Board? Part IV: Enhancing the Board’s Performance Effectiveness 10. How can the Compliance Committee assist in director development? 11. How can the Compliance Committee help the Board chair sharpen the Board’s overall performance focus? 12. What is the Compliance Committee’s role in Board evaluation and feedback? 13. What should the Compliance Committee do if a director is not performing or not interacting effectively with other directors? 14. Should the Compliance Committee have a role in chair succession? 15. How can the Compliance Committee help the Board keep its mandates, policies and practices up-to-date? Part V: Merging Roles of the Compliance Committee 16. How can the Compliance Committee enhance the Board’s relationship with institutional shareholders and other stakeholders? 17. What is the Compliance Committee role in CCO succession? 18. How can the Compliance Committee foster great technical impact for compliance function? 19. What role can the Compliance Committee play in preparing for a crisis, such as the discovery of a sign of a significant compliance violation? 20. How can the Compliance Committee help the Board in deciding CCO pay, bonus and resources made available to the corporate compliance function?  Three key takeaways: 1. The DOJ Evaluation requires active Board of Director engagement around compliance. 2. Board communication on compliance is a two-way street; both inbound and outbound. 3. Has the Board built an effective Compliance Committee for itself? Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 30 Jun 2023 04:00:00 -0000 20 Questions Directors Should Ask about the Board Compliance Committee full Thomas Fox Today, I take up 20 Questions Directors Should Ask about the Board Compliance Committee. In an area of inquiry entitled Oversight, the 2023 ECCP asks three basic questions which we have explored throughout this chapter: 1. What compliance expertise has been available on the Board of Directors? 2. Have the Board of Directors held executive or private sessions with the compliance function? 3. What types of information has the Board of Directors examined in their exercise of oversight in the area in which the misconduct occurred? To facilitate the answers to these questions, consider this list of 20 questions to reflect the oversight role of directors. These are questions the Board should ask of both senior management and the Board should ask itself. The questions are not intended to be an exact checklist, but rather a way to provide insight and stimulate discussion on the topic of compliance. The questions provide directors with a basis for critically assessing the answers they get and digging deeper as necessary. Although the questions apply to most medium to large organizations, the answers will vary according to the size, complexity and sophistication of each individual organization. Part I: Understanding the Role and Value of the Compliance Committee 1. What are the Compliance Committee’s responsibilities and what value does it bring to the Board? 2. How can the Compliance Committee help the Board enhance its relationship with management? 3. What is the role of the Compliance Committee? Part II: Building an Effective Compliance Committee 4. What skill sets does the Compliance Committee require? 5. Who should sit on the Compliance Committee? 6. Who should chair the Compliance Committee? Part III: Directed to the Board 7. What is the Compliance Committee’s role in building an effective compliance program within the company? How can the Compliance Committee assess potential members and senior leaders of the company’s compliance program? 8. How long should directors serve on the Compliance Committee? 9. How can the Compliance Committee assist directors in retiring from the Board? Part IV: Enhancing the Board’s Performance Effectiveness 10. How can the Compliance Committee assist in director development? 11. How can the Compliance Committee help the Board chair sharpen the Board’s overall performance focus? 12. What is the Compliance Committee’s role in Board evaluation and feedback? 13. What should the Compliance Committee do if a director is not performing or not interacting effectively with other directors? 14. Should the Compliance Committee have a role in chair succession? 15. How can the Compliance Committee help the Board keep its mandates, policies and practices up-to-date? Part V: Merging Roles of the Compliance Committee 16. How can the Compliance Committee enhance the Board’s relationship with institutional shareholders and other stakeholders? 17. What is the Compliance Committee role in CCO succession? 18. How can the Compliance Committee foster great technical impact for compliance function? 19. What role can the Compliance Committee play in preparing for a crisis, such as the discovery of a sign of a significant compliance violation? 20. How can the Compliance Committee help the Board in deciding CCO pay, bonus and resources made available to the corporate compliance function?  Three key takeaways: 1. The DOJ Evaluation requires active Board of Director engagement around compliance. 2. Board communication on compliance is a two-way street; both inbound and outbound. 3. Has the Board built an effective Compliance Committee for itself? Learn more about your ad choices. Visit megaphone.fm/adchoices In an area of inquiry entitled Oversight, the 2023 ECCP asks three basic questions which we have explored throughout this chapter:

1. What compliance expertise has been available on the Board of Directors?

2. Have the Board of Directors held executive or private sessions with the compliance function?

3. What types of information has the Board of Directors examined in their exercise of oversight in the area in which the misconduct occurred?

To facilitate the answers to these questions, consider this list of 20 questions to reflect the oversight role of directors. These are questions the Board should ask of both senior management and the Board should ask itself. The questions are not intended to be an exact checklist, but rather a way to provide insight and stimulate discussion on the topic of compliance. The questions provide directors with a basis for critically assessing the answers they get and digging deeper as necessary. Although the questions apply to most medium to large organizations, the answers will vary according to the size, complexity and sophistication of each individual organization.


Part I: Understanding the Role and Value of the Compliance Committee

1. What are the Compliance Committee’s responsibilities and what value does it bring to the Board?

2. How can the Compliance Committee help the Board enhance its relationship with management?

3. What is the role of the Compliance Committee?


Part II: Building an Effective Compliance Committee

4. What skill sets does the Compliance Committee require?

5. Who should sit on the Compliance Committee?

6. Who should chair the Compliance Committee?


Part III: Directed to the Board

7. What is the Compliance Committee’s role in building an effective compliance program within the company? How can the Compliance Committee assess potential members and senior leaders of the company’s compliance program?

8. How long should directors serve on the Compliance Committee?

9. How can the Compliance Committee assist directors in retiring from the Board?


Part IV: Enhancing the Board’s Performance Effectiveness

10. How can the Compliance Committee assist in director development?

11. How can the Compliance Committee help the Board chair sharpen the Board’s overall performance focus?

12. What is the Compliance Committee’s role in Board evaluation and feedback?

13. What should the Compliance Committee do if a director is not performing or not interacting effectively with other directors?

14. Should the Compliance Committee have a role in chair succession?

15. How can the Compliance Committee help the Board keep its mandates, policies and practices up-to-date?


Part V: Merging Roles of the Compliance Committee

16. How can the Compliance Committee enhance the Board’s relationship with institutional shareholders and other stakeholders?

17. What is the Compliance Committee role in CCO succession?

18. How can the Compliance Committee foster great technical impact for compliance function?

19. What role can the Compliance Committee play in preparing for a crisis, such as the discovery of a sign of a significant compliance violation?

20. How can the Compliance Committee help the Board in deciding CCO pay, bonus and resources made available to the corporate compliance function?

 Three key takeaways:

1. The DOJ Evaluation requires active Board of Director engagement around compliance.

2. Board communication on compliance is a two-way street; both inbound and outbound.

3. Has the Board built an effective Compliance Committee for itself?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 566 no One Month to a More Effective Board - Vin DiCianni on Board Inquiries into Compliance Where does “tone at the top” start? With any public and most private U.S. companies, it is at the Board of Directors. But what is the role of a company’s Board in compliance? We start with several general statements about the role of a Board in U.S. companies. First, a Board should not engage in management but should engage in oversight of a CEO and senior management. The Board does this through asking hard questions, risk assessment and identification. A white paper by Deloitte & Touche LLP, entitled, Risk Intelligence Governance—A Practical Guide for Boards, laid out six general principles to help guide Boards in the area of risk governance. These six areas can be summarized as follows: • Define the Board’s role. There must be a mutual understanding between the Board, CEO and senior management of the Board’s responsibilities. • Foster a culture of risk management. All stakeholders should understand the risks involved and manage such risks accordingly. • Incorporate risk management directly into a strategy. Oversee the design and implementation of risk evaluation and analysis. • Help define the company’s appetite for risk. All stakeholders need to understand the company’s appetite or lack thereof for risk. • How to execute the risk management process. Maintain an approach that is continually monitored and has continuing accountability. • How to benchmark and evaluate the process. Systems need to be installed which allow for evaluation and modifying the risk management process as more information becomes available or facts or assumptions change. All of these factors can be easily adapted to compliance and ethics risk management oversight. Initially it must be important that the Board receive direct access to such information on a company’s policies on this issue.  Three key takeaways: 1. The Board’s role is to keep really bad things from happening to a company. 2. There are six general areas the point can inquire into and lead from. 3. A Board should have direct access to information on the company’s compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 29 Jun 2023 04:00:00 -0000 Vin DiCianni on Board Inquiries into Compliance full Thomas Fox Today, I visit with Vin DiCianni on Board Inquiries into Compliance. Where does “tone at the top” start? With any public and most private U.S. companies, it is at the Board of Directors. But what is the role of a company’s Board in compliance? We start with several general statements about the role of a Board in U.S. companies. First, a Board should not engage in management but should engage in oversight of a CEO and senior management. The Board does this through asking hard questions, risk assessment and identification. A white paper by Deloitte & Touche LLP, entitled, Risk Intelligence Governance—A Practical Guide for Boards, laid out six general principles to help guide Boards in the area of risk governance. These six areas can be summarized as follows: • Define the Board’s role. There must be a mutual understanding between the Board, CEO and senior management of the Board’s responsibilities. • Foster a culture of risk management. All stakeholders should understand the risks involved and manage such risks accordingly. • Incorporate risk management directly into a strategy. Oversee the design and implementation of risk evaluation and analysis. • Help define the company’s appetite for risk. All stakeholders need to understand the company’s appetite or lack thereof for risk. • How to execute the risk management process. Maintain an approach that is continually monitored and has continuing accountability. • How to benchmark and evaluate the process. Systems need to be installed which allow for evaluation and modifying the risk management process as more information becomes available or facts or assumptions change. All of these factors can be easily adapted to compliance and ethics risk management oversight. Initially it must be important that the Board receive direct access to such information on a company’s policies on this issue.  Three key takeaways: 1. The Board’s role is to keep really bad things from happening to a company. 2. There are six general areas the point can inquire into and lead from. 3. A Board should have direct access to information on the company’s compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices Where does “tone at the top” start? With any public and most private U.S. companies, it is at the Board of Directors. But what is the role of a company’s Board in compliance? We start with several general statements about the role of a Board in U.S. companies. First, a Board should not engage in management but should engage in oversight of a CEO and senior management. The Board does this through asking hard questions, risk assessment and identification.

A white paper by Deloitte & Touche LLP, entitled, Risk Intelligence Governance—A Practical Guide for Boards, laid out six general principles to help guide Boards in the area of risk governance. These six areas can be summarized as follows:

• Define the Board’s role. There must be a mutual understanding between the Board, CEO and senior management of the Board’s responsibilities.

• Foster a culture of risk management. All stakeholders should understand the risks involved and manage such risks accordingly.

• Incorporate risk management directly into a strategy. Oversee the design and implementation of risk evaluation and analysis.

• Help define the company’s appetite for risk. All stakeholders need to understand the company’s appetite or lack thereof for risk.

• How to execute the risk management process. Maintain an approach that is continually monitored and has continuing accountability.

• How to benchmark and evaluate the process. Systems need to be installed which allow for evaluation and modifying the risk management process as more information becomes available or facts or assumptions change.

All of these factors can be easily adapted to compliance and ethics risk management oversight. Initially it must be important that the Board receive direct access to such information on a company’s policies on this issue.

 Three key takeaways:

1. The Board’s role is to keep really bad things from happening to a company.

2. There are six general areas the point can inquire into and lead from.

3. A Board should have direct access to information on the company’s compliance program.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 658 no One Month to a More Effective Compliance Program with Boards - 3 Areas of Board Inquiry There are three core areas upon which directors should focus their attention regarding to help establish and maintain an effective compliance program: structure, culture, and risk management. Structural questions. This area consists of questions which will aid in determining the fundamental sense of a company’s overall compliance program. The questions should begin with the basics of the program through to how the program operates in action. Cultural questions. This area of inquiry should focus on the culture of the organization regarding compliance. Board members should understand what message is being communicated not only from senior management but also middle management. Equally important, the Board needs to understand what message is being heard at the lowest levels within the company. Risk management questions. Board members need to understand the company’s process being used to identify emerging risks, their evaluation and management. Such risk analysis would be broader than simply a compliance risk assessment and should be tied to other broader corporate matters. Three key takeaways: A Board of Directors should inquire into the structural component of the compliance program as it will aid in determining the fundamental sense of a company’s overall compliance program. Cultural questions should be asked to garner an understanding of what message is being communicated not only from senior management but also middle management. Risk management questions should be asked to understand the company’s process being used to identify emerging risks, their evaluation and management. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 28 Jun 2023 04:00:00 -0000 3 Areas of Board Inquiry full Thomas Fox Today, we consider 3 Areas of Board Inquiry. There are three core areas upon which directors should focus their attention regarding to help establish and maintain an effective compliance program: structure, culture, and risk management. Structural questions. This area consists of questions which will aid in determining the fundamental sense of a company’s overall compliance program. The questions should begin with the basics of the program through to how the program operates in action. Cultural questions. This area of inquiry should focus on the culture of the organization regarding compliance. Board members should understand what message is being communicated not only from senior management but also middle management. Equally important, the Board needs to understand what message is being heard at the lowest levels within the company. Risk management questions. Board members need to understand the company’s process being used to identify emerging risks, their evaluation and management. Such risk analysis would be broader than simply a compliance risk assessment and should be tied to other broader corporate matters. Three key takeaways: A Board of Directors should inquire into the structural component of the compliance program as it will aid in determining the fundamental sense of a company’s overall compliance program. Cultural questions should be asked to garner an understanding of what message is being communicated not only from senior management but also middle management. Risk management questions should be asked to understand the company’s process being used to identify emerging risks, their evaluation and management. Learn more about your ad choices. Visit megaphone.fm/adchoices There are three core areas upon which directors should focus their attention regarding to help establish and maintain an effective compliance program: structure, culture, and risk management.

Structural questions. This area consists of questions which will aid in determining the fundamental sense of a company’s overall compliance program. The questions should begin with the basics of the program through to how the program operates in action.

Cultural questions. This area of inquiry should focus on the culture of the organization regarding compliance. Board members should understand what message is being communicated not only from senior management but also middle management. Equally important, the Board needs to understand what message is being heard at the lowest levels within the company.

Risk management questions. Board members need to understand the company’s process being used to identify emerging risks, their evaluation and management. Such risk analysis would be broader than simply a compliance risk assessment and should be tied to other broader corporate matters.

Three key takeaways:

  1. A Board of Directors should inquire into the structural component of the compliance program as it will aid in determining the fundamental sense of a company’s overall compliance program.
  2. Cultural questions should be asked to garner an understanding of what message is being communicated not only from senior management but also middle management.
  3. Risk management questions should be asked to understand the company’s process being used to identify emerging risks, their evaluation and management.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 169 no One Month to a More Effective Compliance Program with Boards- Incorporating Compliance into a Long-Term Corporate Strategy How can a Board work incorporate the compliance function into a long-term business strategy of the organization? The starting point for a Board of Directors is to develop a framework for incorporating compliance into your long-term strategy. To set up the framework for evaluating compliance into your Board’s long-term strategy is a three-step process, which you can use to determine how comprehensive the Board’s role in your compliance program is as a starting point. 1. Has the company identified the compliance issues relevant to the Board? 2. Has the company assessed and incorporated those compliance issues into its long-term strategy? 3. Has the company communicated its approach to compliance and the influence of those factors on its overall strategy? From this initial inquiry, you can move into some specific questions that the Board can use to determine the overall state of your company’s compliance program. First, a Board can work to identify compliance issues material to your organization. This can be accomplished with compliance-related KPIs, which a Board should prioritize to elevate their impact on compliance. A Board should consider these through the life cycle of a business line or geographic sales area. Next, the Board should work to move compliance into the company’s long-term strategy and have the CCO detail the long-term strategy for the compliance function. The Board should oversee incorporating KPIs into senior management performance evaluations and compensation. Once again building upon the 2020 Update, which asks how the company monitors its senior leadership’s behavior and how senior leadership models proper behavior to subordinates, the Board should make certain systems are in place to quantify or measure performance related to compliance issues, should establish performance goals against which they measure compliance achievement and disclose to shareholders the material compliance issues that drive compensation, the specific goals or performance targets that management must achieve and report on the actual performance against established goals to justify compensation payouts. Finally, the Board should work to communicate the influence of compliance factors on overall corporate strategy by demonstrating how compliance was integrated into the business. Not only is this good from a business perspective and shareholder expectation, but it is also, as the 2020 Update makes clear, what the government expects is the operationalization of compliance going forward. Three key takeaways: 1. Having a long-term strategy is critical. 2. What is the Board’s framework for assessing compliance? 3. Create KPIs to measure senior management’s actions around compliance. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 27 Jun 2023 04:00:00 -0000 Incorporating Compliance into a Long-Term Corporate Strategy full Thomas Fox Today we consider Incorporating Compliance into a Long-Term Corporate Strategy. How can a Board work incorporate the compliance function into a long-term business strategy of the organization? The starting point for a Board of Directors is to develop a framework for incorporating compliance into your long-term strategy. To set up the framework for evaluating compliance into your Board’s long-term strategy is a three-step process, which you can use to determine how comprehensive the Board’s role in your compliance program is as a starting point. 1. Has the company identified the compliance issues relevant to the Board? 2. Has the company assessed and incorporated those compliance issues into its long-term strategy? 3. Has the company communicated its approach to compliance and the influence of those factors on its overall strategy? From this initial inquiry, you can move into some specific questions that the Board can use to determine the overall state of your company’s compliance program. First, a Board can work to identify compliance issues material to your organization. This can be accomplished with compliance-related KPIs, which a Board should prioritize to elevate their impact on compliance. A Board should consider these through the life cycle of a business line or geographic sales area. Next, the Board should work to move compliance into the company’s long-term strategy and have the CCO detail the long-term strategy for the compliance function. The Board should oversee incorporating KPIs into senior management performance evaluations and compensation. Once again building upon the 2020 Update, which asks how the company monitors its senior leadership’s behavior and how senior leadership models proper behavior to subordinates, the Board should make certain systems are in place to quantify or measure performance related to compliance issues, should establish performance goals against which they measure compliance achievement and disclose to shareholders the material compliance issues that drive compensation, the specific goals or performance targets that management must achieve and report on the actual performance against established goals to justify compensation payouts. Finally, the Board should work to communicate the influence of compliance factors on overall corporate strategy by demonstrating how compliance was integrated into the business. Not only is this good from a business perspective and shareholder expectation, but it is also, as the 2020 Update makes clear, what the government expects is the operationalization of compliance going forward. Three key takeaways: 1. Having a long-term strategy is critical. 2. What is the Board’s framework for assessing compliance? 3. Create KPIs to measure senior management’s actions around compliance. Learn more about your ad choices. Visit megaphone.fm/adchoices How can a Board work incorporate the compliance function into a long-term business strategy of the organization?

The starting point for a Board of Directors is to develop a framework for incorporating compliance into your long-term strategy. To set up the framework for evaluating compliance into your Board’s long-term strategy is a three-step process, which you can use to determine how comprehensive the Board’s role in your compliance program is as a starting point.

1. Has the company identified the compliance issues relevant to the Board?

2. Has the company assessed and incorporated those compliance issues into its long-term strategy?

3. Has the company communicated its approach to compliance and the influence of those factors on its overall strategy?

From this initial inquiry, you can move into some specific questions that the Board can use to determine the overall state of your company’s compliance program. First, a Board can work to identify compliance issues material to your organization. This can be accomplished with compliance-related KPIs, which a Board should prioritize to elevate their impact on compliance. A Board should consider these through the life cycle of a business line or geographic sales area. Next, the Board should work to move compliance into the company’s long-term strategy and have the CCO detail the long-term strategy for the compliance function.

The Board should oversee incorporating KPIs into senior management performance evaluations and compensation. Once again building upon the 2020 Update, which asks how the company monitors its senior leadership’s behavior and how senior leadership models proper behavior to subordinates, the Board should make certain systems are in place to quantify or measure performance related to compliance issues, should establish performance goals against which they measure compliance achievement and disclose to shareholders the material compliance issues that drive compensation, the specific goals or performance targets that management must achieve and report on the actual performance against established goals to justify compensation payouts.

Finally, the Board should work to communicate the influence of compliance factors on overall corporate strategy by demonstrating how compliance was integrated into the business. Not only is this good from a business perspective and shareholder expectation, but it is also, as the 2020 Update makes clear, what the government expects is the operationalization of compliance going forward.

Three key takeaways:

1. Having a long-term strategy is critical.

2. What is the Board’s framework for assessing compliance?

3. Create KPIs to measure senior management’s actions around compliance.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 134 no One Month to a More Effective Compliance Program with Boards- The Board and Succession Planning The 2023 ECCP mandated a Board of Directors ensure “the sufficiency of the personnel and resources within the compliance function, in particular, whether those responsible for compliance have: (1) sufficient seniority within the organization; (2) sufficient resources, namely, staff to effectively undertake the requisite auditing, documentation, and analysis; and (3) sufficient autonomy from management, such as direct access to the board of directors or the board’s audit committee.” It went on to pose the following questions about the “sufficiency of the personnel” in the following manner. Under the topic, Seniority and Stature, are the following questions: How does the compliance function compare with other strategic functions in the company in terms of stature, compensation levels, rank/title, reporting line, resources, and access to key decision-makers? and What role has compliance played in the company’s strategic and operational decisions?. Under the topic Experience and Qualifications are the following questions: Do compliance and control personnel have the appropriate experience and qualifications for their roles and responsibilities? Has the level of experience and qualifications in these roles changed over time? How does the company invest in further training and development of the compliance and other control personnel? Who reviews the performance of the compliance function and what is the review process? All of this leads to the inescapable conclusion that the Board of Directors needs to be involved in not only the hiring process for a CCO but also the succession planning. Yet many yet many Board’s fall short on that score. In a Chapman and Cutler LLP quarterly update, entitled, Advancing Board Refreshment Through the Director Succession Planning Process, William Libit and Todd Freier laid out a framework for Boards to use which I have adapted for CCO succession. There are some key traits you should consider in succession planning for any senior management position, including a CCO. Examine the key corporate documents.  Use an assessment framework.  Conduct due diligence.  Maintain a pipeline.  Assess Board policies.  Disclose your succession strategy.  Benchmark your succession strategy.   Three key takeaways: 1. Refreshment is a hot topic in corporate governance. 2. Review your Board policies to understand what your company will need going forward. 3. Transparency in succession planning. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 26 Jun 2023 04:00:00 -0000 The Board and Succession Planning full Thomas Fox What is the role of the Board in Succession planning? The 2023 ECCP mandated a Board of Directors ensure “the sufficiency of the personnel and resources within the compliance function, in particular, whether those responsible for compliance have: (1) sufficient seniority within the organization; (2) sufficient resources, namely, staff to effectively undertake the requisite auditing, documentation, and analysis; and (3) sufficient autonomy from management, such as direct access to the board of directors or the board’s audit committee.” It went on to pose the following questions about the “sufficiency of the personnel” in the following manner. Under the topic, Seniority and Stature, are the following questions: How does the compliance function compare with other strategic functions in the company in terms of stature, compensation levels, rank/title, reporting line, resources, and access to key decision-makers? and What role has compliance played in the company’s strategic and operational decisions?. Under the topic Experience and Qualifications are the following questions: Do compliance and control personnel have the appropriate experience and qualifications for their roles and responsibilities? Has the level of experience and qualifications in these roles changed over time? How does the company invest in further training and development of the compliance and other control personnel? Who reviews the performance of the compliance function and what is the review process? All of this leads to the inescapable conclusion that the Board of Directors needs to be involved in not only the hiring process for a CCO but also the succession planning. Yet many yet many Board’s fall short on that score. In a Chapman and Cutler LLP quarterly update, entitled, Advancing Board Refreshment Through the Director Succession Planning Process, William Libit and Todd Freier laid out a framework for Boards to use which I have adapted for CCO succession. There are some key traits you should consider in succession planning for any senior management position, including a CCO. Examine the key corporate documents.  Use an assessment framework.  Conduct due diligence.  Maintain a pipeline.  Assess Board policies.  Disclose your succession strategy.  Benchmark your succession strategy.   Three key takeaways: 1. Refreshment is a hot topic in corporate governance. 2. Review your Board policies to understand what your company will need going forward. 3. Transparency in succession planning. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2023 ECCP mandated a Board of Directors ensure “the sufficiency of the personnel and resources within the compliance function, in particular, whether those responsible for compliance have: (1) sufficient seniority within the organization; (2) sufficient resources, namely, staff to effectively undertake the requisite auditing, documentation, and analysis; and (3) sufficient autonomy from management, such as direct access to the board of directors or the board’s audit committee.”

It went on to pose the following questions about the “sufficiency of the personnel” in the following manner. Under the topic, Seniority and Stature, are the following questions:

How does the compliance function compare with other strategic functions in the company in terms of stature, compensation levels, rank/title, reporting line, resources, and access to key decision-makers? and What role has compliance played in the company’s strategic and operational decisions?.

Under the topic Experience and Qualifications are the following questions:

Do compliance and control personnel have the appropriate experience and qualifications for their roles and responsibilities? Has the level of experience and qualifications in these roles changed over time? How does the company invest in further training and development of the compliance and other control personnel? Who reviews the performance of the compliance function and what is the review process?

All of this leads to the inescapable conclusion that the Board of Directors needs to be involved in not only the hiring process for a CCO but also the succession planning. Yet many yet many Board’s fall short on that score. In a Chapman and Cutler LLP quarterly update, entitled, Advancing Board Refreshment Through the Director Succession Planning Process, William Libit and Todd Freier laid out a framework for Boards to use which I have adapted for CCO succession. There are some key traits you should consider in succession planning for any senior management position, including a CCO.

  1. Examine the key corporate documents. 
  2. Use an assessment framework. 
  3. Conduct due diligence. 
  4. Maintain a pipeline. 
  5. Assess Board policies. 
  6. Disclose your succession strategy. 
  7. Benchmark your succession strategy. 

 Three key takeaways:

1. Refreshment is a hot topic in corporate governance.

2. Review your Board policies to understand what your company will need going forward.

3. Transparency in succession planning.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 524 no One Month to a More Effective Compliance Program with Boards- the Board Role in Hiring What is the role of a Board of Directors in hiring senior executives, CCOs and even other board members? I explored this issue with Candice Tal, who began by noting, that bad senior executive hires can cost a company much more than simply dollars. She related, the “financial costs in day-to-day operations easily can quadruple that of a regular employee, but it can also impact the company’s corporate governance and board of directors if that executive hire was found to be involved with unethical and illegal activities. Not even a signed contract can protect a company if an executive hire’s unethical actions come to the attention of the national media. Fiduciary risk and exposure for the board of directors cannot be overlooked.” She pointed to the example of Yahoo! and its hire of Scott Thompson. It turned out that Thompson had incorrect information on his online biography regarding his academic credentials. The “implications went beyond the activist shareholder accusations to reflect on the Board of Directors for not vetting his background more carefully. The company may have been exposed to claims of providing false information to the SEC and potential stockholder law suits. Thompson’s 120-day tenure at Yahoo! cost the company over $7 million and seriously tarnished the company’s reputation in the business community.” The key is that a company engages in an executive due diligence investigation rather than simply a routine or even executive-level background investigation. Tal explained that an executive background search, is “typically limited to a five-component review of: criminal records, employment verification, degree or education verification, social security validation, address verification and sometimes credit history.” Such searches are “very limited searches.” Conversely, executive due diligence, “looks in-depth at all available public records sources: criminal history, civil litigation issues, financial and legal issues, relationships with other companies and board advisory positions, reputation, misrepresented education and overstated work history, behavioral history (for example litigiousness), and, in particular, undisclosed or adverse issues.” While it is generally “more costly than executive background checks and takes more time, the information gathered is extremely valuable and can save a company substantially more. A high quality due diligence review can find important information which would not be returned in a routine executive background check.” Infortal has found that up to 20% of executive search candidates fail a deep-level due diligence investigation. Now consider how many senior executive slots your company has and add to that Board of Directors seats and you can quickly see the risk of failure to consider an executive due diligence search when promoting or hiring. Moreover, you need an executive level due diligence in other business situations as well, including the senior management of new business acquisitions brought into your organization through a merger or other acquisition, selecting new Board members, screening corporate Board of Directors and of course, for third party business partners and other agents in the sales and supply chain channels.  Three key takeaways: The costs of a bad executive hire can far exceed the dollar loss. Do not forget the differences between an executive background check and executive level due diligence. 20% of all senior executives fail an executive level due diligence check. For more information, check out The Compliance Handbook, 4th edition, available here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 23 Jun 2023 04:00:00 -0000 The Board Role in Hiring full Thomas Fox What is the Board Role in Hiring? What is the role of a Board of Directors in hiring senior executives, CCOs and even other board members? I explored this issue with Candice Tal, who began by noting, that bad senior executive hires can cost a company much more than simply dollars. She related, the “financial costs in day-to-day operations easily can quadruple that of a regular employee, but it can also impact the company’s corporate governance and board of directors if that executive hire was found to be involved with unethical and illegal activities. Not even a signed contract can protect a company if an executive hire’s unethical actions come to the attention of the national media. Fiduciary risk and exposure for the board of directors cannot be overlooked.” She pointed to the example of Yahoo! and its hire of Scott Thompson. It turned out that Thompson had incorrect information on his online biography regarding his academic credentials. The “implications went beyond the activist shareholder accusations to reflect on the Board of Directors for not vetting his background more carefully. The company may have been exposed to claims of providing false information to the SEC and potential stockholder law suits. Thompson’s 120-day tenure at Yahoo! cost the company over $7 million and seriously tarnished the company’s reputation in the business community.” The key is that a company engages in an executive due diligence investigation rather than simply a routine or even executive-level background investigation. Tal explained that an executive background search, is “typically limited to a five-component review of: criminal records, employment verification, degree or education verification, social security validation, address verification and sometimes credit history.” Such searches are “very limited searches.” Conversely, executive due diligence, “looks in-depth at all available public records sources: criminal history, civil litigation issues, financial and legal issues, relationships with other companies and board advisory positions, reputation, misrepresented education and overstated work history, behavioral history (for example litigiousness), and, in particular, undisclosed or adverse issues.” While it is generally “more costly than executive background checks and takes more time, the information gathered is extremely valuable and can save a company substantially more. A high quality due diligence review can find important information which would not be returned in a routine executive background check.” Infortal has found that up to 20% of executive search candidates fail a deep-level due diligence investigation. Now consider how many senior executive slots your company has and add to that Board of Directors seats and you can quickly see the risk of failure to consider an executive due diligence search when promoting or hiring. Moreover, you need an executive level due diligence in other business situations as well, including the senior management of new business acquisitions brought into your organization through a merger or other acquisition, selecting new Board members, screening corporate Board of Directors and of course, for third party business partners and other agents in the sales and supply chain channels.  Three key takeaways: The costs of a bad executive hire can far exceed the dollar loss. Do not forget the differences between an executive background check and executive level due diligence. 20% of all senior executives fail an executive level due diligence check. For more information, check out The Compliance Handbook, 4th edition, available here. Learn more about your ad choices. Visit megaphone.fm/adchoices What is the role of a Board of Directors in hiring senior executives, CCOs and even other board members? I explored this issue with Candice Tal, who began by noting, that bad senior executive hires can cost a company much more than simply dollars. She related, the “financial costs in day-to-day operations easily can quadruple that of a regular employee, but it can also impact the company’s corporate governance and board of directors if that executive hire was found to be involved with unethical and illegal activities. Not even a signed contract can protect a company if an executive hire’s unethical actions come to the attention of the national media. Fiduciary risk and exposure for the board of directors cannot be overlooked.”

She pointed to the example of Yahoo! and its hire of Scott Thompson. It turned out that Thompson had incorrect information on his online biography regarding his academic credentials. The “implications went beyond the activist shareholder accusations to reflect on the Board of Directors for not vetting his background more carefully. The company may have been exposed to claims of providing false information to the SEC and potential stockholder law suits. Thompson’s 120-day tenure at Yahoo! cost the company over $7 million and seriously tarnished the company’s reputation in the business community.”

The key is that a company engages in an executive due diligence investigation rather than simply a routine or even executive-level background investigation. Tal explained that an executive background search, is “typically limited to a five-component review of: criminal records, employment verification, degree or education verification, social security validation, address verification and sometimes credit history.” Such searches are “very limited searches.”

Conversely, executive due diligence, “looks in-depth at all available public records sources: criminal history, civil litigation issues, financial and legal issues, relationships with other companies and board advisory positions, reputation, misrepresented education and overstated work history, behavioral history (for example litigiousness), and, in particular, undisclosed or adverse issues.” While it is generally “more costly than executive background checks and takes more time, the information gathered is extremely valuable and can save a company substantially more. A high quality due diligence review can find important information which would not be returned in a routine executive background check.”

Infortal has found that up to 20% of executive search candidates fail a deep-level due diligence investigation. Now consider how many senior executive slots your company has and add to that Board of Directors seats and you can quickly see the risk of failure to consider an executive due diligence search when promoting or hiring. Moreover, you need an executive level due diligence in other business situations as well, including the senior management of new business acquisitions brought into your organization through a merger or other acquisition, selecting new Board members, screening corporate Board of Directors and of course, for third party business partners and other agents in the sales and supply chain channels. 

Three key takeaways:

  1. The costs of a bad executive hire can far exceed the dollar loss.
  2. Do not forget the differences between an executive background check and executive level due diligence.
  3. 20% of all senior executives fail an executive level due diligence check.


For more information, check out The Compliance Handbook, 4th edition, available here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 612 no One Month to a More Effective Compliance Program with Boards- Boards and Doing Business in China The Administration’s trade war with China has highlighted the risks of both doing business in China and investing the Chinese companies which come to America to raise capital. Yet this has been a long-known and outstanding problem in the anti-corruption enforcement world. The 2014 bribery and corruption case of GlaxoSmithKline PLC (GSK), which resulted in a $490 million fine for the firm, resonated across the corporate globe. While many questions are still unanswered, one that seems to be at the forefront of the inquiry was where was the GSK Board of Directors? This matter demonstrates that the role of a Board of Directors is becoming more important and more of a critical part of any effective compliance program. In a NACD Directorship article, entitled “Corruption in China and Elsewhere Demands Board Oversight”, Eric V. Zwisler and Dean A. Yoost note, “Boards are ultimately responsible for risk oversight” any Board of a company with operations in China “needs to have a clear understanding of its duties and responsibilities under the FCPA and other international laws, such as the U.K. Bribery Act”. Why should China be on the radar of Boards? From 2010-2019, over 25% of all FCPA enforcement actions derived from China, that’s why. FCPA enforcement actions have made clear that numerous Chinese businesses have proven adept at appearing compliant while hiding unacceptable business practices. A Board should be aware that a well-crafted compliance program must be complemented with a thorough understanding of frontline business practices and constant auditing of actual practices, not just a paper compliance program. This means that both monitoring and auditing should be visible to the Board. Three key takeaways: China presents the highest FCPA risk and after GSK, domestic law corruption risk as well. Chinese companies have been adept at hiding corrupt business practices from their western owners. A Board must be cognizant of these risks and enhance their risk management process in China and other high-risk jurisdictions. For more information, check out The Compliance Handbook, 4th edition, available here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 22 Jun 2023 04:00:00 -0000 Boards and Doing Business in China full Thomas Fox Why Boards must pay attention when doing business in China. The Administration’s trade war with China has highlighted the risks of both doing business in China and investing the Chinese companies which come to America to raise capital. Yet this has been a long-known and outstanding problem in the anti-corruption enforcement world. The 2014 bribery and corruption case of GlaxoSmithKline PLC (GSK), which resulted in a $490 million fine for the firm, resonated across the corporate globe. While many questions are still unanswered, one that seems to be at the forefront of the inquiry was where was the GSK Board of Directors? This matter demonstrates that the role of a Board of Directors is becoming more important and more of a critical part of any effective compliance program. In a NACD Directorship article, entitled “Corruption in China and Elsewhere Demands Board Oversight”, Eric V. Zwisler and Dean A. Yoost note, “Boards are ultimately responsible for risk oversight” any Board of a company with operations in China “needs to have a clear understanding of its duties and responsibilities under the FCPA and other international laws, such as the U.K. Bribery Act”. Why should China be on the radar of Boards? From 2010-2019, over 25% of all FCPA enforcement actions derived from China, that’s why. FCPA enforcement actions have made clear that numerous Chinese businesses have proven adept at appearing compliant while hiding unacceptable business practices. A Board should be aware that a well-crafted compliance program must be complemented with a thorough understanding of frontline business practices and constant auditing of actual practices, not just a paper compliance program. This means that both monitoring and auditing should be visible to the Board. Three key takeaways: China presents the highest FCPA risk and after GSK, domestic law corruption risk as well. Chinese companies have been adept at hiding corrupt business practices from their western owners. A Board must be cognizant of these risks and enhance their risk management process in China and other high-risk jurisdictions. For more information, check out The Compliance Handbook, 4th edition, available here. Learn more about your ad choices. Visit megaphone.fm/adchoices The Administration’s trade war with China has highlighted the risks of both doing business in China and investing the Chinese companies which come to America to raise capital. Yet this has been a long-known and outstanding problem in the anti-corruption enforcement world. The 2014 bribery and corruption case of GlaxoSmithKline PLC (GSK), which resulted in a $490 million fine for the firm, resonated across the corporate globe. While many questions are still unanswered, one that seems to be at the forefront of the inquiry was where was the GSK Board of Directors? This matter demonstrates that the role of a Board of Directors is becoming more important and more of a critical part of any effective compliance program.

In a NACD Directorship article, entitled “Corruption in China and Elsewhere Demands Board Oversight”, Eric V. Zwisler and Dean A. Yoost note, “Boards are ultimately responsible for risk oversight” any Board of a company with operations in China “needs to have a clear understanding of its duties and responsibilities under the FCPA and other international laws, such as the U.K. Bribery Act”. Why should China be on the radar of Boards? From 2010-2019, over 25% of all FCPA enforcement actions derived from China, that’s why.

FCPA enforcement actions have made clear that numerous Chinese businesses have proven adept at appearing compliant while hiding unacceptable business practices. A Board should be aware that a well-crafted compliance program must be complemented with a thorough understanding of frontline business practices and constant auditing of actual practices, not just a paper compliance program. This means that both monitoring and auditing should be visible to the Board.

Three key takeaways:

  1. China presents the highest FCPA risk and after GSK, domestic law corruption risk as well.
  2. Chinese companies have been adept at hiding corrupt business practices from their western owners.
  3. A Board must be cognizant of these risks and enhance their risk management process in China and other high-risk jurisdictions.


For more information, check out The Compliance Handbook, 4th edition, available here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 481 no One Month to a More Effective Compliance Program with Boards- Board Failures Today, consider a couple of landmark failures at the Board level around bribery and corruption. VimpelCom Ltd. In 2015 (now Veon Ltd.), the DOJ alleged that Dutch telecom VimpelCom sought to enter the telecom market through the acquisition of a local player, Unitel, as an entrée into the Uzbekistan market. Unitel made clear to VimpelCom that to have access to, obtain and retain business in the Uzbeki telecom space, VimpelCom would have to, according to the DPA, “regularly pay Foreign Officials millions of dollars” to Gulnara Karimova, the daughter of the then President of the country. VimpelCom also acquired another entity Butzel, that was at least partially owned by an Uzbeki government official, who hid their interest through a shell company, which was known to VimpelCom. VimpelCom did not articulate a legitimate business reason for the deal and paid $60 million for Buztel. Ultimately, VimpelCom agreed to pay approximately $800 million in fines for these activities in 2016.  BizJet. Another FCPA enforcement action involved the Tulsa-based company BizJet International Sales and Support Inc. (BizJet), which had four senior executives convicted for their participation in a bribery scheme. But this case also involved the Board of Directions. In the Criminal Information it stated that in November 2005: …at a Board of Directors meeting of the BizJet Board, Executive A and Executive B discussed with the Board that the decision of where an aircraft is sent for maintenance work is generally made by the potential customer’s director of maintenance or chief pilot, that these individuals are demanding $30,000 to $40,000 in commissions, and that BizJet would pay referral fees in order to gain market share. In both cases, this is where the rubber hits the road. If a company is willing to commit bribery and engage in corruption to secure business, no amount of doing compliance is going to help. If senior management is ready, willing and able to lie, cheat and steal, the Board is the final backstop to prevent such conduct. Both the VimpelCom and BizJet Boards sorely failed in their compliance duties. Three key takeaways: Board liability will be severe based upon similar conduct going forward. Board members must critically challenge management on its conduct. The Board is the ultimate backstop against bribery and corruption. For more information, check out The Compliance Handbook, 4th edition, available here. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 21 Jun 2023 04:00:00 -0000 Board Failures full Thomas Fox Vin DiCianni joins me to discuss Board failures in compliance. Today, consider a couple of landmark failures at the Board level around bribery and corruption. VimpelCom Ltd. In 2015 (now Veon Ltd.), the DOJ alleged that Dutch telecom VimpelCom sought to enter the telecom market through the acquisition of a local player, Unitel, as an entrée into the Uzbekistan market. Unitel made clear to VimpelCom that to have access to, obtain and retain business in the Uzbeki telecom space, VimpelCom would have to, according to the DPA, “regularly pay Foreign Officials millions of dollars” to Gulnara Karimova, the daughter of the then President of the country. VimpelCom also acquired another entity Butzel, that was at least partially owned by an Uzbeki government official, who hid their interest through a shell company, which was known to VimpelCom. VimpelCom did not articulate a legitimate business reason for the deal and paid $60 million for Buztel. Ultimately, VimpelCom agreed to pay approximately $800 million in fines for these activities in 2016.  BizJet. Another FCPA enforcement action involved the Tulsa-based company BizJet International Sales and Support Inc. (BizJet), which had four senior executives convicted for their participation in a bribery scheme. But this case also involved the Board of Directions. In the Criminal Information it stated that in November 2005: …at a Board of Directors meeting of the BizJet Board, Executive A and Executive B discussed with the Board that the decision of where an aircraft is sent for maintenance work is generally made by the potential customer’s director of maintenance or chief pilot, that these individuals are demanding $30,000 to $40,000 in commissions, and that BizJet would pay referral fees in order to gain market share. In both cases, this is where the rubber hits the road. If a company is willing to commit bribery and engage in corruption to secure business, no amount of doing compliance is going to help. If senior management is ready, willing and able to lie, cheat and steal, the Board is the final backstop to prevent such conduct. Both the VimpelCom and BizJet Boards sorely failed in their compliance duties. Three key takeaways: Board liability will be severe based upon similar conduct going forward. Board members must critically challenge management on its conduct. The Board is the ultimate backstop against bribery and corruption. For more information, check out The Compliance Handbook, 4th edition, available here. Learn more about your ad choices. Visit megaphone.fm/adchoices Today, consider a couple of landmark failures at the Board level around bribery and corruption.

VimpelCom Ltd. In 2015 (now Veon Ltd.), the DOJ alleged that Dutch telecom VimpelCom sought to enter the telecom market through the acquisition of a local player, Unitel, as an entrée into the Uzbekistan market. Unitel made clear to VimpelCom that to have access to, obtain and retain business in the Uzbeki telecom space, VimpelCom would have to, according to the DPA, “regularly pay Foreign Officials millions of dollars” to Gulnara Karimova, the daughter of the then President of the country. VimpelCom also acquired another entity Butzel, that was at least partially owned by an Uzbeki government official, who hid their interest through a shell company, which was known to VimpelCom. VimpelCom did not articulate a legitimate business reason for the deal and paid $60 million for Buztel.

Ultimately, VimpelCom agreed to pay approximately $800 million in fines for these activities in 2016. 

BizJet. Another FCPA enforcement action involved the Tulsa-based company BizJet International Sales and Support Inc. (BizJet), which had four senior executives convicted for their participation in a bribery scheme. But this case also involved the Board of Directions. In the Criminal Information it stated that in November 2005:

…at a Board of Directors meeting of the BizJet Board, Executive A and Executive B discussed with the Board that the decision of where an aircraft is sent for maintenance work is generally made by the potential customer’s director of maintenance or chief pilot, that these individuals are demanding $30,000 to $40,000 in commissions, and that BizJet would pay referral fees in order to gain market share.

In both cases, this is where the rubber hits the road. If a company is willing to commit bribery and engage in corruption to secure business, no amount of doing compliance is going to help. If senior management is ready, willing and able to lie, cheat and steal, the Board is the final backstop to prevent such conduct. Both the VimpelCom and BizJet Boards sorely failed in their compliance duties.

Three key takeaways:

  1. Board liability will be severe based upon similar conduct going forward.
  2. Board members must critically challenge management on its conduct.
  3. The Board is the ultimate backstop against bribery and corruption.


For more information, check out The Compliance Handbook, 4th edition, available here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 680 no One Month to a More Effective Compliance Program with Boards-Key Board Metrics for Compliance What are metrics for a Board of Directors around compliance? Former Assistant Attorney General Leslie Caldwell laid out some that the Department of Justice (DOJ) would consider in a review of compliance programs. These metrics are: Does the institution ensure that its directors and senior managers provide strong, explicit and visible support for its corporate compliance policies? Does the Board maintain a material role in overseeing a company’s overall compliance framework? These requirements move beyond simply having the correct tone at the top, which every Board should articulate. The 2020 Update to the Evaluation of Corporate Compliance Programs added the following, under Oversight by posing the following questions: What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions? What types of information have the board of directors and senior management examined in their exercise of oversight in the area in which the misconduct occurred? Based on the foregoing, when determining the Board’s role, begin with two questions. First, does the Board of Directors exercise independent review of a company’s compliance program? Second, is the Board of Directors provided information sufficient to enable the exercise of independent judgment? Three key takeaways: The DOJ expects active engagement by a Board around compliance. Does the Board exercise independent review of the compliance program? The convergence of the Yates Memo, Caldwell’s metrics, the Evaluation and FCPA Corporate Enforcement Policy mandate Board metrics around compliance. For more information, check out The Compliance Handbook, 4th edition, available here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 20 Jun 2023 04:00:00 -0000 Key Board Metrics for Compliance full Thomas Fox What are the Key Board Metrics for Compliance? What are metrics for a Board of Directors around compliance? Former Assistant Attorney General Leslie Caldwell laid out some that the Department of Justice (DOJ) would consider in a review of compliance programs. These metrics are: Does the institution ensure that its directors and senior managers provide strong, explicit and visible support for its corporate compliance policies? Does the Board maintain a material role in overseeing a company’s overall compliance framework? These requirements move beyond simply having the correct tone at the top, which every Board should articulate. The 2020 Update to the Evaluation of Corporate Compliance Programs added the following, under Oversight by posing the following questions: What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions? What types of information have the board of directors and senior management examined in their exercise of oversight in the area in which the misconduct occurred? Based on the foregoing, when determining the Board’s role, begin with two questions. First, does the Board of Directors exercise independent review of a company’s compliance program? Second, is the Board of Directors provided information sufficient to enable the exercise of independent judgment? Three key takeaways: The DOJ expects active engagement by a Board around compliance. Does the Board exercise independent review of the compliance program? The convergence of the Yates Memo, Caldwell’s metrics, the Evaluation and FCPA Corporate Enforcement Policy mandate Board metrics around compliance. For more information, check out The Compliance Handbook, 4th edition, available here. Learn more about your ad choices. Visit megaphone.fm/adchoices What are metrics for a Board of Directors around compliance? Former Assistant Attorney General Leslie Caldwell laid out some that the Department of Justice (DOJ) would consider in a review of compliance programs. These metrics are:

  • Does the institution ensure that its directors and senior managers provide strong, explicit and visible support for its corporate compliance policies?
  • Does the Board maintain a material role in overseeing a company’s overall compliance framework?

These requirements move beyond simply having the correct tone at the top, which every Board should articulate. The 2020 Update to the Evaluation of Corporate Compliance Programs added the following, under Oversight by posing the following questions: What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions? What types of information have the board of directors and senior management examined in their exercise of oversight in the area in which the misconduct occurred?

Based on the foregoing, when determining the Board’s role, begin with two questions. First, does the Board of Directors exercise independent review of a company’s compliance program? Second, is the Board of Directors provided information sufficient to enable the exercise of independent judgment?

Three key takeaways:

  1. The DOJ expects active engagement by a Board around compliance.
  2. Does the Board exercise independent review of the compliance program?
  3. The convergence of the Yates Memo, Caldwell’s metrics, the Evaluation and FCPA Corporate Enforcement Policy mandate Board metrics around compliance.


For more information, check out The Compliance Handbook, 4th edition, available here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 609 One Month to a More Effective Compliance Program with Boards- What leads to a successful Board investigation? Many companies have an investigation protocol in place when a potential Foreign Corruption Practices Act (FCPA) or other legal issue arises. However, many Boards of Directors do not have the same rigor when it comes to an investigation, which should be conducted or led by the Board itself. The consequences of this lack of foresight can be problematic because if a Board of Directors does not get an investigation, which it handles right, the consequences to the company, its reputation, and value can all be quite severe. In an article in the Corporate Board magazine, entitled “Successful Board Investigations”; David Bayless and Tammy Albarrán, wrote about five key goals that any investigation led by a Board of Directors must meet. Consider whether you need independent outside counsel. Consider hiring an experienced investigator to lead the internal investigation. Consider the need to retain outside experts. Analyze potential conflicts of interest at the outset and during the investigation. Carefully evaluate whistleblower allegations. Request regular updates from outside counsel, without limiting the investigation. Consider whether an oral report at the conclusion of the investigation is sufficient. The authors conclude their piece by stating, “By keeping in mind the issues addressed above, the Board will be better prepared for the investigation and readily able to exercise good judgment throughout the review. A well-conducted investigation by the Board may spare the company further disruption and costs associated with follow-on investigations by the regulators, or at the very least minimize the company’s exposure.” Three key takeaways: Retain the right counsel. Consider conflicts and appearance. Carefully evaluate all whistleblower allegations and reject retaliation. Consider receiving oral reports on an ongoing basis and one lengthy oral report at the end of the investigation. For more information, check out The Compliance Handbook, 4th edition, available here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 19 Jun 2023 04:00:00 -0000 What leads to a successful Board investigation? full Thomas Fox Today we take up What leads to a successful Board investigation? Many companies have an investigation protocol in place when a potential Foreign Corruption Practices Act (FCPA) or other legal issue arises. However, many Boards of Directors do not have the same rigor when it comes to an investigation, which should be conducted or led by the Board itself. The consequences of this lack of foresight can be problematic because if a Board of Directors does not get an investigation, which it handles right, the consequences to the company, its reputation, and value can all be quite severe. In an article in the Corporate Board magazine, entitled “Successful Board Investigations”; David Bayless and Tammy Albarrán, wrote about five key goals that any investigation led by a Board of Directors must meet. Consider whether you need independent outside counsel. Consider hiring an experienced investigator to lead the internal investigation. Consider the need to retain outside experts. Analyze potential conflicts of interest at the outset and during the investigation. Carefully evaluate whistleblower allegations. Request regular updates from outside counsel, without limiting the investigation. Consider whether an oral report at the conclusion of the investigation is sufficient. The authors conclude their piece by stating, “By keeping in mind the issues addressed above, the Board will be better prepared for the investigation and readily able to exercise good judgment throughout the review. A well-conducted investigation by the Board may spare the company further disruption and costs associated with follow-on investigations by the regulators, or at the very least minimize the company’s exposure.” Three key takeaways: Retain the right counsel. Consider conflicts and appearance. Carefully evaluate all whistleblower allegations and reject retaliation. Consider receiving oral reports on an ongoing basis and one lengthy oral report at the end of the investigation. For more information, check out The Compliance Handbook, 4th edition, available here. Learn more about your ad choices. Visit megaphone.fm/adchoices Many companies have an investigation protocol in place when a potential Foreign Corruption Practices Act (FCPA) or other legal issue arises. However, many Boards of Directors do not have the same rigor when it comes to an investigation, which should be conducted or led by the Board itself. The consequences of this lack of foresight can be problematic because if a Board of Directors does not get an investigation, which it handles right, the consequences to the company, its reputation, and value can all be quite severe.

In an article in the Corporate Board magazine, entitled “Successful Board Investigations”; David Bayless and Tammy Albarrán, wrote about five key goals that any investigation led by a Board of Directors must meet.

  • Consider whether you need independent outside counsel.
  • Consider hiring an experienced investigator to lead the internal investigation.
  • Consider the need to retain outside experts.
  • Analyze potential conflicts of interest at the outset and during the investigation.
  • Carefully evaluate whistleblower allegations.
  • Request regular updates from outside counsel, without limiting the investigation.
  • Consider whether an oral report at the conclusion of the investigation is sufficient.


The authors conclude their piece by stating, “By keeping in mind the issues addressed above, the Board will be better prepared for the investigation and readily able to exercise good judgment throughout the review. A well-conducted investigation by the Board may spare the company further disruption and costs associated with follow-on investigations by the regulators, or at the very least minimize the company’s exposure.”

Three key takeaways:

  1. Retain the right counsel. Consider conflicts and appearance.
  2. Carefully evaluate all whistleblower allegations and reject retaliation.
  3. Consider receiving oral reports on an ongoing basis and one lengthy oral report at the end of the investigation.


For more information, check out The Compliance Handbook, 4th edition, available here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 497 no One Month to a More Effective Compliance Program with Boards – What Is Your Board’s Investigation Protocol Many companies have an investigation protocol in place when a potential Foreign Corruption Practices Act (FCPA) or other legal issue arises? However, many Boards of Directors do not have the same rigor when it comes to an investigation, which should be conducted or led by the Board itself. The consequences of this lack of foresight can be problematic, because if a Board of Directors does not get an investigation which it handles right, the consequences to the company, its reputation and value can all be quite severe. In an article in the Corporate Board magazine, entitled “Successful Board Investigations”; David Bayless and Tammy Albarrán, wrote about five key goals that any investigation led by a Board of Directors must meet. They are: Thoroughness - The authors believe that one of the key, and most critical, questions that any regulator might pose is just how thorough is an investigation; to test whether they can rely on the facts discovered without hav­ing to repeat the investigation themselves. Objectivity - Here the authors write that any “investigation must follow the facts wherever they lead, regardless of the conse­quences. Accuracy - As in any part of a best practices anti-corruption compliance program, the three most important things are Document, Document and Document. This means that the factual findings of an investiga­tion must be well supported. Timeliness - Certainly in the world of FCPA enforcement, an internal investigation should be done quickly. So timeliness is crucial. Credibility - One of the realities of any FCPA investigation is that a Board of Directors led investigation is reviewed after the fact by not only skeptical third parties but also sometimes years after the initial events and investigation. Three Key Takeaways The Board should have a written protocol for investigations prepared in advance. This gives cover to a Board when regulators come knocking or other third parties seek review. Remember the 5 goals of any Board led investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 16 Jun 2023 04:00:00 -0000 BOD Investigation Protocol bonus 10 Thomas Fox What should your Board Investigation Protocol be? Find out in this episode. Many companies have an investigation protocol in place when a potential Foreign Corruption Practices Act (FCPA) or other legal issue arises? However, many Boards of Directors do not have the same rigor when it comes to an investigation, which should be conducted or led by the Board itself. The consequences of this lack of foresight can be problematic, because if a Board of Directors does not get an investigation which it handles right, the consequences to the company, its reputation and value can all be quite severe. In an article in the Corporate Board magazine, entitled “Successful Board Investigations”; David Bayless and Tammy Albarrán, wrote about five key goals that any investigation led by a Board of Directors must meet. They are: Thoroughness - The authors believe that one of the key, and most critical, questions that any regulator might pose is just how thorough is an investigation; to test whether they can rely on the facts discovered without hav­ing to repeat the investigation themselves. Objectivity - Here the authors write that any “investigation must follow the facts wherever they lead, regardless of the conse­quences. Accuracy - As in any part of a best practices anti-corruption compliance program, the three most important things are Document, Document and Document. This means that the factual findings of an investiga­tion must be well supported. Timeliness - Certainly in the world of FCPA enforcement, an internal investigation should be done quickly. So timeliness is crucial. Credibility - One of the realities of any FCPA investigation is that a Board of Directors led investigation is reviewed after the fact by not only skeptical third parties but also sometimes years after the initial events and investigation. Three Key Takeaways The Board should have a written protocol for investigations prepared in advance. This gives cover to a Board when regulators come knocking or other third parties seek review. Remember the 5 goals of any Board led investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Many companies have an investigation protocol in place when a potential Foreign Corruption Practices Act (FCPA) or other legal issue arises? However, many Boards of Directors do not have the same rigor when it comes to an investigation, which should be conducted or led by the Board itself. The consequences of this lack of foresight can be problematic, because if a Board of Directors does not get an investigation which it handles right, the consequences to the company, its reputation and value can all be quite severe.

In an article in the Corporate Board magazine, entitled “Successful Board Investigations”; David Bayless and Tammy Albarrán, wrote about five key goals that any investigation led by a Board of Directors must meet. They are:

  • Thoroughness - The authors believe that one of the key, and most critical, questions that any regulator might pose is just how thorough is an investigation; to test whether they can rely on the facts discovered without hav­ing to repeat the investigation themselves.
  • Objectivity - Here the authors write that any “investigation must follow the facts wherever they lead, regardless of the conse­quences.
  • Accuracy - As in any part of a best practices anti-corruption compliance program, the three most important things are Document, Document and Document. This means that the factual findings of an investiga­tion must be well supported.
  • Timeliness - Certainly in the world of FCPA enforcement, an internal investigation should be done quickly. So timeliness is crucial.
  • Credibility - One of the realities of any FCPA investigation is that a Board of Directors led investigation is reviewed after the fact by not only skeptical third parties but also sometimes years after the initial events and investigation.

Three Key Takeaways

  1. The Board should have a written protocol for investigations prepared in advance.
  2. This gives cover to a Board when regulators come knocking or other third parties seek review.
  3. Remember the 5 goals of any Board led investigation.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 575 no One Month to a More Effective Compliance Program with Boards - Board Governance and Risk Oversight One of the ongoing questions from members of the Board of Directors is how to resolve the tension between oversight and management. I recently had the opportunity to visit with Joe Howell, former Executive Vice President (EVP) of Workiva, Inc., on this subject. Howell has worked on and with Boards of Directors at various companies, and I wanted to garner his understanding of the role of a Board, senior management, and a Chief Compliance Officer (CCO). Howell’s short response was an excellent starting point for understanding the role; put sand in management’s shoes. The key to such a metaphor succeeding is that a Board of Directors, “by continuing to challenge management on these scenarios that management has considered and the stories management is telling itself about what could go wrong,” can “help get management out of its comfort zone by and large executive teams begin to believe themselves when they talk about how well they’re doing. The independent challenge that the board can offer is putting a little bit of sand in the shoe to make sure you’re thinking about things carefully can cause you to step back and focus your resources where they’re needed.” Howell noted that the role of the Board is not management but oversight, focusing on governance. To do so, an effective Board should challenge senior management not only on what they have planned for but what they may not have considered or may not even know about. He said, “One perfect example is the reputation of those stakeholders involved in the company, and that can be the management team itself, the employees, and the board members themselves.” This is because reputational damage hurts everyone. Howell stated, “It’s essential as we go through some ways the Board can help management in that role. I think the things that make a difference to management is when the Board can be an effective devil’s advocate. Not managing management but helping them in their governing role by helping management to step back and think critically of their underlying assumptions and biases.” A Board is more than just there to be a rubber stamp for senior management. It must exercise independent judgment, action, and oversight. Further, it is the Board’s role to ask hard, difficult, and probing questions to ensure management is doing its job and has considered other risk possibilities. Three Key Takeaways: Boards should force management to open up the company to itself. Boards should be a grain of sand in the shoe of management. Boards should ensure senior management is aware of and planning for known and unknown risks. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 15 Jun 2023 04:00:00 -0000 Board Governance and Risk Oversight bonus 9 Thomas Fox Today, we review Board Governance and Risk Oversight. One of the ongoing questions from members of the Board of Directors is how to resolve the tension between oversight and management. I recently had the opportunity to visit with Joe Howell, former Executive Vice President (EVP) of Workiva, Inc., on this subject. Howell has worked on and with Boards of Directors at various companies, and I wanted to garner his understanding of the role of a Board, senior management, and a Chief Compliance Officer (CCO). Howell’s short response was an excellent starting point for understanding the role; put sand in management’s shoes. The key to such a metaphor succeeding is that a Board of Directors, “by continuing to challenge management on these scenarios that management has considered and the stories management is telling itself about what could go wrong,” can “help get management out of its comfort zone by and large executive teams begin to believe themselves when they talk about how well they’re doing. The independent challenge that the board can offer is putting a little bit of sand in the shoe to make sure you’re thinking about things carefully can cause you to step back and focus your resources where they’re needed.” Howell noted that the role of the Board is not management but oversight, focusing on governance. To do so, an effective Board should challenge senior management not only on what they have planned for but what they may not have considered or may not even know about. He said, “One perfect example is the reputation of those stakeholders involved in the company, and that can be the management team itself, the employees, and the board members themselves.” This is because reputational damage hurts everyone. Howell stated, “It’s essential as we go through some ways the Board can help management in that role. I think the things that make a difference to management is when the Board can be an effective devil’s advocate. Not managing management but helping them in their governing role by helping management to step back and think critically of their underlying assumptions and biases.” A Board is more than just there to be a rubber stamp for senior management. It must exercise independent judgment, action, and oversight. Further, it is the Board’s role to ask hard, difficult, and probing questions to ensure management is doing its job and has considered other risk possibilities. Three Key Takeaways: Boards should force management to open up the company to itself. Boards should be a grain of sand in the shoe of management. Boards should ensure senior management is aware of and planning for known and unknown risks. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the ongoing questions from members of the Board of Directors is how to resolve the tension between oversight and management. I recently had the opportunity to visit with Joe Howell, former Executive Vice President (EVP) of Workiva, Inc., on this subject. Howell has worked on and with Boards of Directors at various companies, and I wanted to garner his understanding of the role of a Board, senior management, and a Chief Compliance Officer (CCO). Howell’s short response was an excellent starting point for understanding the role; put sand in management’s shoes.

The key to such a metaphor succeeding is that a Board of Directors, “by continuing to challenge management on these scenarios that management has considered and the stories management is telling itself about what could go wrong,” can “help get management out of its comfort zone by and large executive teams begin to believe themselves when they talk about how well they’re doing. The independent challenge that the board can offer is putting a little bit of sand in the shoe to make sure you’re thinking about things carefully can cause you to step back and focus your resources where they’re needed.”

Howell noted that the role of the Board is not management but oversight, focusing on governance. To do so, an effective Board should challenge senior management not only on what they have planned for but what they may not have considered or may not even know about. He said, “One perfect example is the reputation of those stakeholders involved in the company, and that can be the management team itself, the employees, and the board members themselves.” This is because reputational damage hurts everyone. Howell stated, “It’s essential as we go through some ways the Board can help management in that role. I think the things that make a difference to management is when the Board can be an effective devil’s advocate. Not managing management but helping them in their governing role by helping management to step back and think critically of their underlying assumptions and biases.”

A Board is more than just there to be a rubber stamp for senior management. It must exercise independent judgment, action, and oversight. Further, it is the Board’s role to ask hard, difficult, and probing questions to ensure management is doing its job and has considered other risk possibilities.

Three Key Takeaways:

  1. Boards should force management to open up the company to itself.
  2. Boards should be a grain of sand in the shoe of management.
  3. Boards should ensure senior management is aware of and planning for known and unknown risks.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 714 One Month to a More Effective Compliance Program with Boards-Board Oversight Role over Internal Controls Best practices compliance program. The first in Hallmark No. 1 states, “Within a business organization, compliance begins with the board of directors and senior executives setting the proper tone for the rest of the company.” The second is found under Hallmark No. 3, entitled “Oversight, Autonomy and Resources,” which says the Chief Compliance Officer (CCO) should have “direct access to an organization’s governing authority, such as the board of directors and committees of the board of directors (e.g., the audit committee).” Further, under the US Sentencing Guidelines, the Board must exercise reasonable oversight of the effectiveness of a company’s compliance program. The DOJ Prosecution Standards posed the following queries: (1) Do the Directors exercise independent review of a company’s compliance program? and (2) Are Directors provided sufficient information to enable independent judgment? Further, if a company’s business plan includes a high-risk proposition, there should be additional oversight. In other words, there is an affirmative duty to ask tough questions. But it is more than simply having a compliance program in place. The Board must exercise appropriate oversight of the compliance program and the compliance function. The Board must ask hard questions and be fully informed of the company’s overall compliance strategy. Lawyers often speak to and advise Boards on their legal obligations and duties. If a Board’s oversight is part of effective financial controls under Sarbanes Oxley (SOX), that includes effective compliance controls. Failure to do either may result in something far worse than bad governance. It may directly lead to an FCPA violation and could even form the basis of an independent FCPA violation. A company must have a corporate compliance program in place and actively oversee that function. A failure to perform these functions may lead to independent liability of a Board for its failure to perform its allotted tasks in an effective compliance program. Internal controls work together with compliance policies and procedures and are interrelated control mechanisms. There are five general compliance internal controls for a Board or Board subcommittee role for compliance: Three Key Takeaways: GTE compliance internal controls are low-hanging fruit. Pick them. Compliance with internal controls can be both detected and prevented controls. Good compliance with internal controls is good for business. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 14 Jun 2023 04:00:00 -0000 Board Oversight Role over Internal Controls bonus 8 Thomas Fox What is the Board role of oversight over internal controls? Find out in today's episode of 31 Days. Best practices compliance program. The first in Hallmark No. 1 states, “Within a business organization, compliance begins with the board of directors and senior executives setting the proper tone for the rest of the company.” The second is found under Hallmark No. 3, entitled “Oversight, Autonomy and Resources,” which says the Chief Compliance Officer (CCO) should have “direct access to an organization’s governing authority, such as the board of directors and committees of the board of directors (e.g., the audit committee).” Further, under the US Sentencing Guidelines, the Board must exercise reasonable oversight of the effectiveness of a company’s compliance program. The DOJ Prosecution Standards posed the following queries: (1) Do the Directors exercise independent review of a company’s compliance program? and (2) Are Directors provided sufficient information to enable independent judgment? Further, if a company’s business plan includes a high-risk proposition, there should be additional oversight. In other words, there is an affirmative duty to ask tough questions. But it is more than simply having a compliance program in place. The Board must exercise appropriate oversight of the compliance program and the compliance function. The Board must ask hard questions and be fully informed of the company’s overall compliance strategy. Lawyers often speak to and advise Boards on their legal obligations and duties. If a Board’s oversight is part of effective financial controls under Sarbanes Oxley (SOX), that includes effective compliance controls. Failure to do either may result in something far worse than bad governance. It may directly lead to an FCPA violation and could even form the basis of an independent FCPA violation. A company must have a corporate compliance program in place and actively oversee that function. A failure to perform these functions may lead to independent liability of a Board for its failure to perform its allotted tasks in an effective compliance program. Internal controls work together with compliance policies and procedures and are interrelated control mechanisms. There are five general compliance internal controls for a Board or Board subcommittee role for compliance: Three Key Takeaways: GTE compliance internal controls are low-hanging fruit. Pick them. Compliance with internal controls can be both detected and prevented controls. Good compliance with internal controls is good for business. Learn more about your ad choices. Visit megaphone.fm/adchoices Best practices compliance program. The first in Hallmark No. 1 states, “Within a business organization, compliance begins with the board of directors and senior executives setting the proper tone for the rest of the company.” The second is found under Hallmark No. 3, entitled “Oversight, Autonomy and Resources,” which says the Chief Compliance Officer (CCO) should have “direct access to an organization’s governing authority, such as the board of directors and committees of the board of directors (e.g., the audit committee).” Further, under the US Sentencing Guidelines, the Board must exercise reasonable oversight of the effectiveness of a company’s compliance program. The DOJ Prosecution Standards posed the following queries: (1) Do the Directors exercise independent review of a company’s compliance program? and (2) Are Directors provided sufficient information to enable independent judgment?

Further, if a company’s business plan includes a high-risk proposition, there should be additional oversight. In other words, there is an affirmative duty to ask tough questions. But it is more than simply having a compliance program in place. The Board must exercise appropriate oversight of the compliance program and the compliance function. The Board must ask hard questions and be fully informed of the company’s overall compliance strategy. Lawyers often speak to and advise Boards on their legal obligations and duties. If a Board’s oversight is part of effective financial controls under Sarbanes Oxley (SOX), that includes effective compliance controls. Failure to do either may result in something far worse than bad governance. It may directly lead to an FCPA violation and could even form the basis of an independent FCPA violation. A company must have a corporate compliance program in place and actively oversee that function. A failure to perform these functions may lead to independent liability of a Board for its failure to perform its allotted tasks in an effective compliance program. Internal controls work together with compliance policies and procedures and are interrelated control mechanisms. There are five general compliance internal controls for a Board or Board subcommittee role for compliance:

Three Key Takeaways:

  1. GTE compliance internal controls are low-hanging fruit. Pick them.
  2. Compliance with internal controls can be both detected and prevented controls.
  3. Good compliance with internal controls is good for business.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 666 no One Month to a More Effective Compliance Program with Boards - the Board as an Internal Control James Doty, former Commissioner of the Public Company Accounting Oversight Board (PCAOB) was once asked if the Board or its sub-committee which handles audits was a part of a company’s internal financial controls. He answered that yes, he believed that was one of the roles of an Audit Committee or full Board. I had never thought of the Board as an internal control but the more I thought about it, the more I realized it was an important insight for any Chief Compliance Officer or compliance practitioner as it also applies to compliance internal control. In the FCPA Resource Guide, 2nd edition, in the Hallmarks of an Effective Compliance Program, there are two specific references to the obligations of a Board. The first is in Hallmark No. 1, which states, “Within a business organization, compliance begins with the board of directors and senior executives setting the proper tone for the rest of the company.” The second is found under Hallmark No. 3, entitled “Oversight, Autonomy and Resources”, where it discusses that the CCO should have “direct access to an organization’s governing authority, such as the board of directors and committees of the board of directors (e.g., the audit committee).” Further, under the US Sentencing Guidelines, the Board must exercise reasonable oversight of the effectiveness of a company’s compliance program. The Department of Justice’s (DOJ) Prosecution Standards posed the following queries: (1) Do the Directors exercise independent review of a company’s compliance program? and (2) Are Directors provided information sufficient to enable the exercise of independent judgment? Doty’s remarks drove home to me the absolute requirement for Board participation in any best practices or even effective anti-corruption compliance program. A Board’s oversight is part of effective compliance controls, then the failure to do so may result in something far worse than bad governance. Such inattention could directly lead to a FCPA violation and could even form the basis of an independent SOX violation as to the Board. Three Key Takeaways A Board must engage in active oversight. A Board should review the design of internal controls on a regular basis. Failure to do so could form the basis for an independent legal violation under SOX. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 13 Jun 2023 04:00:00 -0000 Board as an Internal Control full Thomas Fox Today, we consider the Board as an Internal Control. James Doty, former Commissioner of the Public Company Accounting Oversight Board (PCAOB) was once asked if the Board or its sub-committee which handles audits was a part of a company’s internal financial controls. He answered that yes, he believed that was one of the roles of an Audit Committee or full Board. I had never thought of the Board as an internal control but the more I thought about it, the more I realized it was an important insight for any Chief Compliance Officer or compliance practitioner as it also applies to compliance internal control. In the FCPA Resource Guide, 2nd edition, in the Hallmarks of an Effective Compliance Program, there are two specific references to the obligations of a Board. The first is in Hallmark No. 1, which states, “Within a business organization, compliance begins with the board of directors and senior executives setting the proper tone for the rest of the company.” The second is found under Hallmark No. 3, entitled “Oversight, Autonomy and Resources”, where it discusses that the CCO should have “direct access to an organization’s governing authority, such as the board of directors and committees of the board of directors (e.g., the audit committee).” Further, under the US Sentencing Guidelines, the Board must exercise reasonable oversight of the effectiveness of a company’s compliance program. The Department of Justice’s (DOJ) Prosecution Standards posed the following queries: (1) Do the Directors exercise independent review of a company’s compliance program? and (2) Are Directors provided information sufficient to enable the exercise of independent judgment? Doty’s remarks drove home to me the absolute requirement for Board participation in any best practices or even effective anti-corruption compliance program. A Board’s oversight is part of effective compliance controls, then the failure to do so may result in something far worse than bad governance. Such inattention could directly lead to a FCPA violation and could even form the basis of an independent SOX violation as to the Board. Three Key Takeaways A Board must engage in active oversight. A Board should review the design of internal controls on a regular basis. Failure to do so could form the basis for an independent legal violation under SOX. Learn more about your ad choices. Visit megaphone.fm/adchoices James Doty, former Commissioner of the Public Company Accounting Oversight Board (PCAOB) was once asked if the Board or its sub-committee which handles audits was a part of a company’s internal financial controls. He answered that yes, he believed that was one of the roles of an Audit Committee or full Board. I had never thought of the Board as an internal control but the more I thought about it, the more I realized it was an important insight for any Chief Compliance Officer or compliance practitioner as it also applies to compliance internal control.

In the FCPA Resource Guide, 2nd edition, in the Hallmarks of an Effective Compliance Program, there are two specific references to the obligations of a Board. The first is in Hallmark No. 1, which states, “Within a business organization, compliance begins with the board of directors and senior executives setting the proper tone for the rest of the company.” The second is found under Hallmark No. 3, entitled “Oversight, Autonomy and Resources”, where it discusses that the CCO should have “direct access to an organization’s governing authority, such as the board of directors and committees of the board of directors (e.g., the audit committee).” Further, under the US Sentencing Guidelines, the Board must exercise reasonable oversight of the effectiveness of a company’s compliance program. The Department of Justice’s (DOJ) Prosecution Standards posed the following queries: (1) Do the Directors exercise independent review of a company’s compliance program? and (2) Are Directors provided information sufficient to enable the exercise of independent judgment? Doty’s remarks drove home to me the absolute requirement for Board participation in any best practices or even effective anti-corruption compliance program.

A Board’s oversight is part of effective compliance controls, then the failure to do so may result in something far worse than bad governance. Such inattention could directly lead to a FCPA violation and could even form the basis of an independent SOX violation as to the Board.

Three Key Takeaways

  1. A Board must engage in active oversight.
  2. A Board should review the design of internal controls on a regular basis.
  3. Failure to do so could form the basis for an independent legal violation under SOX.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 615 One Month to a More Effective Compliance Program with Boards - Boards Inquiring Up and Down Where does “tone at the top” start? It is with public and most private U.S. companies at the Board of Directors. But what is the role of a company’s Board in compliance? First, a Board should not engage in management but oversee a CEO and senior management. The Board asks hard questions, risk assessment, and identification. These factors can be easily adapted to compliance and ethics risk management oversight. Initially, it must be necessary that the Board receive direct access to such information on a company’s policies on this issue. The Board must have quarterly or semi-annual reports from a company’s CCO to either the Audit Committee or the Compliance Committee. Every Board should create a Compliance Committee to deal with compliance issues, as an Audit Committee may more appropriately deal with financial audit issues. A Board Compliance Committee can devote itself exclusively to non-financial compliance. The Board’s oversight role should be to receive regular reports on the company’s compliance program’s structure, actions, and self-evaluations. From this information, the Board can oversee any modifications to managing FCPA risk that should be implemented. Three key takeaways: A Board Compliance Committee should provide oversight, not management. A CCO should use multiple reports to communicate with the Board Compliance Committee. Board Compliance Committee oversight makes companies more efficient and profitable. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 12 Jun 2023 04:00:00 -0000 Inquiring Up and Down bonus 6 Thomas Fox Today we consider the role of the BOD in asking tough questions. Where does “tone at the top” start? It is with public and most private U.S. companies at the Board of Directors. But what is the role of a company’s Board in compliance? First, a Board should not engage in management but oversee a CEO and senior management. The Board asks hard questions, risk assessment, and identification. These factors can be easily adapted to compliance and ethics risk management oversight. Initially, it must be necessary that the Board receive direct access to such information on a company’s policies on this issue. The Board must have quarterly or semi-annual reports from a company’s CCO to either the Audit Committee or the Compliance Committee. Every Board should create a Compliance Committee to deal with compliance issues, as an Audit Committee may more appropriately deal with financial audit issues. A Board Compliance Committee can devote itself exclusively to non-financial compliance. The Board’s oversight role should be to receive regular reports on the company’s compliance program’s structure, actions, and self-evaluations. From this information, the Board can oversee any modifications to managing FCPA risk that should be implemented. Three key takeaways: A Board Compliance Committee should provide oversight, not management. A CCO should use multiple reports to communicate with the Board Compliance Committee. Board Compliance Committee oversight makes companies more efficient and profitable. Learn more about your ad choices. Visit megaphone.fm/adchoices Where does “tone at the top” start? It is with public and most private U.S. companies at the Board of Directors. But what is the role of a company’s Board in compliance? First, a Board should not engage in management but oversee a CEO and senior management. The Board asks hard questions, risk assessment, and identification.

These factors can be easily adapted to compliance and ethics risk management oversight. Initially, it must be necessary that the Board receive direct access to such information on a company’s policies on this issue. The Board must have quarterly or semi-annual reports from a company’s CCO to either the Audit Committee or the Compliance Committee. Every Board should create a Compliance Committee to deal with compliance issues, as an Audit Committee may more appropriately deal with financial audit issues. A Board Compliance Committee can devote itself exclusively to non-financial compliance. The Board’s oversight role should be to receive regular reports on the company’s compliance program’s structure, actions, and self-evaluations. From this information, the Board can oversee any modifications to managing FCPA risk that should be implemented.

Three key takeaways:

  1. A Board Compliance Committee should provide oversight, not management.
  2. A CCO should use multiple reports to communicate with the Board Compliance Committee.
  3. Board Compliance Committee oversight makes companies more efficient and profitable.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 470 no One Month to a More Effective Compliance Program with Boards- OIG Guidance for Boards Regarding Compliance The OIG white paper “Practical Guidance for Health Care Governing Boards on Compliance Oversight” (OIG Guidance), provides an excellent road map for thinking about how to structure a Compliance Committee for your Board and a Board’s obligations. As an introduction, the OIG Guidance states that a Board must act in good faith around its obligations regarding compliance. This means that there must be both a corporation information and reporting system and that such reporting mechanisms provide appropriate information to a Board. It states: The existence of a corporate reporting system is a key compliance program element, which not only keeps the Board informed of the activities of the organization but also enables an organization to evaluate and respond to issues of potentially illegal or otherwise inappropriate activity. The OIG Guidance sets out four areas of Board oversight and review of a compliance function: Roles of, and relationships between, the organization’s audit, compliance, and legal departments; Mechanism and process for issue-reporting within an organization; Approach to identifying regulatory risk; and Methods of encouraging enterprise-wide accountability for the achievement of compliance goals and objectives. The OIG Guidance is an excellent review for not only compliance professionals and others in the healthcare industry but a good primer for Boards around their duties under a best practices compliance program. The U.S. Sentencing Guidelines, the Hallmarks of an Effective Compliance Program, the OIG Guidance, and OIG Corporate Integrity Agreements can be used as baseline assessment tools for Boards and management in determining what specific functions may be necessary to meet the requirements of an effective compliance program. Three key takeaways: Information flow up to the Board is critical. Compliance should be institutionalized in your company as a way of life. A Board needs to consider all risks. For more information check out The Compliance Handbook, 3rd edition, available from LexisNexis here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 09 Jun 2023 04:00:00 -0000 OIG Guidance for Boards Regarding Compliance full Thomas Fox Today we consider the OIG Guidance for Boards regarding compliance. The OIG white paper “Practical Guidance for Health Care Governing Boards on Compliance Oversight” (OIG Guidance), provides an excellent road map for thinking about how to structure a Compliance Committee for your Board and a Board’s obligations. As an introduction, the OIG Guidance states that a Board must act in good faith around its obligations regarding compliance. This means that there must be both a corporation information and reporting system and that such reporting mechanisms provide appropriate information to a Board. It states: The existence of a corporate reporting system is a key compliance program element, which not only keeps the Board informed of the activities of the organization but also enables an organization to evaluate and respond to issues of potentially illegal or otherwise inappropriate activity. The OIG Guidance sets out four areas of Board oversight and review of a compliance function: Roles of, and relationships between, the organization’s audit, compliance, and legal departments; Mechanism and process for issue-reporting within an organization; Approach to identifying regulatory risk; and Methods of encouraging enterprise-wide accountability for the achievement of compliance goals and objectives. The OIG Guidance is an excellent review for not only compliance professionals and others in the healthcare industry but a good primer for Boards around their duties under a best practices compliance program. The U.S. Sentencing Guidelines, the Hallmarks of an Effective Compliance Program, the OIG Guidance, and OIG Corporate Integrity Agreements can be used as baseline assessment tools for Boards and management in determining what specific functions may be necessary to meet the requirements of an effective compliance program. Three key takeaways: Information flow up to the Board is critical. Compliance should be institutionalized in your company as a way of life. A Board needs to consider all risks. For more information check out The Compliance Handbook, 3rd edition, available from LexisNexis here. Learn more about your ad choices. Visit megaphone.fm/adchoices The OIG white paper “Practical Guidance for Health Care Governing Boards on Compliance Oversight” (OIG Guidance), provides an excellent road map for thinking about how to structure a Compliance Committee for your Board and a Board’s obligations. As an introduction, the OIG Guidance states that a Board must act in good faith around its obligations regarding compliance. This means that there must be both a corporation information and reporting system and that such reporting mechanisms provide appropriate information to a Board. It states: The existence of a corporate reporting system is a key compliance program element, which not only keeps the Board informed of the activities of the organization but also enables an organization to evaluate and respond to issues of potentially illegal or otherwise inappropriate activity.

The OIG Guidance sets out four areas of Board oversight and review of a compliance function:

  1. Roles of, and relationships between, the organization’s audit, compliance, and legal departments;
  2. Mechanism and process for issue-reporting within an organization;
  3. Approach to identifying regulatory risk; and
  4. Methods of encouraging enterprise-wide accountability for the achievement of compliance goals and objectives.

The OIG Guidance is an excellent review for not only compliance professionals and others in the healthcare industry but a good primer for Boards around their duties under a best practices compliance program. The U.S. Sentencing Guidelines, the Hallmarks of an Effective Compliance Program, the OIG Guidance, and OIG Corporate Integrity Agreements can be used as baseline assessment tools for Boards and management in determining what specific functions may be necessary to meet the requirements of an effective compliance program.

Three key takeaways:

  1. Information flow up to the Board is critical.
  2. Compliance should be institutionalized in your company as a way of life.
  3. A Board needs to consider all risks.

For more information check out The Compliance Handbook, 3rd edition, available from LexisNexis here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 686 no One Month to a More Effective Compliance Program with Boards- Compliance Expertise on the Board Every Board of Directors needs a true compliance expert sitting at the table. Almost every Board has a former CFO, former head of Internal Audit, or persons with a similar background, and often these are also the Audit Committee members of the Board. Such a background brings a level of sophistication, training, and SME that can help all companies with their financial reporting and other finance-based issues. So why is there, not such compliance SME at the Board level? This requirement was set out in 2017 in the FCPA Corporate Enforcement Policy, where one of the criteria to be evaluated in a compliance program is “the availability of compliance expertise to the board.” Finally, the 2020 Update to the Evaluation of Corporate Compliance Programs, under the section entitled Oversight, posed the following questions What compliance expertise has been available on the Board of Directors? The DOJ and Securities and Exchange Commission introduced this concept to the FCPA Resource Guide, 2nd edition. It means that when your company is evaluated by the DOJ, under the factors set out in the 2020 Update and the FCPA Corporate Enforcement Policy, to retrospectively determine if your company had a best practices compliance program in place at the time of any violation, you need to have not only the structure of the Board-level Compliance Committee but also the specific SME on the Board and on that committee. Three key takeaways: Boards must have compliance expertise. Government regulators and shareholder groups have both called for greater compliance expertise on the Board. Compliance expertise at the Board works up and down as such expertise can be a resource to both the CCO and Compliance Department. For more information check out The Compliance Handbook, 3rd edition, available from LexisNexis here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 08 Jun 2023 04:00:00 -0000 Compliance Expertise on the Board full Thomas Fox Today we consider the need for compliance expertise at the Board level. Every Board of Directors needs a true compliance expert sitting at the table. Almost every Board has a former CFO, former head of Internal Audit, or persons with a similar background, and often these are also the Audit Committee members of the Board. Such a background brings a level of sophistication, training, and SME that can help all companies with their financial reporting and other finance-based issues. So why is there, not such compliance SME at the Board level? This requirement was set out in 2017 in the FCPA Corporate Enforcement Policy, where one of the criteria to be evaluated in a compliance program is “the availability of compliance expertise to the board.” Finally, the 2020 Update to the Evaluation of Corporate Compliance Programs, under the section entitled Oversight, posed the following questions What compliance expertise has been available on the Board of Directors? The DOJ and Securities and Exchange Commission introduced this concept to the FCPA Resource Guide, 2nd edition. It means that when your company is evaluated by the DOJ, under the factors set out in the 2020 Update and the FCPA Corporate Enforcement Policy, to retrospectively determine if your company had a best practices compliance program in place at the time of any violation, you need to have not only the structure of the Board-level Compliance Committee but also the specific SME on the Board and on that committee. Three key takeaways: Boards must have compliance expertise. Government regulators and shareholder groups have both called for greater compliance expertise on the Board. Compliance expertise at the Board works up and down as such expertise can be a resource to both the CCO and Compliance Department. For more information check out The Compliance Handbook, 3rd edition, available from LexisNexis here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Every Board of Directors needs a true compliance expert sitting at the table. Almost every Board has a former CFO, former head of Internal Audit, or persons with a similar background, and often these are also the Audit Committee members of the Board. Such a background brings a level of sophistication, training, and SME that can help all companies with their financial reporting and other finance-based issues. So why is there, not such compliance SME at the Board level?

This requirement was set out in 2017 in the FCPA Corporate Enforcement Policy, where one of the criteria to be evaluated in a compliance program is “the availability of compliance expertise to the board.” Finally, the 2020 Update to the Evaluation of Corporate Compliance Programs, under the section entitled Oversight, posed the following questions What compliance expertise has been available on the Board of Directors?

The DOJ and Securities and Exchange Commission introduced this concept to the FCPA Resource Guide, 2nd edition. It means that when your company is evaluated by the DOJ, under the factors set out in the 2020 Update and the FCPA Corporate Enforcement Policy, to retrospectively determine if your company had a best practices compliance program in place at the time of any violation, you need to have not only the structure of the Board-level Compliance Committee but also the specific SME on the Board and on that committee.

Three key takeaways:

  1. Boards must have compliance expertise.
  2. Government regulators and shareholder groups have both called for greater compliance expertise on the Board.
  3. Compliance expertise at the Board works up and down as such expertise can be a resource to both the CCO and Compliance Department.

For more information check out The Compliance Handbook, 3rd edition, available from LexisNexis here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 666 no One Month to a More Effective Compliance Program with Boards-the Board Compliance Committee Under the U.S. Sentencing Guidelines, the Board must exercise reasonable oversight on the effectiveness of a company’s compliance program. The DOJ Prosecution Standards posed the following queries: 1) Do the directors exercise independent review of a company’s compliance program? and 2) Are directors provided information sufficient to enable the exercise of independent judgment? Moreover, the FCPA Resource Guide, 2nd edition required a CCO to have direct access to the Board or an appropriate sub-committee and requires a tangible commitment from the top levels of an organization, starting with the Board of Directors, that the company creates an ethical culture. This requirement was brought forward in 2017 in the FCPA Corporate Enforcement Policy. Finally, nn the 2020 Update to the Evaluation of Corporate Compliance Programs, under the section entitled Oversight, it posed the following questions What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions? Today’s regulatory climate and hyper-transparency in social media make a Board Compliance Committee’s task seem Herculean. But more than simply the regulatory climate, shareholders are taking a much more active role in asserting their rights against Boards of Directors. It is incumbent that Boards seek out and obtain sufficient information to fulfill their legal obligations and keep their company off the front page of the New York Times, Wall Street Journal or Financial Times, just to name a few, to prevent serious reputational damage. A Board Compliance Committee is a good place to start. Three key takeaways: The Board Compliance Committee exists to provide oversight and assist the CCO, not to substitute its judgment for that of the CCO. The Board Compliance Committee should work to hold the CCO accountable to hit appropriate metrics. The Board Compliance Committee is ideal for leading the efforts around strategic planning. For more information check out The Compliance Handbook, 3rd edition, available from LexisNexis here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 07 Jun 2023 04:00:00 -0000 The Board Compliance Committee full Thomas Fox Today we consider the Board Compliance Committee. Under the U.S. Sentencing Guidelines, the Board must exercise reasonable oversight on the effectiveness of a company’s compliance program. The DOJ Prosecution Standards posed the following queries: 1) Do the directors exercise independent review of a company’s compliance program? and 2) Are directors provided information sufficient to enable the exercise of independent judgment? Moreover, the FCPA Resource Guide, 2nd edition required a CCO to have direct access to the Board or an appropriate sub-committee and requires a tangible commitment from the top levels of an organization, starting with the Board of Directors, that the company creates an ethical culture. This requirement was brought forward in 2017 in the FCPA Corporate Enforcement Policy. Finally, nn the 2020 Update to the Evaluation of Corporate Compliance Programs, under the section entitled Oversight, it posed the following questions What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions? Today’s regulatory climate and hyper-transparency in social media make a Board Compliance Committee’s task seem Herculean. But more than simply the regulatory climate, shareholders are taking a much more active role in asserting their rights against Boards of Directors. It is incumbent that Boards seek out and obtain sufficient information to fulfill their legal obligations and keep their company off the front page of the New York Times, Wall Street Journal or Financial Times, just to name a few, to prevent serious reputational damage. A Board Compliance Committee is a good place to start. Three key takeaways: The Board Compliance Committee exists to provide oversight and assist the CCO, not to substitute its judgment for that of the CCO. The Board Compliance Committee should work to hold the CCO accountable to hit appropriate metrics. The Board Compliance Committee is ideal for leading the efforts around strategic planning. For more information check out The Compliance Handbook, 3rd edition, available from LexisNexis here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Under the U.S. Sentencing Guidelines, the Board must exercise reasonable oversight on the effectiveness of a company’s compliance program. The DOJ Prosecution Standards posed the following queries: 1) Do the directors exercise independent review of a company’s compliance program? and 2) Are directors provided information sufficient to enable the exercise of independent judgment? Moreover, the FCPA Resource Guide, 2nd edition required a CCO to have direct access to the Board or an appropriate sub-committee and requires a tangible commitment from the top levels of an organization, starting with the Board of Directors, that the company creates an ethical culture.

This requirement was brought forward in 2017 in the FCPA Corporate Enforcement Policy. Finally, nn the 2020 Update to the Evaluation of Corporate Compliance Programs, under the section entitled Oversight, it posed the following questions What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions?

Today’s regulatory climate and hyper-transparency in social media make a Board Compliance Committee’s task seem Herculean. But more than simply the regulatory climate, shareholders are taking a much more active role in asserting their rights against Boards of Directors. It is incumbent that Boards seek out and obtain sufficient information to fulfill their legal obligations and keep their company off the front page of the New York Times, Wall Street Journal or Financial Times, just to name a few, to prevent serious reputational damage. A Board Compliance Committee is a good place to start.

Three key takeaways:

  1. The Board Compliance Committee exists to provide oversight and assist the CCO, not to substitute its judgment for that of the CCO.
  2. The Board Compliance Committee should work to hold the CCO accountable to hit appropriate metrics.
  3. The Board Compliance Committee is ideal for leading the efforts around strategic planning.


For more information check out The Compliance Handbook, 3rd edition, available from LexisNexis here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 638 no One Month to a More Effective Compliance Program with Boards - Prudent Discharge of Board Obligations What are the obligations of a Board member regarding the FCPA? Are the obligations of the Compliance Committee under the FCPA at odds with a director’s “prudent discharge of duties to shareholders”? Do the words prudent discharge even appear anywhere in the FCPA? In the case of Stone v. Ritter, the proposition is found that “a duty to attempt in good faith to assure that a corporate information and reporting system, which the board concludes is adequate, exists.” From the case of In re Walt Disney Company Derivative Litigation, she drew the principle that directors should follow the best practices in ethics and compliance. The Board has the role of monitoring the performance of the compliance function, including monitoring the performance of it using customary economic metrics and overseeing compliance with applicable laws and regulations. While the Board is not responsible for auditing or ferreting out compliance problems, it is responsible for determining that the company has an appropriate system of internal controls. The Board should also monitor company policies and practices that address compliance and matters affecting the public perception and reputation of the company. Every company should ensure that it conducts appropriate compliance training for employees and conducts regular compliance assessments. Finally, the Board must take appropriate action if and when it becomes aware of a material problem it believes management is not properly handling. There is no reference to prudent discharge in the FCPA itself. However, a Board member might think more than twice about the prudent discharge of duties to the shareholders as both the DOJ and SEC now might wish to look into a Board’s prudent discharge of duties under the FCPA. Three key takeaways: What is prudent discharge? What is your process for doing compliance at the Board level? A Board must have active rather than passive engagement around compliance. For more information, check out The Compliance Handbook, 3rd edition, available from LexisNexis here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 06 Jun 2023 04:00:00 -0000 Prudent Discharge of Board Obligations full Thomas Fox In this episode, we consider a Board's prudent discharge of its compliance obligations. What are the obligations of a Board member regarding the FCPA? Are the obligations of the Compliance Committee under the FCPA at odds with a director’s “prudent discharge of duties to shareholders”? Do the words prudent discharge even appear anywhere in the FCPA? In the case of Stone v. Ritter, the proposition is found that “a duty to attempt in good faith to assure that a corporate information and reporting system, which the board concludes is adequate, exists.” From the case of In re Walt Disney Company Derivative Litigation, she drew the principle that directors should follow the best practices in ethics and compliance. The Board has the role of monitoring the performance of the compliance function, including monitoring the performance of it using customary economic metrics and overseeing compliance with applicable laws and regulations. While the Board is not responsible for auditing or ferreting out compliance problems, it is responsible for determining that the company has an appropriate system of internal controls. The Board should also monitor company policies and practices that address compliance and matters affecting the public perception and reputation of the company. Every company should ensure that it conducts appropriate compliance training for employees and conducts regular compliance assessments. Finally, the Board must take appropriate action if and when it becomes aware of a material problem it believes management is not properly handling. There is no reference to prudent discharge in the FCPA itself. However, a Board member might think more than twice about the prudent discharge of duties to the shareholders as both the DOJ and SEC now might wish to look into a Board’s prudent discharge of duties under the FCPA. Three key takeaways: What is prudent discharge? What is your process for doing compliance at the Board level? A Board must have active rather than passive engagement around compliance. For more information, check out The Compliance Handbook, 3rd edition, available from LexisNexis here. Learn more about your ad choices. Visit megaphone.fm/adchoices What are the obligations of a Board member regarding the FCPA? Are the obligations of the Compliance Committee under the FCPA at odds with a director’s “prudent discharge of duties to shareholders”? Do the words prudent discharge even appear anywhere in the FCPA? In the case of Stone v. Ritter, the proposition is found that “a duty to attempt in good faith to assure that a corporate information and reporting system, which the board concludes is adequate, exists.” From the case of In re Walt Disney Company Derivative Litigation, she drew the principle that directors should follow the best practices in ethics and compliance. The Board has the role of monitoring the performance of the compliance function, including monitoring the performance of it using customary economic metrics and overseeing compliance with applicable laws and regulations.

While the Board is not responsible for auditing or ferreting out compliance problems, it is responsible for determining that the company has an appropriate system of internal controls. The Board should also monitor company policies and practices that address compliance and matters affecting the public perception and reputation of the company. Every company should ensure that it conducts appropriate compliance training for employees and conducts regular compliance assessments. Finally, the Board must take appropriate action if and when it becomes aware of a material problem it believes management is not properly handling.

There is no reference to prudent discharge in the FCPA itself. However, a Board member might think more than twice about the prudent discharge of duties to the shareholders as both the DOJ and SEC now might wish to look into a Board’s prudent discharge of duties under the FCPA.

Three key takeaways:

  1. What is prudent discharge?
  2. What is your process for doing compliance at the Board level?
  3. A Board must have active rather than passive engagement around compliance.


For more information, check out The Compliance Handbook, 3rd edition, available from LexisNexis here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 651 no One Month to a More Effective Compliance Program with Boards - Legal Requirements of the Board Regarding Compliance As to the specific role of best practices in general compliance and ethics, one can look to Delaware corporate law for guidance. The case of In Re Caremark International Inc., 698 A.2d 959 (Del. S. Ct. 1996) was the first case to hold that a Board’s obligation “includes a duty to attempt in good faith to assure that a corporate information and reporting system, which the board concludes is adequate, exists, and that failure to do so under some circumstances may, in theory at least, render a director liable for losses caused by non-compliance with applicable legal standards.” In the case of Stone v. Ritter, the Supreme Court of Delaware expanded on the Caremark decision by establishing two important principles. First, the Court held that the Caremark standard is the appropriate standard for director duties concerning corporate compliance issues. Second, the Court found that no duty of good faith forms a basis for director liability, independent of the duties of care and loyalty. Rather, Stone v. Ritter 911 A.2d 362 (‎Del. S. Ct. 2006) holds that the question of director liability turns on whether there is a “sustained or systematic failure of the board to exercise oversight—such as an utter failure to attempt to assure a reasonable information and reporting system exists.” The Board has the role of monitoring the performance of the compliance function, including monitoring the performance of it using standard economic metrics and overseeing compliance with applicable laws and regulations. While the Board is not responsible for auditing or ferreting out compliance problems, it is responsible for determining that the company has an appropriate system of internal controls. The Board should also monitor company policies and practices that address compliance and matters affecting the public perception and reputation of the company. Every company should ensure that it conducts appropriate compliance training for employees and conducts regular compliance assessments. Finally, the Board must take appropriate action if and when it becomes aware of a material problem it believes management is not properly handling. The Delaware Supreme Court has expanded this obligation in the cases of Marchand v. Barnhill (the “Blue Bell” case), Clovis Oncology, Hughes, and Boeing. From the Delaware cases, a Board must have a corporate compliance program in place and actively oversee that function. Further, if a company’s business plan includes a high-risk proposition, additional oversight should exist. In other words, there is an affirmative duty to ask tough questions. However, there has been a significant expansion of the Board’s Caremark obligation. Delaware courts will be much more scrutinizing of Caremark claims going forward. The evolution of decisions from Marchand to Boeing shows that a company must have robust compliance and risk management oversight but, more importantly, engage in oversight for the company’s signature risk(s). Boards must do so aggressively, not passively. As Mike Volkov has noted, “At the bottom, the Chancery Court is raising the stakes on board member accountability.”  Three key takeaways: The Delaware courts have led the way with the Caremark and Stone v. Ritter decisions. Boards must have compliance expertise and exercise it. In a series of recent decisions, the Delaware courts are expanding the Caremark obligations, most recently. For more information check out The Compliance Handbook, 3rd edition, available from LexisNexis here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 05 Jun 2023 04:00:00 -0000 Legal Requirements of the Board Regarding Compliance full Thomas Fox We begin a look at the obligations of a Board regarding compliance. As to the specific role of best practices in general compliance and ethics, one can look to Delaware corporate law for guidance. The case of In Re Caremark International Inc., 698 A.2d 959 (Del. S. Ct. 1996) was the first case to hold that a Board’s obligation “includes a duty to attempt in good faith to assure that a corporate information and reporting system, which the board concludes is adequate, exists, and that failure to do so under some circumstances may, in theory at least, render a director liable for losses caused by non-compliance with applicable legal standards.” In the case of Stone v. Ritter, the Supreme Court of Delaware expanded on the Caremark decision by establishing two important principles. First, the Court held that the Caremark standard is the appropriate standard for director duties concerning corporate compliance issues. Second, the Court found that no duty of good faith forms a basis for director liability, independent of the duties of care and loyalty. Rather, Stone v. Ritter 911 A.2d 362 (‎Del. S. Ct. 2006) holds that the question of director liability turns on whether there is a “sustained or systematic failure of the board to exercise oversight—such as an utter failure to attempt to assure a reasonable information and reporting system exists.” The Board has the role of monitoring the performance of the compliance function, including monitoring the performance of it using standard economic metrics and overseeing compliance with applicable laws and regulations. While the Board is not responsible for auditing or ferreting out compliance problems, it is responsible for determining that the company has an appropriate system of internal controls. The Board should also monitor company policies and practices that address compliance and matters affecting the public perception and reputation of the company. Every company should ensure that it conducts appropriate compliance training for employees and conducts regular compliance assessments. Finally, the Board must take appropriate action if and when it becomes aware of a material problem it believes management is not properly handling. The Delaware Supreme Court has expanded this obligation in the cases of Marchand v. Barnhill (the “Blue Bell” case), Clovis Oncology, Hughes, and Boeing. From the Delaware cases, a Board must have a corporate compliance program in place and actively oversee that function. Further, if a company’s business plan includes a high-risk proposition, additional oversight should exist. In other words, there is an affirmative duty to ask tough questions. However, there has been a significant expansion of the Board’s Caremark obligation. Delaware courts will be much more scrutinizing of Caremark claims going forward. The evolution of decisions from Marchand to Boeing shows that a company must have robust compliance and risk management oversight but, more importantly, engage in oversight for the company’s signature risk(s). Boards must do so aggressively, not passively. As Mike Volkov has noted, “At the bottom, the Chancery Court is raising the stakes on board member accountability.”  Three key takeaways: The Delaware courts have led the way with the Caremark and Stone v. Ritter decisions. Boards must have compliance expertise and exercise it. In a series of recent decisions, the Delaware courts are expanding the Caremark obligations, most recently. For more information check out The Compliance Handbook, 3rd edition, available from LexisNexis here.  Learn more about your ad choices. Visit megaphone.fm/adchoices As to the specific role of best practices in general compliance and ethics, one can look to Delaware corporate law for guidance. The case of In Re Caremark International Inc., 698 A.2d 959 (Del. S. Ct. 1996) was the first case to hold that a Board’s obligation “includes a duty to attempt in good faith to assure that a corporate information and reporting system, which the board concludes is adequate, exists, and that failure to do so under some circumstances may, in theory at least, render a director liable for losses caused by non-compliance with applicable legal standards.”

In the case of Stone v. Ritter, the Supreme Court of Delaware expanded on the Caremark decision by establishing two important principles. First, the Court held that the Caremark standard is the appropriate standard for director duties concerning corporate compliance issues. Second, the Court found that no duty of good faith forms a basis for director liability, independent of the duties of care and loyalty. Rather, Stone v. Ritter 911 A.2d 362 (‎Del. S. Ct. 2006) holds that the question of director liability turns on whether there is a “sustained or systematic failure of the board to exercise oversight—such as an utter failure to attempt to assure a reasonable information and reporting system exists.”

The Board has the role of monitoring the performance of the compliance function, including monitoring the performance of it using standard economic metrics and overseeing compliance with applicable laws and regulations. While the Board is not responsible for auditing or ferreting out compliance problems, it is responsible for determining that the company has an appropriate system of internal controls. The Board should also monitor company policies and practices that address compliance and matters affecting the public perception and reputation of the company. Every company should ensure that it conducts appropriate compliance training for employees and conducts regular compliance assessments. Finally, the Board must take appropriate action if and when it becomes aware of a material problem it believes management is not properly handling. The Delaware Supreme Court has expanded this obligation in the cases of Marchand v. Barnhill (the “Blue Bell” case), Clovis Oncology, Hughes, and Boeing.

From the Delaware cases, a Board must have a corporate compliance program in place and actively oversee that function. Further, if a company’s business plan includes a high-risk proposition, additional oversight should exist. In other words, there is an affirmative duty to ask tough questions. However, there has been a significant expansion of the Board’s Caremark obligation. Delaware courts will be much more scrutinizing of Caremark claims going forward. The evolution of decisions from Marchand to Boeing shows that a company must have robust compliance and risk management oversight but, more importantly, engage in oversight for the company’s signature risk(s). Boards must do so aggressively, not passively.

As Mike Volkov has noted, “At the bottom, the Chancery Court is raising the stakes on board member accountability.”


 Three key takeaways:

  1. The Delaware courts have led the way with the Caremark and Stone v. Ritter decisions.
  2. Boards must have compliance expertise and exercise it.
  3. In a series of recent decisions, the Delaware courts are expanding the Caremark obligations, most recently.


For more information check out The Compliance Handbook, 3rd edition, available from LexisNexis here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 655 no One Month to a More Effective Compliance Program in Training and Communications - Compliance Training From the Movies If there is one truism from the practices of law which translates to the practice of compliance, it is that your imagination only limits you. Marc Havener, founder, and CEO of Resonate Pictures, Inc., created a series of video shorts for a consulting company on compliance and ethics. Rather than the traditional legal approach of telling employees about the corporate policy on compliance, they wanted to tell a story about compliance through the art of movie-based storytelling that wove messaging into characters to tell a story. I have urged compliance practitioners to bring more storytelling into their compliance messaging. If you put the employee in the shoes of the person they’re watching, they will remember it because they will see how it applies to their lives. Havener noted that the training experience would last “exponentially longer than if you just go over a written policy or show a PowerPoint.” He called it “expanding your classroom.” The next time they see George Clooney, they’re going to remember the training, the next time they watch that movie that you showed a clip from, they’re going to be reminded of the training, and so it becomes a great drift method of training.” Three key takeaways: Storytelling is another form of communication. Movie clips in compliance training can provide useful touchstones that employees can relate to for compliance lessons. The Morgan Stanley declination gave credit for annual compliance reminders. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 26 May 2023 04:00:00 -0000 Compliance training from the movies full Thomas Fox For our final episode on this month's 31 days to a more effective compliance program, we consider compliance training from the movies. If there is one truism from the practices of law which translates to the practice of compliance, it is that your imagination only limits you. Marc Havener, founder, and CEO of Resonate Pictures, Inc., created a series of video shorts for a consulting company on compliance and ethics. Rather than the traditional legal approach of telling employees about the corporate policy on compliance, they wanted to tell a story about compliance through the art of movie-based storytelling that wove messaging into characters to tell a story. I have urged compliance practitioners to bring more storytelling into their compliance messaging. If you put the employee in the shoes of the person they’re watching, they will remember it because they will see how it applies to their lives. Havener noted that the training experience would last “exponentially longer than if you just go over a written policy or show a PowerPoint.” He called it “expanding your classroom.” The next time they see George Clooney, they’re going to remember the training, the next time they watch that movie that you showed a clip from, they’re going to be reminded of the training, and so it becomes a great drift method of training.” Three key takeaways: Storytelling is another form of communication. Movie clips in compliance training can provide useful touchstones that employees can relate to for compliance lessons. The Morgan Stanley declination gave credit for annual compliance reminders. Learn more about your ad choices. Visit megaphone.fm/adchoices If there is one truism from the practices of law which translates to the practice of compliance, it is that your imagination only limits you. Marc Havener, founder, and CEO of Resonate Pictures, Inc., created a series of video shorts for a consulting company on compliance and ethics. Rather than the traditional legal approach of telling employees about the corporate policy on compliance, they wanted to tell a story about compliance through the art of movie-based storytelling that wove messaging into characters to tell a story.

I have urged compliance practitioners to bring more storytelling into their compliance messaging. If you put the employee in the shoes of the person they’re watching, they will remember it because they will see how it applies to their lives. Havener noted that the training experience would last “exponentially longer than if you just go over a written policy or show a PowerPoint.” He called it “expanding your classroom.” The next time they see George Clooney, they’re going to remember the training, the next time they watch that movie that you showed a clip from, they’re going to be reminded of the training, and so it becomes a great drift method of training.”

Three key takeaways:

  1. Storytelling is another form of communication.
  2. Movie clips in compliance training can provide useful touchstones that employees can relate to for compliance lessons.
  3. The Morgan Stanley declination gave credit for annual compliance reminders.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 451 no One Month to a More Effective Compliance Program in Training and Communications - Measuring Compliance Training Effectiveness Since at least 2017, the DOJ has emphasized the need to determine compliance training effectiveness. In the 2020 Update, it stated under the section entitled “Form/Content/Effectiveness of Training” the following questions, How has the company measured the effectiveness of the training? Have employees been tested on what they have learned? How has the company addressed employees who fail all or a portion of the testing? Has the company evaluated how much the training impacts employee behavior or operations? The DOJ enshrined the importance of determining the effectiveness of your compliance program in its 2020 Evaluation. The 2020 Evaluation demonstrates that the DOJ wants to see evidence of the effectiveness of your compliance program. This is something that many CCOs and compliance professionals still need help to determine. Both the simple guidelines suggested herein, the more robust assessment, and the results provide you with a start to fulfill the precepts set out in the 2020 Evaluation, but you will eventually need to demonstrate the effectiveness of your compliance training in the future. Three key takeaways: You must demonstrate that you have measured the effectiveness of your compliance training. The DOJ is moving into requiring a demonstration of the effectiveness of compliance training. You should be moving towards a model of demonstrating compliance training ROI to validate the full operationalization of your compliance training. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 25 May 2023 04:00:00 -0000 Measuring Compliance Training Effectiveness full Thomas Fox Today we take up Measuring Compliance Training Effectiveness. Since at least 2017, the DOJ has emphasized the need to determine compliance training effectiveness. In the 2020 Update, it stated under the section entitled “Form/Content/Effectiveness of Training” the following questions, How has the company measured the effectiveness of the training? Have employees been tested on what they have learned? How has the company addressed employees who fail all or a portion of the testing? Has the company evaluated how much the training impacts employee behavior or operations? The DOJ enshrined the importance of determining the effectiveness of your compliance program in its 2020 Evaluation. The 2020 Evaluation demonstrates that the DOJ wants to see evidence of the effectiveness of your compliance program. This is something that many CCOs and compliance professionals still need help to determine. Both the simple guidelines suggested herein, the more robust assessment, and the results provide you with a start to fulfill the precepts set out in the 2020 Evaluation, but you will eventually need to demonstrate the effectiveness of your compliance training in the future. Three key takeaways: You must demonstrate that you have measured the effectiveness of your compliance training. The DOJ is moving into requiring a demonstration of the effectiveness of compliance training. You should be moving towards a model of demonstrating compliance training ROI to validate the full operationalization of your compliance training. Learn more about your ad choices. Visit megaphone.fm/adchoices Since at least 2017, the DOJ has emphasized the need to determine compliance training effectiveness. In the 2020 Update, it stated under the section entitled “Form/Content/Effectiveness of Training” the following questions, How has the company measured the effectiveness of the training? Have employees been tested on what they have learned? How has the company addressed employees who fail all or a portion of the testing? Has the company evaluated how much the training impacts employee behavior or operations?

The DOJ enshrined the importance of determining the effectiveness of your compliance program in its 2020 Evaluation. The 2020 Evaluation demonstrates that the DOJ wants to see evidence of the effectiveness of your compliance program. This is something that many CCOs and compliance professionals still need help to determine. Both the simple guidelines suggested herein, the more robust assessment, and the results provide you with a start to fulfill the precepts set out in the 2020 Evaluation, but you will eventually need to demonstrate the effectiveness of your compliance training in the future.

Three key takeaways:

  1. You must demonstrate that you have measured the effectiveness of your compliance training.
  2. The DOJ is moving into requiring a demonstration of the effectiveness of compliance training.
  3. You should be moving towards a model of demonstrating compliance training ROI to validate the full operationalization of your compliance training.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 450 no One Month to a More Effective Compliance Program in Training and Communications - Compliance Training Frequency What should be your organization’s compliance training frequency? How does the amount of training can positively or negatively impact an overall training strategy? Unfortunately, these questions were not answered by the 2020 Update or the 2020 FCPA Resource Guide. Still every company should have a “well-designed compliance program is appropriately tailored training and communications.” Often compliance professionals think that compliance training needs to be conducted very frequently, even if it means repeating the same training courses every year. Compliance training expert Shawn Rogers analogizes compliance training to an automobile’s windshield wiper system in a discussion of how frequently compliance training should be administered. He went on to explain that “it would not make any sense to run your wipers constantly, even when it is not raining. First, it would be extremely annoying to the passengers. And second, eventually it would wear out both the wiper blades and the wiper motor. It would simply be nonsensical.” Requiring overly repetitive training is like running your windshield wipers in clear weather. The learners are going to be annoyed, the training will be viewed as a waste of time and energy and finally your employees will not take training as seriously when it is really needed to address a specific situation as the compliance training will be viewed literally and figuratively as a “check-the-box” exercise.  Three key takeaways:  Have a well-reasoned approach to training frequency. Lengthier more full-bodied training can be given once every three years or so. Shorter more frequent compliance refreshers or reminders can be used to keep the risk top-of-mind. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 24 May 2023 04:00:00 -0000 Compliance Training Frequency full Thomas Fox Today we consider Compliance Training Frequency. What should be your organization’s compliance training frequency? How does the amount of training can positively or negatively impact an overall training strategy? Unfortunately, these questions were not answered by the 2020 Update or the 2020 FCPA Resource Guide. Still every company should have a “well-designed compliance program is appropriately tailored training and communications.” Often compliance professionals think that compliance training needs to be conducted very frequently, even if it means repeating the same training courses every year. Compliance training expert Shawn Rogers analogizes compliance training to an automobile’s windshield wiper system in a discussion of how frequently compliance training should be administered. He went on to explain that “it would not make any sense to run your wipers constantly, even when it is not raining. First, it would be extremely annoying to the passengers. And second, eventually it would wear out both the wiper blades and the wiper motor. It would simply be nonsensical.” Requiring overly repetitive training is like running your windshield wipers in clear weather. The learners are going to be annoyed, the training will be viewed as a waste of time and energy and finally your employees will not take training as seriously when it is really needed to address a specific situation as the compliance training will be viewed literally and figuratively as a “check-the-box” exercise.  Three key takeaways:  Have a well-reasoned approach to training frequency. Lengthier more full-bodied training can be given once every three years or so. Shorter more frequent compliance refreshers or reminders can be used to keep the risk top-of-mind. Learn more about your ad choices. Visit megaphone.fm/adchoices What should be your organization’s compliance training frequency? How does the amount of training can positively or negatively impact an overall training strategy? Unfortunately, these questions were not answered by the 2020 Update or the 2020 FCPA Resource Guide. Still every company should have a “well-designed compliance program is appropriately tailored training and communications.”

Often compliance professionals think that compliance training needs to be conducted very frequently, even if it means repeating the same training courses every year. Compliance training expert Shawn Rogers analogizes compliance training to an automobile’s windshield wiper system in a discussion of how frequently compliance training should be administered. He went on to explain that “it would not make any sense to run your wipers constantly, even when it is not raining. First, it would be extremely annoying to the passengers. And second, eventually it would wear out both the wiper blades and the wiper motor. It would simply be nonsensical.” Requiring overly repetitive training is like running your windshield wipers in clear weather. The learners are going to be annoyed, the training will be viewed as a waste of time and energy and finally your employees will not take training as seriously when it is really needed to address a specific situation as the compliance training will be viewed literally and figuratively as a “check-the-box” exercise.

 Three key takeaways: 

  1. Have a well-reasoned approach to training frequency.
  2. Lengthier more full-bodied training can be given once every three years or so.
  3. Shorter more frequent compliance refreshers or reminders can be used to keep the risk top-of-mind.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 453 no One Month to a More Effective Compliance Program in Training and Communications - Compliance Training Governance Committee One issue that needs to be considered by compliance professionals around compliance training is compliance training governance. Yet a multinational organization subject to the FCPA faces many legal and regulatory risks, and often many of those risks are “owned” by organizations outside the compliance function. How can your organization create a comprehensive compliance training program covering its risk profile? Every multinational organization will have a broad risk portfolio typically owned across the organization. Consider compliance risk, fraud risk, reputational risk, financial accounting risk, and discrimination risk. These are a small sample of risks; many will not be “owned” by the corporate compliance function. This presents a real challenge when creating a comprehensive compliance training program covering a company’s legal, regulatory, compliance, and reputational risks. Well-know compliance training maven Shawn Rogers suggests “establishing a corporate Compliance Training Governance Committee that looks at the company’s overall risk profile and builds a cross-functional and comprehensive multi-year training plan that effectively addresses all of the risks in a company’s risk portfolio.” A Compliance Training Governance Committee will allow your organization to effectively establish a multi-year training plan, help in vendor selection and engage in course creation. Rogers said, “One of the biggest benefits has been its predictability to the compliance training program. Every stakeholder from a risk-owning organization knows exactly when their function will have their course deployed over the three-year calendar. They can plan resources, they have a long lead-time to develop the courses, and during their off-years, they can do communications campaigns and events to keep their risk top-of-mind.” Three key takeaways:  Why your organization should create a Compliance Training Governance Committee. Who should be on the Compliance Training Governance Committee? How should the Compliance Training Governance Committee work going forward? Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 23 May 2023 04:00:00 -0000 Compliance Training Governance Committee full Thomas Fox Today we take up Compliance Training Governance Committee. One issue that needs to be considered by compliance professionals around compliance training is compliance training governance. Yet a multinational organization subject to the FCPA faces many legal and regulatory risks, and often many of those risks are “owned” by organizations outside the compliance function. How can your organization create a comprehensive compliance training program covering its risk profile? Every multinational organization will have a broad risk portfolio typically owned across the organization. Consider compliance risk, fraud risk, reputational risk, financial accounting risk, and discrimination risk. These are a small sample of risks; many will not be “owned” by the corporate compliance function. This presents a real challenge when creating a comprehensive compliance training program covering a company’s legal, regulatory, compliance, and reputational risks. Well-know compliance training maven Shawn Rogers suggests “establishing a corporate Compliance Training Governance Committee that looks at the company’s overall risk profile and builds a cross-functional and comprehensive multi-year training plan that effectively addresses all of the risks in a company’s risk portfolio.” A Compliance Training Governance Committee will allow your organization to effectively establish a multi-year training plan, help in vendor selection and engage in course creation. Rogers said, “One of the biggest benefits has been its predictability to the compliance training program. Every stakeholder from a risk-owning organization knows exactly when their function will have their course deployed over the three-year calendar. They can plan resources, they have a long lead-time to develop the courses, and during their off-years, they can do communications campaigns and events to keep their risk top-of-mind.” Three key takeaways:  Why your organization should create a Compliance Training Governance Committee. Who should be on the Compliance Training Governance Committee? How should the Compliance Training Governance Committee work going forward? Learn more about your ad choices. Visit megaphone.fm/adchoices One issue that needs to be considered by compliance professionals around compliance training is compliance training governance. Yet a multinational organization subject to the FCPA faces many legal and regulatory risks, and often many of those risks are “owned” by organizations outside the compliance function. How can your organization create a comprehensive compliance training program covering its risk profile?

Every multinational organization will have a broad risk portfolio typically owned across the organization. Consider compliance risk, fraud risk, reputational risk, financial accounting risk, and discrimination risk. These are a small sample of risks; many will not be “owned” by the corporate compliance function. This presents a real challenge when creating a comprehensive compliance training program covering a company’s legal, regulatory, compliance, and reputational risks. Well-know compliance training maven Shawn Rogers suggests “establishing a corporate Compliance Training Governance Committee that looks at the company’s overall risk profile and builds a cross-functional and comprehensive multi-year training plan that effectively addresses all of the risks in a company’s risk portfolio.”

A Compliance Training Governance Committee will allow your organization to effectively establish a multi-year training plan, help in vendor selection and engage in course creation. Rogers said, “One of the biggest benefits has been its predictability to the compliance training program. Every stakeholder from a risk-owning organization knows exactly when their function will have their course deployed over the three-year calendar. They can plan resources, they have a long lead-time to develop the courses, and during their off-years, they can do communications campaigns and events to keep their risk top-of-mind.”

Three key takeaways: 

  1. Why your organization should create a Compliance Training Governance Committee.
  2. Who should be on the Compliance Training Governance Committee?
  3. How should the Compliance Training Governance Committee work going forward?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 452 no One Month to a More Effective Compliance Program in Training and Communications - 10 Compliance Training Program Design Objectives Well-know compliance training guru Shawn Rogers has developed ten design objectives for establishing your compliance program training design objectives. It would be best if you considered doing the same for your organization. Your organization may value other objectives. What the government has told us since the original FCPA Resource Guide back in 2012 is that it expects a well throughout the approach. If you consider your design objectives early in the planning phase, it will not only meet this requirement but also become a roadmap for your program implementation easier. Finally, you can pivot more quickly in this new era as new compliance risks emerge. Three key takeaways:  What are your design objectives? They should be dynamic, not static. You should use them as touchpoints going forward. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 22 May 2023 04:00:00 -0000 10 Compliance Training Program Design Objectives full Thomas Fox Today we consider 10 Compliance Training Program Design Objectives. Well-know compliance training guru Shawn Rogers has developed ten design objectives for establishing your compliance program training design objectives. It would be best if you considered doing the same for your organization. Your organization may value other objectives. What the government has told us since the original FCPA Resource Guide back in 2012 is that it expects a well throughout the approach. If you consider your design objectives early in the planning phase, it will not only meet this requirement but also become a roadmap for your program implementation easier. Finally, you can pivot more quickly in this new era as new compliance risks emerge. Three key takeaways:  What are your design objectives? They should be dynamic, not static. You should use them as touchpoints going forward. Learn more about your ad choices. Visit megaphone.fm/adchoices Well-know compliance training guru Shawn Rogers has developed ten design objectives for establishing your compliance program training design objectives. It would be best if you considered doing the same for your organization. Your organization may value other objectives. What the government has told us since the original FCPA Resource Guide back in 2012 is that it expects a well throughout the approach. If you consider your design objectives early in the planning phase, it will not only meet this requirement but also become a roadmap for your program implementation easier. Finally, you can pivot more quickly in this new era as new compliance risks emerge.

Three key takeaways: 

  1. What are your design objectives?
  2. They should be dynamic, not static.
  3. You should use them as touchpoints going forward.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 477 no One Month to a More Effective Compliance Program in Training and Communications - Envisioning Your Compliance Training Program How can you begin to think through a best practices compliance training program? I asked Shawn Rogers, training guru, expert, and maven. Rogers advised that you ‘envision’ what your training would like as a first step. He stated, “A common mistake is jumping right to the question is which courses you want and how to deploy them. However, you must consider several things before building the program.” You should develop some principles on what your compliance training will look like. A key way to start is by reference to the Training and Communications section of the 2023 ECCP, which states, “Prosecutors should assess the steps taken by the company to ensure that policies and procedures have been integrated into the organization, including through periodic training and certification for all directors, officers, relevant employees, and, where appropriate, agents and business partners. Prosecutors should also assess whether the company has relayed information in a manner tailored to the audience’s size, sophistication, or subject matter expertise. Some companies, for instance, give employees practical advice or case studies to address real-life scenarios, and/or guidance on obtaining ethics advice on a case-by-case basis as needs arise.” Some of these principles include the following, What are the Guiding Principles of your compliance training? What are you trying to communicate? Is it a broad set of values you want to speak to every employee about what your organization stands for? As noted in the 2023 ECCP, a company should “examine whether the compliance program is being disseminated to, and understood by, employees in practice to decide whether the compliance program is “truly effective.” Three key takeaways: The 2023 ECCP has a strong emphasis on compliance training. Create a set of Principles for your compliance training programs. You should always use the Guiding Principles of your compliance training program to make decisions. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 19 May 2023 04:00:00 -0000 Envisioning Your Compliance Training Program full Thomas Fox Today, the importance of Envisioning your compliance training program. How can you begin to think through a best practices compliance training program? I asked Shawn Rogers, training guru, expert, and maven. Rogers advised that you ‘envision’ what your training would like as a first step. He stated, “A common mistake is jumping right to the question is which courses you want and how to deploy them. However, you must consider several things before building the program.” You should develop some principles on what your compliance training will look like. A key way to start is by reference to the Training and Communications section of the 2023 ECCP, which states, “Prosecutors should assess the steps taken by the company to ensure that policies and procedures have been integrated into the organization, including through periodic training and certification for all directors, officers, relevant employees, and, where appropriate, agents and business partners. Prosecutors should also assess whether the company has relayed information in a manner tailored to the audience’s size, sophistication, or subject matter expertise. Some companies, for instance, give employees practical advice or case studies to address real-life scenarios, and/or guidance on obtaining ethics advice on a case-by-case basis as needs arise.” Some of these principles include the following, What are the Guiding Principles of your compliance training? What are you trying to communicate? Is it a broad set of values you want to speak to every employee about what your organization stands for? As noted in the 2023 ECCP, a company should “examine whether the compliance program is being disseminated to, and understood by, employees in practice to decide whether the compliance program is “truly effective.” Three key takeaways: The 2023 ECCP has a strong emphasis on compliance training. Create a set of Principles for your compliance training programs. You should always use the Guiding Principles of your compliance training program to make decisions. Learn more about your ad choices. Visit megaphone.fm/adchoices How can you begin to think through a best practices compliance training program? I asked Shawn Rogers, training guru, expert, and maven. Rogers advised that you ‘envision’ what your training would like as a first step. He stated, “A common mistake is jumping right to the question is which courses you want and how to deploy them. However, you must consider several things before building the program.”

You should develop some principles on what your compliance training will look like. A key way to start is by reference to the Training and Communications section of the 2023 ECCP, which states, “Prosecutors should assess the steps taken by the company to ensure that policies and procedures have been integrated into the organization, including through periodic training and certification for all directors, officers, relevant employees, and, where appropriate, agents and business partners. Prosecutors should also assess whether the company has relayed information in a manner tailored to the audience’s size, sophistication, or subject matter expertise.

Some companies, for instance, give employees practical advice or case studies to address real-life scenarios, and/or guidance on obtaining ethics advice on a case-by-case basis as needs arise.” Some of these principles include the following, What are the Guiding Principles of your compliance training? What are you trying to communicate? Is it a broad set of values you want to speak to every employee about what your organization stands for? As noted in the 2023 ECCP, a company should “examine whether the compliance program is being disseminated to, and understood by, employees in practice to decide whether the compliance program is “truly effective.”

Three key takeaways:

  1. The 2023 ECCP has a strong emphasis on compliance training.
  2. Create a set of Principles for your compliance training programs.
  3. You should always use the Guiding Principles of your compliance training program to make decisions.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 448 no One Month to a More Effective Compliance Program in Training and Communications - Twitter and 360-degrees of Communication Even with the Elon Musk defenestration of Twitter, one of the ways that CCOs and compliance practitioners can better use 360 degrees of communication is through this tool. In an MIT Sloan Management Review article entitled “How Twitter Users Can Generate Better Ideas,” authors Salvatore Parise, Eoin Whelan, and Steve Todd found that “employees with a diverse Twitter network – one that exposes them to people and ideas they don’t already know – tend to generate better ideas.” Their research led them to three interesting findings: 1) Employees who used Twitter had better ideas than those who did not do so; 2) There was a link between the amount of diversity in employees’ Twitter networks and the quality of their ideas; and 3) Twitter users who combined idea scouting and idea connecting were the most innovative. Their research certainly confirms the experience of Louis Sapirman during his time as CCO at Dun & Bradstreet. The key concept for the compliance profession is the roles of Idea Scout and Idea Connector. An “idea scout is an employee who looks outside the organization to bring in new ideas. An idea connector is someone who can assimilate external ideas and find opportunities within the organization to implement these new concepts.” It is the ability to identify, assimilate and exploit new compliance ideas, which makes this concept so powerful. However, to improve your compliance innovation, “you need to maintain a diverse network while also developing your assimilation and exploitation skills.” Twitter can be a powerful tool for the compliance practitioner. It is one of the only tools that can work both inbounds for you to obtain information and insight and in an outbound manner, where you can communicate with your compliance customer base and your employees. It would be best if you worked to incorporate one or more of the techniques to help you burn compliance into the DNA fabric of your organization. Three key takeaways: Twitter can be a powerful tool for the compliance practitioner. Data mine Twitter for best practices and see what the regulators may be saying. Curiosity may have killed the cat, but it makes for a far better and more effective compliance practitioner. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 18 May 2023 04:00:00 -0000 Twitter and 360-degrees of Communication full Thomas Fox What is the intersection of Twitter and 360-degrees of communication? Even with the Elon Musk defenestration of Twitter, one of the ways that CCOs and compliance practitioners can better use 360 degrees of communication is through this tool. In an MIT Sloan Management Review article entitled “How Twitter Users Can Generate Better Ideas,” authors Salvatore Parise, Eoin Whelan, and Steve Todd found that “employees with a diverse Twitter network – one that exposes them to people and ideas they don’t already know – tend to generate better ideas.” Their research led them to three interesting findings: 1) Employees who used Twitter had better ideas than those who did not do so; 2) There was a link between the amount of diversity in employees’ Twitter networks and the quality of their ideas; and 3) Twitter users who combined idea scouting and idea connecting were the most innovative. Their research certainly confirms the experience of Louis Sapirman during his time as CCO at Dun & Bradstreet. The key concept for the compliance profession is the roles of Idea Scout and Idea Connector. An “idea scout is an employee who looks outside the organization to bring in new ideas. An idea connector is someone who can assimilate external ideas and find opportunities within the organization to implement these new concepts.” It is the ability to identify, assimilate and exploit new compliance ideas, which makes this concept so powerful. However, to improve your compliance innovation, “you need to maintain a diverse network while also developing your assimilation and exploitation skills.” Twitter can be a powerful tool for the compliance practitioner. It is one of the only tools that can work both inbounds for you to obtain information and insight and in an outbound manner, where you can communicate with your compliance customer base and your employees. It would be best if you worked to incorporate one or more of the techniques to help you burn compliance into the DNA fabric of your organization. Three key takeaways: Twitter can be a powerful tool for the compliance practitioner. Data mine Twitter for best practices and see what the regulators may be saying. Curiosity may have killed the cat, but it makes for a far better and more effective compliance practitioner. Learn more about your ad choices. Visit megaphone.fm/adchoices Even with the Elon Musk defenestration of Twitter, one of the ways that CCOs and compliance practitioners can better use 360 degrees of communication is through this tool. In an MIT Sloan Management Review article entitled “How Twitter Users Can Generate Better Ideas,” authors Salvatore Parise, Eoin Whelan, and Steve Todd found that “employees with a diverse Twitter network – one that exposes them to people and ideas they don’t already know – tend to generate better ideas.” Their research led them to three interesting findings: 1) Employees who used Twitter had better ideas than those who did not do so; 2) There was a link between the amount of diversity in employees’ Twitter networks and the quality of their ideas; and 3) Twitter users who combined idea scouting and idea connecting were the most innovative. Their research certainly confirms the experience of Louis Sapirman during his time as CCO at Dun & Bradstreet.

The key concept for the compliance profession is the roles of Idea Scout and Idea Connector. An “idea scout is an employee who looks outside the organization to bring in new ideas. An idea connector is someone who can assimilate external ideas and find opportunities within the organization to implement these new concepts.” It is the ability to identify, assimilate and exploit new compliance ideas, which makes this concept so powerful. However, to improve your compliance innovation, “you need to maintain a diverse network while also developing your assimilation and exploitation skills.”

Twitter can be a powerful tool for the compliance practitioner. It is one of the only tools that can work both inbounds for you to obtain information and insight and in an outbound manner, where you can communicate with your compliance customer base and your employees. It would be best if you worked to incorporate one or more of the techniques to help you burn compliance into the DNA fabric of your organization.

Three key takeaways:

  1. Twitter can be a powerful tool for the compliance practitioner.
  2. Data mine Twitter for best practices and see what the regulators may be saying.
  3. Curiosity may have killed the cat, but it makes for a far better and more effective compliance practitioner.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 460 no One Month to a More Effective Compliance Program in Training and Communications - Asking Questions Other than the skill of listening, asking questions is about as important to the compliance practitioner as any other that can be employed. Yet, equally critical is to ask the right question, which is an issue explored by Brian Grazer and Charles Fishman in their book entitled “A Curious Mind: The Secret to a Bigger Life.” Grazer is a well-known and successful Hollywood director who has directed such movies as Splash, A Beautiful Mind, and Cinderella Man. He believes that much of his success is because he asks many questions, and “Questions are a great management tool.” This is because “Asking questions elicits information” also “creates the space for people to raise issues they are worried about that a boss, or colleagues, may not know about.” By asking questions, you allow “people to tell a different story than the one you expect.” Finally, and perhaps most significantly, “asking questions means people have to make their case for the way they want a decision to go.” You, too, can use this simple and straightforward technique to improve your leadership qualities in the compliance function. The reason that asking questions is so much better than simply giving orders is that you have a vast talented workforce to tap into to help you do business in compliance. But the how of doing a business process that is, or should be, burned into your company can be facilitated by possibilities that are out there in your employees’ minds. 360 degrees of communication allows you to create an atmosphere where nobody is afraid to ask questions. Perhaps equally importantly, no one is afraid to answer a question. Three key takeaways: Asking questions is a great technique to elicit information. Asking questions creates the authority in people to come up with ideas, coupled with the responsibility for moving things forward. Create an atmosphere where employees are confident to ask or answer a question. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 17 May 2023 04:00:00 -0000 Asking Questions full Thomas Fox Today, we take up the importance of asking questions. Other than the skill of listening, asking questions is about as important to the compliance practitioner as any other that can be employed. Yet, equally critical is to ask the right question, which is an issue explored by Brian Grazer and Charles Fishman in their book entitled “A Curious Mind: The Secret to a Bigger Life.” Grazer is a well-known and successful Hollywood director who has directed such movies as Splash, A Beautiful Mind, and Cinderella Man. He believes that much of his success is because he asks many questions, and “Questions are a great management tool.” This is because “Asking questions elicits information” also “creates the space for people to raise issues they are worried about that a boss, or colleagues, may not know about.” By asking questions, you allow “people to tell a different story than the one you expect.” Finally, and perhaps most significantly, “asking questions means people have to make their case for the way they want a decision to go.” You, too, can use this simple and straightforward technique to improve your leadership qualities in the compliance function. The reason that asking questions is so much better than simply giving orders is that you have a vast talented workforce to tap into to help you do business in compliance. But the how of doing a business process that is, or should be, burned into your company can be facilitated by possibilities that are out there in your employees’ minds. 360 degrees of communication allows you to create an atmosphere where nobody is afraid to ask questions. Perhaps equally importantly, no one is afraid to answer a question. Three key takeaways: Asking questions is a great technique to elicit information. Asking questions creates the authority in people to come up with ideas, coupled with the responsibility for moving things forward. Create an atmosphere where employees are confident to ask or answer a question. Learn more about your ad choices. Visit megaphone.fm/adchoices Other than the skill of listening, asking questions is about as important to the compliance practitioner as any other that can be employed. Yet, equally critical is to ask the right question, which is an issue explored by Brian Grazer and Charles Fishman in their book entitled “A Curious Mind: The Secret to a Bigger Life.”

Grazer is a well-known and successful Hollywood director who has directed such movies as Splash, A Beautiful Mind, and Cinderella Man. He believes that much of his success is because he asks many questions, and “Questions are a great management tool.” This is because “Asking questions elicits information” also “creates the space for people to raise issues they are worried about that a boss, or colleagues, may not know about.” By asking questions, you allow “people to tell a different story than the one you expect.” Finally, and perhaps most significantly, “asking questions means people have to make their case for the way they want a decision to go.”

You, too, can use this simple and straightforward technique to improve your leadership qualities in the compliance function. The reason that asking questions is so much better than simply giving orders is that you have a vast talented workforce to tap into to help you do business in compliance. But the how of doing a business process that is, or should be, burned into your company can be facilitated by possibilities that are out there in your employees’ minds. 360 degrees of communication allows you to create an atmosphere where nobody is afraid to ask questions. Perhaps equally importantly, no one is afraid to answer a question.

Three key takeaways:

  1. Asking questions is a great technique to elicit information.
  2. Asking questions creates the authority in people to come up with ideas, coupled with the responsibility for moving things forward.
  3. Create an atmosphere where employees are confident to ask or answer a question.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 456 no One Month to a More Effective Compliance Program in Training and Communications -Communication Across Cultures A 360-degree approach to communications entails looking at all forms of interactions as a way to interconnect. This means both verbal and non-verbal and in clues and hints. This concept can be particularly helpful in relating to and with cultures outside the U.S. as one of the most critical issues to a compliance function is breaking through a company’s internal cultural boundaries. In a  Harvard Business Review article, entitled “Getting to Si, Ja, Oui, Hai and Da”, Erin Meyer explained that “managers often discover that perfectly rational deals fall apart when their [business] counterparts make what seem to be unreasonable demands or don’t respect their commitments.” She laid out a five-point solution that I have adapted for the CCO or compliance practitioner in communicating a compliance program across a multi-national organization. In its 2020 Update, the DOJ specified that when it comes to compliance training, a company must offer compliance training in the form and language appropriate for the audience. Initially look for as many cultural bridges as you can find as it will help you understand what your international audience is communicating to you, in both verbal and non-verbal formats, during a wide variety of activities familiar to any compliance professional such as training, investigations or simple meetings where the compliance perspective must be articulated in any business setting. If you fail to have an understanding or even a person who can navigate these signs for you, here are five steps to help you out: 1) Adapt the way you express disagreement; 2) Know when to bottle it up and let it all pour out; 3) Learn how the other culture builds trust; 4) Avoid yes or no questions; and 5) Be careful about putting it in writing. Three key takeaways: Communications in compliance must be largely drawn around trust. Look for as many cultural bridges as you can find as it will help you understand what your international audience is communicating to you. One of the things most critical issues to a compliance function is breaking through a company’s internal cultural boundaries. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 16 May 2023 04:00:00 -0000 Communication Across Cultures full Thomas Fox In this episode, we consider communicating across cultural boundaries. A 360-degree approach to communications entails looking at all forms of interactions as a way to interconnect. This means both verbal and non-verbal and in clues and hints. This concept can be particularly helpful in relating to and with cultures outside the U.S. as one of the most critical issues to a compliance function is breaking through a company’s internal cultural boundaries. In a  Harvard Business Review article, entitled “Getting to Si, Ja, Oui, Hai and Da”, Erin Meyer explained that “managers often discover that perfectly rational deals fall apart when their [business] counterparts make what seem to be unreasonable demands or don’t respect their commitments.” She laid out a five-point solution that I have adapted for the CCO or compliance practitioner in communicating a compliance program across a multi-national organization. In its 2020 Update, the DOJ specified that when it comes to compliance training, a company must offer compliance training in the form and language appropriate for the audience. Initially look for as many cultural bridges as you can find as it will help you understand what your international audience is communicating to you, in both verbal and non-verbal formats, during a wide variety of activities familiar to any compliance professional such as training, investigations or simple meetings where the compliance perspective must be articulated in any business setting. If you fail to have an understanding or even a person who can navigate these signs for you, here are five steps to help you out: 1) Adapt the way you express disagreement; 2) Know when to bottle it up and let it all pour out; 3) Learn how the other culture builds trust; 4) Avoid yes or no questions; and 5) Be careful about putting it in writing. Three key takeaways: Communications in compliance must be largely drawn around trust. Look for as many cultural bridges as you can find as it will help you understand what your international audience is communicating to you. One of the things most critical issues to a compliance function is breaking through a company’s internal cultural boundaries. Learn more about your ad choices. Visit megaphone.fm/adchoices A 360-degree approach to communications entails looking at all forms of interactions as a way to interconnect. This means both verbal and non-verbal and in clues and hints. This concept can be particularly helpful in relating to and with cultures outside the U.S. as one of the most critical issues to a compliance function is breaking through a company’s internal cultural boundaries. In a  Harvard Business Review article, entitled “Getting to Si, Ja, Oui, Hai and Da”, Erin Meyer explained that “managers often discover that perfectly rational deals fall apart when their [business] counterparts make what seem to be unreasonable demands or don’t respect their commitments.” She laid out a five-point solution that I have adapted for the CCO or compliance practitioner in communicating a compliance program across a multi-national organization. In its 2020 Update, the DOJ specified that when it comes to compliance training, a company must offer compliance training in the form and language appropriate for the audience.

Initially look for as many cultural bridges as you can find as it will help you understand what your international audience is communicating to you, in both verbal and non-verbal formats, during a wide variety of activities familiar to any compliance professional such as training, investigations or simple meetings where the compliance perspective must be articulated in any business setting. If you fail to have an understanding or even a person who can navigate these signs for you, here are five steps to help you out: 1) Adapt the way you express disagreement; 2) Know when to bottle it up and let it all pour out; 3) Learn how the other culture builds trust; 4) Avoid yes or no questions; and 5) Be careful about putting it in writing.

Three key takeaways:

  1. Communications in compliance must be largely drawn around trust.
  2. Look for as many cultural bridges as you can find as it will help you understand what your international audience is communicating to you.
  3. One of the things most critical issues to a compliance function is breaking through a company’s internal cultural boundaries.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 456 no One Month to a More Effective Compliance Program in Training and Communications - Multiplying the Influence of Compliance What if you could multiply the impact and effectiveness of your compliance program throughout your company? That would be a great boon to any compliance practitioner and compliance program. It is also possible by considering a 360-degree view of communications in compliance using multipliers. Liz Wiseman is the co-author with Greg McKeown of “Multipliers: How the Best Leaders Make Everyone Smarter,” a book about the various types of leaders. They focus on two different types of leaders, Diminishers and Multipliers. Multipliers are leaders who encourage their workers’ growth and creativity, while Diminishers hinder and otherwise keep their employees’ productivity at a minimum. Now imagine applying this leadership technique as you are trying to operationalize your compliance program fully. If you take this approach of leading by asking questions, you not only guide the functional unit but you get greater buy-in to the entire concept and process as it becomes their process. The non-compliance team may design it and have ownership over it. Wiseman concluded by challenging each of us to multiply our influence to make those we work with work even better. You can use these skills to operationalize your compliance program more fully. If you do so, you will not only fulfill the requirements of the DOJ, as laid out in the Evaluation, but you will integrate compliance into the DNA of your company by making it a part of how you conduct your business. Three key takeaways: Multipliers are leaders who encourage growth and creativity from their workers. Diminishers hinder and otherwise keep their employees’ productivity at a minimum. Multiply the influence of the compliance function inside and outside the company in this manner. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 15 May 2023 04:00:00 -0000 Multiplying the Influence of Compliance full Thomas Fox In this episode, how to multiply the influence of compliance. What if you could multiply the impact and effectiveness of your compliance program throughout your company? That would be a great boon to any compliance practitioner and compliance program. It is also possible by considering a 360-degree view of communications in compliance using multipliers. Liz Wiseman is the co-author with Greg McKeown of “Multipliers: How the Best Leaders Make Everyone Smarter,” a book about the various types of leaders. They focus on two different types of leaders, Diminishers and Multipliers. Multipliers are leaders who encourage their workers’ growth and creativity, while Diminishers hinder and otherwise keep their employees’ productivity at a minimum. Now imagine applying this leadership technique as you are trying to operationalize your compliance program fully. If you take this approach of leading by asking questions, you not only guide the functional unit but you get greater buy-in to the entire concept and process as it becomes their process. The non-compliance team may design it and have ownership over it. Wiseman concluded by challenging each of us to multiply our influence to make those we work with work even better. You can use these skills to operationalize your compliance program more fully. If you do so, you will not only fulfill the requirements of the DOJ, as laid out in the Evaluation, but you will integrate compliance into the DNA of your company by making it a part of how you conduct your business. Three key takeaways: Multipliers are leaders who encourage growth and creativity from their workers. Diminishers hinder and otherwise keep their employees’ productivity at a minimum. Multiply the influence of the compliance function inside and outside the company in this manner. Learn more about your ad choices. Visit megaphone.fm/adchoices What if you could multiply the impact and effectiveness of your compliance program throughout your company? That would be a great boon to any compliance practitioner and compliance program. It is also possible by considering a 360-degree view of communications in compliance using multipliers.

Liz Wiseman is the co-author with Greg McKeown of “Multipliers: How the Best Leaders Make Everyone Smarter,” a book about the various types of leaders. They focus on two different types of leaders, Diminishers and Multipliers. Multipliers are leaders who encourage their workers’ growth and creativity, while Diminishers hinder and otherwise keep their employees’ productivity at a minimum.

Now imagine applying this leadership technique as you are trying to operationalize your compliance program fully. If you take this approach of leading by asking questions, you not only guide the functional unit but you get greater buy-in to the entire concept and process as it becomes their process. The non-compliance team may design it and have ownership over it.

Wiseman concluded by challenging each of us to multiply our influence to make those we work with work even better. You can use these skills to operationalize your compliance program more fully. If you do so, you will not only fulfill the requirements of the DOJ, as laid out in the Evaluation, but you will integrate compliance into the DNA of your company by making it a part of how you conduct your business.

Three key takeaways:

  1. Multipliers are leaders who encourage growth and creativity from their workers.
  2. Diminishers hinder and otherwise keep their employees’ productivity at a minimum.
  3. Multiply the influence of the compliance function inside and outside the company in this manner.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 555 no One Month to a More Effective Compliance Program in Training and Communications - Communication through persuasion Such small gestures can make a difference. I recently read a biography of Dale Carnegie by Steven Watts, entitled “Self-Help Messiah: Dale Carnegie and Success in Modern America”, penned by Ian Frazier. Carnegie is of course well known for his seminal work “How to Win Friends and Influence People” first published in 1936. I was somewhat surprised to learn that the text was largely drawn up as transcripts to lectures Carnegie was giving in New York City in the mid-1903s. Carnegie’s main thesis was to provide concrete steps on how ordinary people could help master the art of persuasion. While it has been some time since I read this book, what I recall is that to influence people, one has to listen to them. For me, the book was about how to become a better listener. I cannot say enough about this skill for a CCO. If you hear any long-term CCO speak about their job, they will tell you it is largely about listening to people; whether those people are employees, senior management or the Chief Executive Officer (CEO) and Board members. By listening to others you not only hear, and hopefully will come to understand their concerns, but you allow them to come to decisions themselves and you are not in the position of telling them what to do. It is a skill that has served many CCOs very well for many years. Three key takeaways: A little can mean a lot. One of the primary keys to influencing people is to listen to them. A CCO can enhance their communications by using the six principals of persuasion. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 12 May 2023 04:00:00 -0000 Communication through persuasion full Thomas Fox Today, using persuasion to facilitate communications in compliance. Such small gestures can make a difference. I recently read a biography of Dale Carnegie by Steven Watts, entitled “Self-Help Messiah: Dale Carnegie and Success in Modern America”, penned by Ian Frazier. Carnegie is of course well known for his seminal work “How to Win Friends and Influence People” first published in 1936. I was somewhat surprised to learn that the text was largely drawn up as transcripts to lectures Carnegie was giving in New York City in the mid-1903s. Carnegie’s main thesis was to provide concrete steps on how ordinary people could help master the art of persuasion. While it has been some time since I read this book, what I recall is that to influence people, one has to listen to them. For me, the book was about how to become a better listener. I cannot say enough about this skill for a CCO. If you hear any long-term CCO speak about their job, they will tell you it is largely about listening to people; whether those people are employees, senior management or the Chief Executive Officer (CEO) and Board members. By listening to others you not only hear, and hopefully will come to understand their concerns, but you allow them to come to decisions themselves and you are not in the position of telling them what to do. It is a skill that has served many CCOs very well for many years. Three key takeaways: A little can mean a lot. One of the primary keys to influencing people is to listen to them. A CCO can enhance their communications by using the six principals of persuasion. Learn more about your ad choices. Visit megaphone.fm/adchoices Such small gestures can make a difference. I recently read a biography of Dale Carnegie by Steven Watts, entitled “Self-Help Messiah: Dale Carnegie and Success in Modern America”, penned by Ian Frazier. Carnegie is of course well known for his seminal work “How to Win Friends and Influence People” first published in 1936. I was somewhat surprised to learn that the text was largely drawn up as transcripts to lectures Carnegie was giving in New York City in the mid-1903s. Carnegie’s main thesis was to provide concrete steps on how ordinary people could help master the art of persuasion. While it has been some time since I read this book, what I recall is that to influence people, one has to listen to them. For me, the book was about how to become a better listener.

I cannot say enough about this skill for a CCO. If you hear any long-term CCO speak about their job, they will tell you it is largely about listening to people; whether those people are employees, senior management or the Chief Executive Officer (CEO) and Board members. By listening to others you not only hear, and hopefully will come to understand their concerns, but you allow them to come to decisions themselves and you are not in the position of telling them what to do. It is a skill that has served many CCOs very well for many years.

Three key takeaways:

  1. A little can mean a lot.
  2. One of the primary keys to influencing people is to listen to them.
  3. A CCO can enhance their communications by using the six principals of persuasion.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 463 no One Month to a More Effective Compliance Program in Training and Communications - Using Communications to Foster your Compliance Brand Our next lesson on compliance communications comes from best-selling authors James Patterson and David Baldacci, and it is about your brand. I have always considered your brand the image customers have of your business. It should be strategic and intentional. For a corporate compliance function, it means doing business ethically and in compliance. It could mean creating an effective compliance program that enhances business efficiency that drives greater profitability. It could mean driving an ethical culture to the very heart of your business. However, Patterson and Baldacci discussed brand in a manner that was very different from how I think about brand and branding. They said your brand is not an image but is about your relationship with your stakeholders. For an author, that means your readers. For these writers, it means that you deliver what your readers expect, and if you are going to go in a different direction, it is important to let your readers know that you are doing something different so that if you pick up a Baldacci or a Patterson, the book will be something other than the thriller or murder mystery you are expecting. While there are other groups you may have a relationship with as a compliance professional, looking at this from the perspective of Baldacci and Patterson, you begin to see the corporate compliance brand and your personal brand in a very different light. It can help you be both more effective as a compliance professional and lead to more professional opportunities for you as well. Three key takeaways: How do you define your compliance brand? What is your relationship with your stakeholders? As a CCO or compliance professional, you can draw lessons from various disciplines. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 11 May 2023 04:00:00 -0000 Using communications to foster your compliance brand full Thomas Fox Today, how using communications can foster your compliance brand. Our next lesson on compliance communications comes from best-selling authors James Patterson and David Baldacci, and it is about your brand. I have always considered your brand the image customers have of your business. It should be strategic and intentional. For a corporate compliance function, it means doing business ethically and in compliance. It could mean creating an effective compliance program that enhances business efficiency that drives greater profitability. It could mean driving an ethical culture to the very heart of your business. However, Patterson and Baldacci discussed brand in a manner that was very different from how I think about brand and branding. They said your brand is not an image but is about your relationship with your stakeholders. For an author, that means your readers. For these writers, it means that you deliver what your readers expect, and if you are going to go in a different direction, it is important to let your readers know that you are doing something different so that if you pick up a Baldacci or a Patterson, the book will be something other than the thriller or murder mystery you are expecting. While there are other groups you may have a relationship with as a compliance professional, looking at this from the perspective of Baldacci and Patterson, you begin to see the corporate compliance brand and your personal brand in a very different light. It can help you be both more effective as a compliance professional and lead to more professional opportunities for you as well. Three key takeaways: How do you define your compliance brand? What is your relationship with your stakeholders? As a CCO or compliance professional, you can draw lessons from various disciplines. Learn more about your ad choices. Visit megaphone.fm/adchoices Our next lesson on compliance communications comes from best-selling authors James Patterson and David Baldacci, and it is about your brand. I have always considered your brand the image customers have of your business. It should be strategic and intentional. For a corporate compliance function, it means doing business ethically and in compliance. It could mean creating an effective compliance program that enhances business efficiency that drives greater profitability. It could mean driving an ethical culture to the very heart of your business.

However, Patterson and Baldacci discussed brand in a manner that was very different from how I think about brand and branding. They said your brand is not an image but is about your relationship with your stakeholders. For an author, that means your readers. For these writers, it means that you deliver what your readers expect, and if you are going to go in a different direction, it is important to let your readers know that you are doing something different so that if you pick up a Baldacci or a Patterson, the book will be something other than the thriller or murder mystery you are expecting.

While there are other groups you may have a relationship with as a compliance professional, looking at this from the perspective of Baldacci and Patterson, you begin to see the corporate compliance brand and your personal brand in a very different light. It can help you be both more effective as a compliance professional and lead to more professional opportunities for you as well.

Three key takeaways:

  1. How do you define your compliance brand?
  2. What is your relationship with your stakeholders?
  3. As a CCO or compliance professional, you can draw lessons from various disciplines.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 469 no One Month to a More Effective Compliance Program in Training and Communications- Using Communications to Drive a Speak Up Culture How often have you thought about the role of communications in your entire hotline reporting system? I do not mean posters giving the hotline number, promising anonymity and non-retaliation. I mean using compliance communications to create a social environment where employees feel comfortable speaking up to ask questions and report concerns and they know the options for doing that. Why do many compliance professionals find it so difficult to use compliance communications to help move the ball forward on driving a speak up culture? It begins because many conflate such communications with training. Training tends to be viewed as something that happens once per year or on a similar cadence. Yet even the DOJ has seen through the fallacy of this argument in its 2020 Update to the Evaluation of Corporate Compliance Programs when it stated, “companies have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit, or other risk management functions.” The 2020 Update also leads to the following questions, what resources have been available to employees to provide guidance relating to raising an issue? And, has your company assessed whether its employees know when to seek advice and whether they would be willing to speak up? Can you answer these to satisfaction of the DOJ? If not, you may have a gap in your speak up communications program. The bottom line to all is that in compliance, you are only limited by your imagination. When you overlay creativity on your imagination, you can create something very special. And you can use compliance communications to drive a speak up culture.  Three key takeaways: How can communications improve a speak up culture? Use communications to foster trust. A speak up culture only works when paired with a ‘listen-up’ culture. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 10 May 2023 04:00:00 -0000 Using Communications to Drive a Speak Up Culture full Thomas Fox Today, using Communications to Drive a Speak Up Culture. How often have you thought about the role of communications in your entire hotline reporting system? I do not mean posters giving the hotline number, promising anonymity and non-retaliation. I mean using compliance communications to create a social environment where employees feel comfortable speaking up to ask questions and report concerns and they know the options for doing that. Why do many compliance professionals find it so difficult to use compliance communications to help move the ball forward on driving a speak up culture? It begins because many conflate such communications with training. Training tends to be viewed as something that happens once per year or on a similar cadence. Yet even the DOJ has seen through the fallacy of this argument in its 2020 Update to the Evaluation of Corporate Compliance Programs when it stated, “companies have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit, or other risk management functions.” The 2020 Update also leads to the following questions, what resources have been available to employees to provide guidance relating to raising an issue? And, has your company assessed whether its employees know when to seek advice and whether they would be willing to speak up? Can you answer these to satisfaction of the DOJ? If not, you may have a gap in your speak up communications program. The bottom line to all is that in compliance, you are only limited by your imagination. When you overlay creativity on your imagination, you can create something very special. And you can use compliance communications to drive a speak up culture.  Three key takeaways: How can communications improve a speak up culture? Use communications to foster trust. A speak up culture only works when paired with a ‘listen-up’ culture. Learn more about your ad choices. Visit megaphone.fm/adchoices How often have you thought about the role of communications in your entire hotline reporting system? I do not mean posters giving the hotline number, promising anonymity and non-retaliation. I mean using compliance communications to create a social environment where employees feel comfortable speaking up to ask questions and report concerns and they know the options for doing that.

Why do many compliance professionals find it so difficult to use compliance communications to help move the ball forward on driving a speak up culture? It begins because many conflate such communications with training. Training tends to be viewed as something that happens once per year or on a similar cadence. Yet even the DOJ has seen through the fallacy of this argument in its 2020 Update to the Evaluation of Corporate Compliance Programs when it stated, “companies have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit, or other risk management functions.”

The 2020 Update also leads to the following questions, what resources have been available to employees to provide guidance relating to raising an issue? And, has your company assessed whether its employees know when to seek advice and whether they would be willing to speak up? Can you answer these to satisfaction of the DOJ? If not, you may have a gap in your speak up communications program.

The bottom line to all is that in compliance, you are only limited by your imagination. When you overlay creativity on your imagination, you can create something very special. And you can use compliance communications to drive a speak up culture.

 Three key takeaways:

  1. How can communications improve a speak up culture?
  2. Use communications to foster trust.
  3. A speak up culture only works when paired with a ‘listen-up’ culture.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 456 no One Month to a More Effective Compliance Program in Training and Communications - Using 360 Degree of Compliance to Tell a Story The 360-degree approach to compliance works with all the stakeholders in a compliance program, even the “Document, Document, and Document” stakeholders; i.e., the regulators. By using innovative techniques, one law firm came up with mechanism to present verifiable evidence to regulators, using the basic techniques of social media in operationalizing compliance as a solution to a difficult compliance issue around, of all things, honey. This example shows how creative thinking by a lawyer, in the field of import compliance, led to the development of a software application, using some of the concepts of social media. Once again demonstrating the maxim that compliance practitioners (and lawyers) are only limited by their imagination, the use of this software tool demonstrates the power of what a 360-degree view can bring to your compliance program. Three Key Takeaways Use the tools of social media to help tell your story of compliance. You are only limited by your imagination. Converging text, pictures and data can be a powerful tool in compliance. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 09 May 2023 04:00:00 -0000 Using 360 Degree of Compliance to Tell a Story full Thomas Fox Telling a story in and for compliance. The 360-degree approach to compliance works with all the stakeholders in a compliance program, even the “Document, Document, and Document” stakeholders; i.e., the regulators. By using innovative techniques, one law firm came up with mechanism to present verifiable evidence to regulators, using the basic techniques of social media in operationalizing compliance as a solution to a difficult compliance issue around, of all things, honey. This example shows how creative thinking by a lawyer, in the field of import compliance, led to the development of a software application, using some of the concepts of social media. Once again demonstrating the maxim that compliance practitioners (and lawyers) are only limited by their imagination, the use of this software tool demonstrates the power of what a 360-degree view can bring to your compliance program. Three Key Takeaways Use the tools of social media to help tell your story of compliance. You are only limited by your imagination. Converging text, pictures and data can be a powerful tool in compliance. Learn more about your ad choices. Visit megaphone.fm/adchoices The 360-degree approach to compliance works with all the stakeholders in a compliance program, even the “Document, Document, and Document” stakeholders; i.e., the regulators. By using innovative techniques, one law firm came up with mechanism to present verifiable evidence to regulators, using the basic techniques of social media in operationalizing compliance as a solution to a difficult compliance issue around, of all things, honey. This example shows how creative thinking by a lawyer, in the field of import compliance, led to the development of a software application, using some of the concepts of social media. Once again demonstrating the maxim that compliance practitioners (and lawyers) are only limited by their imagination, the use of this software tool demonstrates the power of what a 360-degree view can bring to your compliance program.

Three Key Takeaways

  1. Use the tools of social media to help tell your story of compliance.
  2. You are only limited by your imagination.
  3. Converging text, pictures and data can be a powerful tool in compliance.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 587 no One Month to a More Effective Compliance Program in Training and Communications - Compliance and the Clash of Cultures One of the more difficult things to predict in the mergers and acquisition context is how the cultures of the two entities will merge. Further, while many mergers claim to be a ‘merger of equals’ the reality is far different as there is always one corporate winner that continues to exist and one corporate loser that simply ceases to exist. This is true across industries and countries; witness the debacle of DaimlerChrysler, the disaster of the HP acquisition of Autonomy or the slow downhill slide of United Airlines, Inc. after its merger with Continental Airlines. In the compliance space this clash of cultures is often seen. One company may have a robust compliance program, with a commitment from top management to have a best practices compliance program. The other company may put profits before compliance. Whichever company comes out the winner in the merger, it can certainly mean not only conflict but if the winning entity is not seen as valuing compliance, it may mean investigations and possibly even violations going forward. Learning how your employees in other countries will approach decision-making and leadership will give you, as the CCO, insight into how they will approach compliance. It will require you to get out into the field to talk with folks. If your company grows organically or through M&A or the JV route, it will need to understand how your new employees will not only think through issues but how they will relate to instructions from the home office in America. Three key takeaways: Culture clash through a merger can be extremely negative for a company. What are the cultures of leadership in your organization? Learning how your employees approach decision making can provide insight into how the will approach compliance. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 08 May 2023 04:00:00 -0000 Compliance and the Clash of Cultures full Thomas Fox Today we consider the corporate clash of cultures and what it means for compliance. One of the more difficult things to predict in the mergers and acquisition context is how the cultures of the two entities will merge. Further, while many mergers claim to be a ‘merger of equals’ the reality is far different as there is always one corporate winner that continues to exist and one corporate loser that simply ceases to exist. This is true across industries and countries; witness the debacle of DaimlerChrysler, the disaster of the HP acquisition of Autonomy or the slow downhill slide of United Airlines, Inc. after its merger with Continental Airlines. In the compliance space this clash of cultures is often seen. One company may have a robust compliance program, with a commitment from top management to have a best practices compliance program. The other company may put profits before compliance. Whichever company comes out the winner in the merger, it can certainly mean not only conflict but if the winning entity is not seen as valuing compliance, it may mean investigations and possibly even violations going forward. Learning how your employees in other countries will approach decision-making and leadership will give you, as the CCO, insight into how they will approach compliance. It will require you to get out into the field to talk with folks. If your company grows organically or through M&A or the JV route, it will need to understand how your new employees will not only think through issues but how they will relate to instructions from the home office in America. Three key takeaways: Culture clash through a merger can be extremely negative for a company. What are the cultures of leadership in your organization? Learning how your employees approach decision making can provide insight into how the will approach compliance. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the more difficult things to predict in the mergers and acquisition context is how the cultures of the two entities will merge. Further, while many mergers claim to be a ‘merger of equals’ the reality is far different as there is always one corporate winner that continues to exist and one corporate loser that simply ceases to exist. This is true across industries and countries; witness the debacle of DaimlerChrysler, the disaster of the HP acquisition of Autonomy or the slow downhill slide of United Airlines, Inc. after its merger with Continental Airlines.

In the compliance space this clash of cultures is often seen. One company may have a robust compliance program, with a commitment from top management to have a best practices compliance program. The other company may put profits before compliance. Whichever company comes out the winner in the merger, it can certainly mean not only conflict but if the winning entity is not seen as valuing compliance, it may mean investigations and possibly even violations going forward.

Learning how your employees in other countries will approach decision-making and leadership will give you, as the CCO, insight into how they will approach compliance. It will require you to get out into the field to talk with folks. If your company grows organically or through M&A or the JV route, it will need to understand how your new employees will not only think through issues but how they will relate to instructions from the home office in America.

Three key takeaways:

  1. Culture clash through a merger can be extremely negative for a company.
  2. What are the cultures of leadership in your organization?
  3. Learning how your employees approach decision making can provide insight into how the will approach compliance.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 553 no One Month to a More Effective Compliance Program in Training and Communications - Sharing to 360-Degrees of communication Why do people share information? The answer to that question has important implications for every compliance practitioner and compliance program. Sharing is a primary method to communicate and connect. This is always a challenge in any far-flung international corporation, particularly for disciplines that can be viewed as home office overhead at best and the Land of No at worst. Work to hone your message through social media. Part of this is based on experimenting with what message to send and how to send it. Another aspect was based upon the Wave (of all things), its development, and coming to fruition in the early 1980s. It took some time for it to become popular, but once it was communicated to enough disparate communications, it took off. “It’s the same thing with social media. On social media, we think something will go viral because the art is beautiful or the science is full of deep analytics, but it takes time to build the community.” This means that you will need to work to hone your message and continue to plug away to send that message out. The Morgan Stanley declination will always be instructional as one of the reasons the DOJ did not prosecute the company, as they sent out 35 compliance reminders to its workforce over seven years. Social media can be used in the same cost-effective way to get the message of compliance out and to receive information and communications back from your customer base, the company employees. Three key takeaways: What makes your employees want to share information? Facilitate mechanisms that allow sharing with the compliance function. The Morgan Stanley declination still resonates. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 05 May 2023 10:50:34 -0000 Sharing to 360-Degrees of communication full Thomas Fox Today we consider sharing of information. Why do people share information? The answer to that question has important implications for every compliance practitioner and compliance program. Sharing is a primary method to communicate and connect. This is always a challenge in any far-flung international corporation, particularly for disciplines that can be viewed as home office overhead at best and the Land of No at worst. Work to hone your message through social media. Part of this is based on experimenting with what message to send and how to send it. Another aspect was based upon the Wave (of all things), its development, and coming to fruition in the early 1980s. It took some time for it to become popular, but once it was communicated to enough disparate communications, it took off. “It’s the same thing with social media. On social media, we think something will go viral because the art is beautiful or the science is full of deep analytics, but it takes time to build the community.” This means that you will need to work to hone your message and continue to plug away to send that message out. The Morgan Stanley declination will always be instructional as one of the reasons the DOJ did not prosecute the company, as they sent out 35 compliance reminders to its workforce over seven years. Social media can be used in the same cost-effective way to get the message of compliance out and to receive information and communications back from your customer base, the company employees. Three key takeaways: What makes your employees want to share information? Facilitate mechanisms that allow sharing with the compliance function. The Morgan Stanley declination still resonates. For more information, check out The Compliance Handbook, 4th edition, here. Learn more about your ad choices. Visit megaphone.fm/adchoices Why do people share information? The answer to that question has important implications for every compliance practitioner and compliance program. Sharing is a primary method to communicate and connect. This is always a challenge in any far-flung international corporation, particularly for disciplines that can be viewed as home office overhead at best and the Land of No at worst. Work to hone your message through social media. Part of this is based on experimenting with what message to send and how to send it. Another aspect was based upon the Wave (of all things), its development, and coming to fruition in the early 1980s. It took some time for it to become popular, but once it was communicated to enough disparate communications, it took off. “It’s the same thing with social media. On social media, we think something will go viral because the art is beautiful or the science is full of deep analytics, but it takes time to build the community.”

This means that you will need to work to hone your message and continue to plug away to send that message out. The Morgan Stanley declination will always be instructional as one of the reasons the DOJ did not prosecute the company, as they sent out 35 compliance reminders to its workforce over seven years. Social media can be used in the same cost-effective way to get the message of compliance out and to receive information and communications back from your customer base, the company employees.

Three key takeaways:

  1. What makes your employees want to share information?
  2. Facilitate mechanisms that allow sharing with the compliance function.
  3. The Morgan Stanley declination still resonates.

For more information, check out The Compliance Handbook, 4th edition, here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 534 no One Month to a More Effective Training and Communications - Using Social Media to Innovate in Your Compliance Regime I am a huge fan of using social media in your compliance function. But how can you get your arms around how to structure such a program for your company? After acknowledging that social media focuses on the social aspects of communication, the most important thing to remember is that communication in social media is two-way, both inbound and outbound. It helps to bring your employee base together in an efficient manner to create an environment conducive to compliance for your organization. It also has the benefit of continued engagement. It is more than putting on training or even a set of initiatives; you can continue the conversation and enthusiasm about compliance going forward throughout the year. The authors break this down further into three parts that emphasize 1) the need to listen to and learn from user-generated content, 2) the need to engage and facilitate dialogue with employee innovators, and 3) to find an audience of early adopters to create excitement and collect feedback. If your goal in the compliance function is to create awareness and publicize your compliance program and initiatives, social media can be a powerful tool. This is so paramount that it should become a core activity of your compliance function. Using social media tools, your compliance function can tell the story of compliance, communicate expectations, and even train. Yet again, it is simply more than a one-way tool. Just as employees are more apt to tell you about a concern immediately or soon after being trained on that issue, they may well communicate directly with you after receiving social media communication on subjects such as managing third-party relationships. CCOs and compliance practitioners must develop a dedicated compliance strategy around social media in the context of their corporate objectives. It allows you a 360-degree view of compliance, through which you can take input from your employee base and create a compliance experience that your employees will embrace.  Three key takeaways: Never forget that social media is a two-way communication. Company employees are the customers of the compliance department. As with all compliance issues, assess what works for your company and appropriately tailor your social media approach. For more information, check out The Compliance Handbook, 4th edition here. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 04 May 2023 04:00:00 -0000 Using Social Media to Innovate in Your Compliance Regime full Thomas Fox Today, how can you utilize social media to innovate in your compliance program. I am a huge fan of using social media in your compliance function. But how can you get your arms around how to structure such a program for your company? After acknowledging that social media focuses on the social aspects of communication, the most important thing to remember is that communication in social media is two-way, both inbound and outbound. It helps to bring your employee base together in an efficient manner to create an environment conducive to compliance for your organization. It also has the benefit of continued engagement. It is more than putting on training or even a set of initiatives; you can continue the conversation and enthusiasm about compliance going forward throughout the year. The authors break this down further into three parts that emphasize 1) the need to listen to and learn from user-generated content, 2) the need to engage and facilitate dialogue with employee innovators, and 3) to find an audience of early adopters to create excitement and collect feedback. If your goal in the compliance function is to create awareness and publicize your compliance program and initiatives, social media can be a powerful tool. This is so paramount that it should become a core activity of your compliance function. Using social media tools, your compliance function can tell the story of compliance, communicate expectations, and even train. Yet again, it is simply more than a one-way tool. Just as employees are more apt to tell you about a concern immediately or soon after being trained on that issue, they may well communicate directly with you after receiving social media communication on subjects such as managing third-party relationships. CCOs and compliance practitioners must develop a dedicated compliance strategy around social media in the context of their corporate objectives. It allows you a 360-degree view of compliance, through which you can take input from your employee base and create a compliance experience that your employees will embrace.  Three key takeaways: Never forget that social media is a two-way communication. Company employees are the customers of the compliance department. As with all compliance issues, assess what works for your company and appropriately tailor your social media approach. For more information, check out The Compliance Handbook, 4th edition here. Learn more about your ad choices. Visit megaphone.fm/adchoices I am a huge fan of using social media in your compliance function. But how can you get your arms around how to structure such a program for your company? After acknowledging that social media focuses on the social aspects of communication, the most important thing to remember is that communication in social media is two-way, both inbound and outbound. It helps to bring your employee base together in an efficient manner to create an environment conducive to compliance for your organization. It also has the benefit of continued engagement. It is more than putting on training or even a set of initiatives; you can continue the conversation and enthusiasm about compliance going forward throughout the year. The authors break this down further into three parts that emphasize 1) the need to listen to and learn from user-generated content, 2) the need to engage and facilitate dialogue with employee innovators, and 3) to find an audience of early adopters to create excitement and collect feedback.

If your goal in the compliance function is to create awareness and publicize your compliance program and initiatives, social media can be a powerful tool. This is so paramount that it should become a core activity of your compliance function. Using social media tools, your compliance function can tell the story of compliance, communicate expectations, and even train. Yet again, it is simply more than a one-way tool. Just as employees are more apt to tell you about a concern immediately or soon after being trained on that issue, they may well communicate directly with you after receiving social media communication on subjects such as managing third-party relationships.

CCOs and compliance practitioners must develop a dedicated compliance strategy around social media in the context of their corporate objectives. It allows you a 360-degree view of compliance, through which you can take input from your employee base and create a compliance experience that your employees will embrace.

 Three key takeaways:

  • Never forget that social media is a two-way communication.
  • Company employees are the customers of the compliance department.
  • As with all compliance issues, assess what works for your company and appropriately tailor your social media approach.


For more information, check out The Compliance Handbook, 4th edition here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 608 One Month to a More Effective Training and Communications - Use of Social Media in Compliance What is the message of compliance inside of a corporation and how it is distributed? In a compliance program, the largest portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communications are free or available at very low cost. Why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward? Louis Sapirman, Vice President and Chief Ethics & Compliance Officer for Panasonic Corporation of North America – Panasonic USA, often talks about the integration of social media into compliance. You should start with the tech-savvy nature of the today’s workforce. It is not simply about having a younger workforce but a workforce whose primary tool for communication is social media. If your company is in the services business, it probably means your employee base is using technological tools to deliver business solutions. Finally, consider the data-driven nature of business today so using technological tools to deliver products and solutions is something your company most probably does now. Facebook, LinkedIn, Twitter and even TikTok can all be utilized.  Finally, never forget the social part of social media. Social media is a more holistic, multiple-sided communication. Not only are you setting out expectations but also these tools allow you to receive back communications from your employees. The D&B experience around the name change for its Code of Conduct is but one example. You can also see that if you have several concerns expressed it could alert you earlier to begin some detection and move towards prevention in your compliance program. Another approach is to use audio as a part of your compliance communications. Podcasts are a great way to tell a long form story about your compliance successes and challenges. Ronnie Feldman, founder of L&E Entertainment continually reminds us that the engagement of your compliance audience is through the entertainment of your compliance communications. But the key is the audio format can be a powerful tool for you and a way to reach your employee base that you are not taking advantage. It can be as simple as interviewing employees on the importance of culture and how they use culture to guide their decision-making process in their daily work. You are only limited by your imagination.  Three key takeaways: 1. Incorporation of social media into your compliance communications can pay big dividends. 2. Focus on the ‘social’ part of social media. 3. Consider incorporating podcasts and other audio clips into your compliance communications and training. For more information, check The Compliance Handbook, 3rd Edition available here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 03 May 2023 04:00:00 -0000 One Month to a More Effective Compliance Program for Training and Communications - Use of Social Media in Compliance full Thomas Fox How can you use social media in your compliance program? What is the message of compliance inside of a corporation and how it is distributed? In a compliance program, the largest portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communications are free or available at very low cost. Why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward? Louis Sapirman, Vice President and Chief Ethics & Compliance Officer for Panasonic Corporation of North America – Panasonic USA, often talks about the integration of social media into compliance. You should start with the tech-savvy nature of the today’s workforce. It is not simply about having a younger workforce but a workforce whose primary tool for communication is social media. If your company is in the services business, it probably means your employee base is using technological tools to deliver business solutions. Finally, consider the data-driven nature of business today so using technological tools to deliver products and solutions is something your company most probably does now. Facebook, LinkedIn, Twitter and even TikTok can all be utilized.  Finally, never forget the social part of social media. Social media is a more holistic, multiple-sided communication. Not only are you setting out expectations but also these tools allow you to receive back communications from your employees. The D&B experience around the name change for its Code of Conduct is but one example. You can also see that if you have several concerns expressed it could alert you earlier to begin some detection and move towards prevention in your compliance program. Another approach is to use audio as a part of your compliance communications. Podcasts are a great way to tell a long form story about your compliance successes and challenges. Ronnie Feldman, founder of L&E Entertainment continually reminds us that the engagement of your compliance audience is through the entertainment of your compliance communications. But the key is the audio format can be a powerful tool for you and a way to reach your employee base that you are not taking advantage. It can be as simple as interviewing employees on the importance of culture and how they use culture to guide their decision-making process in their daily work. You are only limited by your imagination.  Three key takeaways: 1. Incorporation of social media into your compliance communications can pay big dividends. 2. Focus on the ‘social’ part of social media. 3. Consider incorporating podcasts and other audio clips into your compliance communications and training. For more information, check The Compliance Handbook, 3rd Edition available here.  Learn more about your ad choices. Visit megaphone.fm/adchoices What is the message of compliance inside of a corporation and how it is distributed? In a compliance program, the largest portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communications are free or available at very low cost. Why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward?

Louis Sapirman, Vice President and Chief Ethics & Compliance Officer for Panasonic Corporation of North America – Panasonic USA, often talks about the integration of social media into compliance. You should start with the tech-savvy nature of the today’s workforce. It is not simply about having a younger workforce but a workforce whose primary tool for communication is social media. If your company is in the services business, it probably means your employee base is using technological tools to deliver business solutions. Finally, consider the data-driven nature of business today so using technological tools to deliver products and solutions is something your company most probably does now. Facebook, LinkedIn, Twitter and even TikTok can all be utilized. 

Finally, never forget the social part of social media. Social media is a more holistic, multiple-sided communication. Not only are you setting out expectations but also these tools allow you to receive back communications from your employees. The D&B experience around the name change for its Code of Conduct is but one example. You can also see that if you have several concerns expressed it could alert you earlier to begin some detection and move towards prevention in your compliance program.

Another approach is to use audio as a part of your compliance communications. Podcasts are a great way to tell a long form story about your compliance successes and challenges. Ronnie Feldman, founder of L&E Entertainment continually reminds us that the engagement of your compliance audience is through the entertainment of your compliance communications. But the key is the audio format can be a powerful tool for you and a way to reach your employee base that you are not taking advantage. It can be as simple as interviewing employees on the importance of culture and how they use culture to guide their decision-making process in their daily work. You are only limited by your imagination.

 Three key takeaways:

1. Incorporation of social media into your compliance communications can pay big dividends.

2. Focus on the ‘social’ part of social media.

3. Consider incorporating podcasts and other audio clips into your compliance communications and training.

For more information, check The Compliance Handbook, 3rd Edition available here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 473 no One Month to a More Effective Training and Communications - The D&B Experience in Training and Communications How did one company and one CCO actively use social media to make the company's compliance culture more effective? The company was Dun & Bradstreet, Inc. (D&B), and its then CCO, Louis Sapirman, discussed D&B's integration of social media into compliance with me. As we advance, these tools can go a long way toward enhancing your compliance program. Recall the declination to prosecute Morgan Stanley received from the DOJ when one of its managing directors had engaged in FCPA violations. One of the reasons cited by the DOJ was 35 email compliance reminders sent over seven years, bolsters the annual FCPA training the recalcitrant managing director received. You can use your archived social media communications as evidence that you have continually communicated your company's expectations around compliance. It is equally important that these expectations are documented. Finally, always remember the social part of social media. Social media is a two-way communication. Not only are you setting out expectations, but also, these tools allow you to receive back communications from your employees. The D&B experience around the name change for its Code of Conduct is but one example. If you have several concerns expressed, it could alert you earlier to begin some detection and move toward prevention in your compliance program. Three key takeaways: How do 360 degrees of communication work in compliance? Focus on the ‘social’ part of social media. Use internal corporate social media to have a conversation. For more information, check The Compliance Handbook, 3rd Edition available here. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 02 May 2023 04:00:00 -0000 The D&B Experience in Training and Communications full Thomas Fox Today, how one company incorporated effective use of social media into effective training and communications. How did one company and one CCO actively use social media to make the company's compliance culture more effective? The company was Dun & Bradstreet, Inc. (D&B), and its then CCO, Louis Sapirman, discussed D&B's integration of social media into compliance with me. As we advance, these tools can go a long way toward enhancing your compliance program. Recall the declination to prosecute Morgan Stanley received from the DOJ when one of its managing directors had engaged in FCPA violations. One of the reasons cited by the DOJ was 35 email compliance reminders sent over seven years, bolsters the annual FCPA training the recalcitrant managing director received. You can use your archived social media communications as evidence that you have continually communicated your company's expectations around compliance. It is equally important that these expectations are documented. Finally, always remember the social part of social media. Social media is a two-way communication. Not only are you setting out expectations, but also, these tools allow you to receive back communications from your employees. The D&B experience around the name change for its Code of Conduct is but one example. If you have several concerns expressed, it could alert you earlier to begin some detection and move toward prevention in your compliance program. Three key takeaways: How do 360 degrees of communication work in compliance? Focus on the ‘social’ part of social media. Use internal corporate social media to have a conversation. For more information, check The Compliance Handbook, 3rd Edition available here. Learn more about your ad choices. Visit megaphone.fm/adchoices How did one company and one CCO actively use social media to make the company's compliance culture more effective? The company was Dun & Bradstreet, Inc. (D&B), and its then CCO, Louis Sapirman, discussed D&B's integration of social media into compliance with me.

As we advance, these tools can go a long way toward enhancing your compliance program. Recall the declination to prosecute Morgan Stanley received from the DOJ when one of its managing directors had engaged in FCPA violations. One of the reasons cited by the DOJ was 35 email compliance reminders sent over seven years, bolsters the annual FCPA training the recalcitrant managing director received. You can use your archived social media communications as evidence that you have continually communicated your company's expectations around compliance. It is equally important that these expectations are documented.

Finally, always remember the social part of social media. Social media is a two-way communication. Not only are you setting out expectations, but also, these tools allow you to receive back communications from your employees. The D&B experience around the name change for its Code of Conduct is but one example. If you have several concerns expressed, it could alert you earlier to begin some detection and move toward prevention in your compliance program.

Three key takeaways:

  1. How do 360 degrees of communication work in compliance?
  2. Focus on the ‘social’ part of social media.
  3. Use internal corporate social media to have a conversation.

For more information, check The Compliance Handbook, 3rd Edition available here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 615 no One Month to a More Effective Training and Communications - Introduction In this month's offering of 31 Days to a More Effective Compliance Program, you will learn about training and communication techniques that the CCO can use to provide a well-rounded role as a CCO and facilitate a much more holistic approach to compliance in your organization. Best of all, the techniques discussed are available at little to no cost. You can do things in your method of running the CCO positions and innovations that you can bring to the compliance function in your organization. A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is always in touch with and visible to your employees. It is about creating a distinctive brand philosophy of compliance centered on the customers of your compliance program (i.e., your employees). It helps to anticipate all the aspects of your employee's needs around compliance, especially when compliance is perceived as new, something that comes out of the home office, or as the Land of No. It allows you to build a new brand image for your compliance program. The objective is to build trust for the 360-degree process by determining if the goal was achieved. You can utilize surveys or focus groups to assess the impact on your target audience. Focusing on your customers of compliance allows you to identify gaps and improve the communication process for your compliance program. Three key takeaways: Remember the definition of 360 degrees of compliance communications. It is an effort that moves the compliance identity into a holistic approach so compliance is always in touch and visible to your employees. What is your objective? What are you trying to do with your 360-degree view of compliance communications, and how are you using that mechanism to deliver the objective your compliance program desires? You need to evaluate if the message has been delivered, has been heard, and is being implemented. For more information, check The Compliance Handbook, 3rd Edition, available here. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 01 May 2023 04:00:00 -0000 Introduction to Training and Communications full Thomas Fox In May we take up training and communications. In this month's offering of 31 Days to a More Effective Compliance Program, you will learn about training and communication techniques that the CCO can use to provide a well-rounded role as a CCO and facilitate a much more holistic approach to compliance in your organization. Best of all, the techniques discussed are available at little to no cost. You can do things in your method of running the CCO positions and innovations that you can bring to the compliance function in your organization. A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is always in touch with and visible to your employees. It is about creating a distinctive brand philosophy of compliance centered on the customers of your compliance program (i.e., your employees). It helps to anticipate all the aspects of your employee's needs around compliance, especially when compliance is perceived as new, something that comes out of the home office, or as the Land of No. It allows you to build a new brand image for your compliance program. The objective is to build trust for the 360-degree process by determining if the goal was achieved. You can utilize surveys or focus groups to assess the impact on your target audience. Focusing on your customers of compliance allows you to identify gaps and improve the communication process for your compliance program. Three key takeaways: Remember the definition of 360 degrees of compliance communications. It is an effort that moves the compliance identity into a holistic approach so compliance is always in touch and visible to your employees. What is your objective? What are you trying to do with your 360-degree view of compliance communications, and how are you using that mechanism to deliver the objective your compliance program desires? You need to evaluate if the message has been delivered, has been heard, and is being implemented. For more information, check The Compliance Handbook, 3rd Edition, available here. Learn more about your ad choices. Visit megaphone.fm/adchoices In this month's offering of 31 Days to a More Effective Compliance Program, you will learn about training and communication techniques that the CCO can use to provide a well-rounded role as a CCO and facilitate a much more holistic approach to compliance in your organization. Best of all, the techniques discussed are available at little to no cost. You can do things in your method of running the CCO positions and innovations that you can bring to the compliance function in your organization.

A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is always in touch with and visible to your employees. It is about creating a distinctive brand philosophy of compliance centered on the customers of your compliance program (i.e., your employees). It helps to anticipate all the aspects of your employee's needs around compliance, especially when compliance is perceived as new, something that comes out of the home office, or as the Land of No. It allows you to build a new brand image for your compliance program.

The objective is to build trust for the 360-degree process by determining if the goal was achieved. You can utilize surveys or focus groups to assess the impact on your target audience. Focusing on your customers of compliance allows you to identify gaps and improve the communication process for your compliance program.

Three key takeaways:

  1. Remember the definition of 360 degrees of compliance communications. It is an effort that moves the compliance identity into a holistic approach so compliance is always in touch and visible to your employees.
  2. What is your objective? What are you trying to do with your 360-degree view of compliance communications, and how are you using that mechanism to deliver the objective your compliance program desires?
  3. You need to evaluate if the message has been delivered, has been heard, and is being implemented.


For more information, check The Compliance Handbook, 3rd Edition, available here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 751 no One Month to a More Effective Compliance Program for 3rd Parties - Risk Ranking in the Supply Chain One of the areas many companies do not focus on enough is possible corruption in their supply chain for goods and services provided on a company’s behalf. The FCPA risks can be just as great through those entry points as they can be through the sales side of an organization. You need to know whom your company is doing business with through this channel as much as you need to know your agents seeking business opportunities on your behalf. Most companies have exponentially more vendors than sales agents, so this task may seem daunting. However, a well-thought-out plan to risk rank your company’s third parties on the supply chain side can go a long way toward ameliorating this issue. The key is setting reasonable parameters and then managing those third parties that present real corruption risk to your organization. This determination of the level of due diligence and categorization of a supplier should depend on a variety of factors, including such factors as whether the supplier is (1) located or will operate in a high-risk country; (2) associated, or recommended, or required by, a government official; (3) currently under corruption investigation, or has been recently convicted of any form of corruption; (4) a multinational publicly traded corporation with a recognized exemplary system of compliance and internal controls; or (5) a provider of widely available services and products that are not industry specific. You should note that any supplier with foreign government touchpoints should move up to a higher level of scrutiny. I suggest that you create a three-tiered risk matrix consisting of (1) high-risk suppliers, (2) low-risk suppliers, and (3) minimal-risk suppliers. Below this final category is another category for providers of goods that are commonly available and pose almost no corruption risk. It would be best to risk ranking the third parties your supply chain might engage with for FCPA exposure. It should be based on your company’s experience and risk going forward. As with all third-party risk management issues, you must “Document, Document, and Document.” Three key takeaways: Risk rank your supply chain based on well-conceived strata. Consider not only the compliance risk but also your business risk. Only manage those suppliers who present a corruption risk. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 27 Apr 2023 04:00:00 -0000 Risk Ranking in the Supply Chain full Thomas Fox Today we consider Risk Ranking in the Supply Chain. One of the areas many companies do not focus on enough is possible corruption in their supply chain for goods and services provided on a company’s behalf. The FCPA risks can be just as great through those entry points as they can be through the sales side of an organization. You need to know whom your company is doing business with through this channel as much as you need to know your agents seeking business opportunities on your behalf. Most companies have exponentially more vendors than sales agents, so this task may seem daunting. However, a well-thought-out plan to risk rank your company’s third parties on the supply chain side can go a long way toward ameliorating this issue. The key is setting reasonable parameters and then managing those third parties that present real corruption risk to your organization. This determination of the level of due diligence and categorization of a supplier should depend on a variety of factors, including such factors as whether the supplier is (1) located or will operate in a high-risk country; (2) associated, or recommended, or required by, a government official; (3) currently under corruption investigation, or has been recently convicted of any form of corruption; (4) a multinational publicly traded corporation with a recognized exemplary system of compliance and internal controls; or (5) a provider of widely available services and products that are not industry specific. You should note that any supplier with foreign government touchpoints should move up to a higher level of scrutiny. I suggest that you create a three-tiered risk matrix consisting of (1) high-risk suppliers, (2) low-risk suppliers, and (3) minimal-risk suppliers. Below this final category is another category for providers of goods that are commonly available and pose almost no corruption risk. It would be best to risk ranking the third parties your supply chain might engage with for FCPA exposure. It should be based on your company’s experience and risk going forward. As with all third-party risk management issues, you must “Document, Document, and Document.” Three key takeaways: Risk rank your supply chain based on well-conceived strata. Consider not only the compliance risk but also your business risk. Only manage those suppliers who present a corruption risk. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the areas many companies do not focus on enough is possible corruption in their supply chain for goods and services provided on a company’s behalf. The FCPA risks can be just as great through those entry points as they can be through the sales side of an organization. You need to know whom your company is doing business with through this channel as much as you need to know your agents seeking business opportunities on your behalf. Most companies have exponentially more vendors than sales agents, so this task may seem daunting. However, a well-thought-out plan to risk rank your company’s third parties on the supply chain side can go a long way toward ameliorating this issue. The key is setting reasonable parameters and then managing those third parties that present real corruption risk to your organization.

This determination of the level of due diligence and categorization of a supplier should depend on a variety of factors, including such factors as whether the supplier is (1) located or will operate in a high-risk country; (2) associated, or recommended, or required by, a government official; (3) currently under corruption investigation, or has been recently convicted of any form of corruption; (4) a multinational publicly traded corporation with a recognized exemplary system of compliance and internal controls; or (5) a provider of widely available services and products that are not industry specific. You should note that any supplier with foreign government touchpoints should move up to a higher level of scrutiny.

I suggest that you create a three-tiered risk matrix consisting of (1) high-risk suppliers, (2) low-risk suppliers, and (3) minimal-risk suppliers. Below this final category is another category for providers of goods that are commonly available and pose almost no corruption risk.

It would be best to risk ranking the third parties your supply chain might engage with for FCPA exposure. It should be based on your company’s experience and risk going forward. As with all third-party risk management issues, you must “Document, Document, and Document.”

Three key takeaways:

  1. Risk rank your supply chain based on well-conceived strata.
  2. Consider not only the compliance risk but also your business risk.
  3. Only manage those suppliers who present a corruption risk.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 476 no One Month to a More Effective Compliance Program for 3rd Parties- Freight Forwarders The FCPA world is littered with cases involving freight forwarders, brokers and agents in the shipping and express delivery arena. Both the DOJ and SEC have aggressively pursued third-party business relationships where bribery and corruption have been found. This is particularly true where companies are required to deliver goods into a foreign country through the assistance of a freight forwarder or express delivery service. If you utilize the services of a third-party for as a freight forwarders, brokers and agents in the shipping and express delivery arena, that company’s actions will go a long way in determining your company’s FCPA liability. You must have a thoughtful process and document that process. Three key takeaways: Express delivery services and freight forwarders present unique compliance risks. There must be a business justification to bring on new express delivery services or freight forwarders in high risk jurisdictions. Consider constructing a risk matrix in this area. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 26 Apr 2023 04:00:00 -0000 Freight Forwarders full Thomas Fox Today we consider Freight Forwarders. The FCPA world is littered with cases involving freight forwarders, brokers and agents in the shipping and express delivery arena. Both the DOJ and SEC have aggressively pursued third-party business relationships where bribery and corruption have been found. This is particularly true where companies are required to deliver goods into a foreign country through the assistance of a freight forwarder or express delivery service. If you utilize the services of a third-party for as a freight forwarders, brokers and agents in the shipping and express delivery arena, that company’s actions will go a long way in determining your company’s FCPA liability. You must have a thoughtful process and document that process. Three key takeaways: Express delivery services and freight forwarders present unique compliance risks. There must be a business justification to bring on new express delivery services or freight forwarders in high risk jurisdictions. Consider constructing a risk matrix in this area. Learn more about your ad choices. Visit megaphone.fm/adchoices The FCPA world is littered with cases involving freight forwarders, brokers and agents in the shipping and express delivery arena. Both the DOJ and SEC have aggressively pursued third-party business relationships where bribery and corruption have been found. This is particularly true where companies are required to deliver goods into a foreign country through the assistance of a freight forwarder or express delivery service.

If you utilize the services of a third-party for as a freight forwarders, brokers and agents in the shipping and express delivery arena, that company’s actions will go a long way in determining your company’s FCPA liability. You must have a thoughtful process and document that process.

Three key takeaways:

  1. Express delivery services and freight forwarders present unique compliance risks.
  2. There must be a business justification to bring on new express delivery services or freight forwarders in high risk jurisdictions.
  3. Consider constructing a risk matrix in this area.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 479 no One Month to a More Effective Compliance Program for 3rd Parties - Distributor Compensation One of the issues in any compliance program is the compensation paid to a third party, as FCPA exposure arises when companies pay money, either directly or indirectly, to fund bribe payments. Another area that leads to exposure from third parties is with distributors. In a distributor relationship, the distributor purchases a product, taking the risk of loss and title, at a discount from a manufacturer. The distributor resells at an uplift, and that spread between the purchase price and sales price is the distributor’s income. If a product is purchased at an inflated discounted rate and sold, the difference between the purchase price and resale value could be used for corrupt purposes. Commission payments and excessive distributor discounts can be channeled to pay bribes. The FCPA Resource Guide, 2nd edition, noted that common red flags associated with third parties include “unreasonably large discounts to third-party distributors.” When companies grant distributors uncommonly steep discounts, bribes can result either: 1) because the company instructs the distributor to use the excess amounts to fund corrupt payments; or 2) because the distributor pays bribes on its own, without the express direction or implicit suggestion from the company, to gain some business advantage. Three key takeaways: Creating a well-thought-out process that operationalizes your compliance program around distributor compensation in a manner that documents your decision-making calculus is key. Require multiple levels of approval for an out-of-range distributor discount. Tracking distributor discounts globally make your company more efficient. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 25 Apr 2023 04:00:00 -0000 Distributor Compensation full Thomas Fox Today, we consider Distributor Compensation. One of the issues in any compliance program is the compensation paid to a third party, as FCPA exposure arises when companies pay money, either directly or indirectly, to fund bribe payments. Another area that leads to exposure from third parties is with distributors. In a distributor relationship, the distributor purchases a product, taking the risk of loss and title, at a discount from a manufacturer. The distributor resells at an uplift, and that spread between the purchase price and sales price is the distributor’s income. If a product is purchased at an inflated discounted rate and sold, the difference between the purchase price and resale value could be used for corrupt purposes. Commission payments and excessive distributor discounts can be channeled to pay bribes. The FCPA Resource Guide, 2nd edition, noted that common red flags associated with third parties include “unreasonably large discounts to third-party distributors.” When companies grant distributors uncommonly steep discounts, bribes can result either: 1) because the company instructs the distributor to use the excess amounts to fund corrupt payments; or 2) because the distributor pays bribes on its own, without the express direction or implicit suggestion from the company, to gain some business advantage. Three key takeaways: Creating a well-thought-out process that operationalizes your compliance program around distributor compensation in a manner that documents your decision-making calculus is key. Require multiple levels of approval for an out-of-range distributor discount. Tracking distributor discounts globally make your company more efficient. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the issues in any compliance program is the compensation paid to a third party, as FCPA exposure arises when companies pay money, either directly or indirectly, to fund bribe payments. Another area that leads to exposure from third parties is with distributors. In a distributor relationship, the distributor purchases a product, taking the risk of loss and title, at a discount from a manufacturer. The distributor resells at an uplift, and that spread between the purchase price and sales price is the distributor’s income. If a product is purchased at an inflated discounted rate and sold, the difference between the purchase price and resale value could be used for corrupt purposes. Commission payments and excessive distributor discounts can be channeled to pay bribes.

The FCPA Resource Guide, 2nd edition, noted that common red flags associated with third parties include “unreasonably large discounts to third-party distributors.” When companies grant distributors uncommonly steep discounts, bribes can result either: 1) because the company instructs the distributor to use the excess amounts to fund corrupt payments; or 2) because the distributor pays bribes on its own, without the express direction or implicit suggestion from the company, to gain some business advantage.

Three key takeaways:

  1. Creating a well-thought-out process that operationalizes your compliance program around distributor compensation in a manner that documents your decision-making calculus is key.
  2. Require multiple levels of approval for an out-of-range distributor discount.
  3. Tracking distributor discounts globally make your company more efficient.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 486 no One Month to a More Effective Compliance Program for 3rd Parties-Terminating 3rd Parties At some point, you will be required to terminate a third party and there will be multiple legal, compliance and business issues to navigate through. If you are stuck doing it in the middle of a FCPA or U.K. Bribery Act investigation, there may well be some tension to do so and do so quickly. If you have not thought through this issue and created a process to follow before a crisis occurs, you may well be in for a very tough road. Yet the 2023 ECCP specifically asked that question in the section entitled, Real Actions and Consequences, when it posed the query: Has a similar third party been suspended, terminated, or audited as a result of compliance issues? The key theme in termination is planning. The Office of Comptroller of the Currency (OCC), OCC Bulletin 2013-29, said that regarding third-party termination, a bank should develop a “contingency plan to ensure that the bank can transition the activities to another third party, bring the activities in-house, or discontinue the activities when a contract expires, the terms of the contract have been satisfied, in response to contract default, or in response to changes to the bank’s or third party’s business strategy.” Although rarely considered, the termination of a third-party relationship can be as important a step as any other in the management of the third-party lifecycle. While having the contractual right to terminate is a good starting point, it is only the starting point. You not only need to have a compliance and legal plan in place but a business plan as well. If you do not, the cost in both monetary and potential business reputation can be quite high.  Three key takeaways: 1. Termination of third parties is an oft-neglected part of the third-party risk management process. 2. Make certain you have the contractual right to terminate third parties written into your compliance terms and conditions. 3. Have a strategy in place for termination before a crisis arises. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 24 Apr 2023 04:00:00 -0000 Terminating 3rd Parties full Thomas Fox In this episode we consider terminating 3rd Parties. At some point, you will be required to terminate a third party and there will be multiple legal, compliance and business issues to navigate through. If you are stuck doing it in the middle of a FCPA or U.K. Bribery Act investigation, there may well be some tension to do so and do so quickly. If you have not thought through this issue and created a process to follow before a crisis occurs, you may well be in for a very tough road. Yet the 2023 ECCP specifically asked that question in the section entitled, Real Actions and Consequences, when it posed the query: Has a similar third party been suspended, terminated, or audited as a result of compliance issues? The key theme in termination is planning. The Office of Comptroller of the Currency (OCC), OCC Bulletin 2013-29, said that regarding third-party termination, a bank should develop a “contingency plan to ensure that the bank can transition the activities to another third party, bring the activities in-house, or discontinue the activities when a contract expires, the terms of the contract have been satisfied, in response to contract default, or in response to changes to the bank’s or third party’s business strategy.” Although rarely considered, the termination of a third-party relationship can be as important a step as any other in the management of the third-party lifecycle. While having the contractual right to terminate is a good starting point, it is only the starting point. You not only need to have a compliance and legal plan in place but a business plan as well. If you do not, the cost in both monetary and potential business reputation can be quite high.  Three key takeaways: 1. Termination of third parties is an oft-neglected part of the third-party risk management process. 2. Make certain you have the contractual right to terminate third parties written into your compliance terms and conditions. 3. Have a strategy in place for termination before a crisis arises. Learn more about your ad choices. Visit megaphone.fm/adchoices At some point, you will be required to terminate a third party and there will be multiple legal, compliance and business issues to navigate through. If you are stuck doing it in the middle of a FCPA or U.K. Bribery Act investigation, there may well be some tension to do so and do so quickly. If you have not thought through this issue and created a process to follow before a crisis occurs, you may well be in for a very tough road. Yet the 2023 ECCP specifically asked that question in the section entitled, Real Actions and Consequences, when it posed the query: Has a similar third party been suspended, terminated, or audited as a result of compliance issues?

The key theme in termination is planning. The Office of Comptroller of the Currency (OCC), OCC Bulletin 2013-29, said that regarding third-party termination, a bank should develop a “contingency plan to ensure that the bank can transition the activities to another third party, bring the activities in-house, or discontinue the activities when a contract expires, the terms of the contract have been satisfied, in response to contract default, or in response to changes to the bank’s or third party’s business strategy.”

Although rarely considered, the termination of a third-party relationship can be as important a step as any other in the management of the third-party lifecycle. While having the contractual right to terminate is a good starting point, it is only the starting point. You not only need to have a compliance and legal plan in place but a business plan as well. If you do not, the cost in both monetary and potential business reputation can be quite high.

 Three key takeaways:

1. Termination of third parties is an oft-neglected part of the third-party risk management process.

2. Make certain you have the contractual right to terminate third parties written into your compliance terms and conditions.

3. Have a strategy in place for termination before a crisis arises.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 494 no One Month to a More Effective Compliance Program for 3rd Parties-3rd Parties as Innovation Partners It is universally recognized that third-parties are your highest FCPA risk. What if you could turn your third-party from a liability under the FCPA to an innovation partner to your compliance program? This is an area that not many compliance professionals have mined but once again in compliance, you are only limited by your imagination. In a Supply Chain Management Review article by Jennifer Blackhurst, Pam Manhart and Emily Kohnke, entitled “The Five Key Components for Supply Chain Innovation”, the authors identified five components common to the most successful innovation partnerships. They are: Don’t settle for the status quo. This means that you should not settle for simply the status quo in compliance. Hit the road in order to hit your metrics. To truly understand your compliance risk from third-parties, you must get out of the ivory tower and hit the road. Send prospectors, not auditors. While an audit clause is critical in any third-party contract, both from a commercial and FCPA compliance perspective; you can establish a “point of contact as an innovation manager for your third-parties.” Show and tell. As with all relationships, trust plays an important role in third-party compliance innovation, as “Firms in successful innovations discussed a willingness to share resources and rewards and to develop their partners’ capabilities.” Who’s running the show? This means “who is doing what, but also what each firm is bringing to the relationship in terms of resources and capabilities.” Three key takeaways: Use your third-parties as innovators to assist your compliance program. Change your thinking about third-parties and make them your partners. Do not settle for the status quo. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 21 Apr 2023 04:00:00 -0000 3rd Parties as Innovation Partners full Thomas Fox Next we consider 3rd Parties as Innovation Partners. It is universally recognized that third-parties are your highest FCPA risk. What if you could turn your third-party from a liability under the FCPA to an innovation partner to your compliance program? This is an area that not many compliance professionals have mined but once again in compliance, you are only limited by your imagination. In a Supply Chain Management Review article by Jennifer Blackhurst, Pam Manhart and Emily Kohnke, entitled “The Five Key Components for Supply Chain Innovation”, the authors identified five components common to the most successful innovation partnerships. They are: Don’t settle for the status quo. This means that you should not settle for simply the status quo in compliance. Hit the road in order to hit your metrics. To truly understand your compliance risk from third-parties, you must get out of the ivory tower and hit the road. Send prospectors, not auditors. While an audit clause is critical in any third-party contract, both from a commercial and FCPA compliance perspective; you can establish a “point of contact as an innovation manager for your third-parties.” Show and tell. As with all relationships, trust plays an important role in third-party compliance innovation, as “Firms in successful innovations discussed a willingness to share resources and rewards and to develop their partners’ capabilities.” Who’s running the show? This means “who is doing what, but also what each firm is bringing to the relationship in terms of resources and capabilities.” Three key takeaways: Use your third-parties as innovators to assist your compliance program. Change your thinking about third-parties and make them your partners. Do not settle for the status quo. Learn more about your ad choices. Visit megaphone.fm/adchoices It is universally recognized that third-parties are your highest FCPA risk. What if you could turn your third-party from a liability under the FCPA to an innovation partner to your compliance program? This is an area that not many compliance professionals have mined but once again in compliance, you are only limited by your imagination. In a Supply Chain Management Review article by Jennifer Blackhurst, Pam Manhart and Emily Kohnke, entitled “The Five Key Components for Supply Chain Innovation”, the authors identified five components common to the most successful innovation partnerships. They are:

Don’t settle for the status quo. This means that you should not settle for simply the status quo in compliance.

Hit the road in order to hit your metrics. To truly understand your compliance risk from third-parties, you must get out of the ivory tower and hit the road.

Send prospectors, not auditors. While an audit clause is critical in any third-party contract, both from a commercial and FCPA compliance perspective; you can establish a “point of contact as an innovation manager for your third-parties.”

Show and tell. As with all relationships, trust plays an important role in third-party compliance innovation, as “Firms in successful innovations discussed a willingness to share resources and rewards and to develop their partners’ capabilities.”

Who’s running the show? This means “who is doing what, but also what each firm is bringing to the relationship in terms of resources and capabilities.”

Three key takeaways:

  1. Use your third-parties as innovators to assist your compliance program.
  2. Change your thinking about third-parties and make them your partners.
  3. Do not settle for the status quo.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 455 no One Month to a More Effective Compliance Program for 3rd Parties-ROI for 3rd Party Risk Management A study by Forrester Research Inc. compared the user experience which lead to a finding of a positive ROI for the technology user around third-party risk management. I found the approach and methodology used persuasive and valuable for the compliance professional to consider in evaluating such a process in your organization. Some of the key findings readily translate across for the compliance practitioner. The first area was in risk assessments of third parties. If you provide a technological platform, you can enhance both the speed and efficiency of your risk assessments on an ongoing basis. This decrease in time, both in terms of length and man-hours, will yield an immediate cost saving for your compliance function. There are a wide variety of other factors that could increase your ROI, as detailed in the Forrester report, which include renewal assessments, ongoing monitoring, increase in business efficiencies for both your organization and the third parties, which would all work to increase ROI. Most critically, you would demonstrate the operationalization of your compliance program into the very fabric of your organization.  Three key takeaways: 1. Why is it important to demonstrate ROI on your third-party risk management program? 2. Determining ROI helps to demonstrate operationalizing your compliance program. 3. Determining third-party management program ROI can help to tear down compliance siloes. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 20 Apr 2023 04:00:00 -0000 ROI for 3rd Parties Risk Management full Thomas Fox Today we look at the ROI for 3rd Parties risk management. A study by Forrester Research Inc. compared the user experience which lead to a finding of a positive ROI for the technology user around third-party risk management. I found the approach and methodology used persuasive and valuable for the compliance professional to consider in evaluating such a process in your organization. Some of the key findings readily translate across for the compliance practitioner. The first area was in risk assessments of third parties. If you provide a technological platform, you can enhance both the speed and efficiency of your risk assessments on an ongoing basis. This decrease in time, both in terms of length and man-hours, will yield an immediate cost saving for your compliance function. There are a wide variety of other factors that could increase your ROI, as detailed in the Forrester report, which include renewal assessments, ongoing monitoring, increase in business efficiencies for both your organization and the third parties, which would all work to increase ROI. Most critically, you would demonstrate the operationalization of your compliance program into the very fabric of your organization.  Three key takeaways: 1. Why is it important to demonstrate ROI on your third-party risk management program? 2. Determining ROI helps to demonstrate operationalizing your compliance program. 3. Determining third-party management program ROI can help to tear down compliance siloes. Learn more about your ad choices. Visit megaphone.fm/adchoices A study by Forrester Research Inc. compared the user experience which lead to a finding of a positive ROI for the technology user around third-party risk management. I found the approach and methodology used persuasive and valuable for the compliance professional to consider in evaluating such a process in your organization. Some of the key findings readily translate across for the compliance practitioner. The first area was in risk assessments of third parties. If you provide a technological platform, you can enhance both the speed and efficiency of your risk assessments on an ongoing basis. This decrease in time, both in terms of length and man-hours, will yield an immediate cost saving for your compliance function.

There are a wide variety of other factors that could increase your ROI, as detailed in the Forrester report, which include renewal assessments, ongoing monitoring, increase in business efficiencies for both your organization and the third parties, which would all work to increase ROI. Most critically, you would demonstrate the operationalization of your compliance program into the very fabric of your organization.

 Three key takeaways:

1. Why is it important to demonstrate ROI on your third-party risk management program?

2. Determining ROI helps to demonstrate operationalizing your compliance program.

3. Determining third-party management program ROI can help to tear down compliance siloes.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 551 no One Month to a More Effective Compliance Program for 3rd Parties-Ongoing Monitoring of 3rd Parties One of the key themes in the Evaluation of Corporate Compliance Programs is the use of data and data analytics in a best practices compliance program. This has specific application to third-parties. In the section entitled, Risk-Tailored Resource Allocation, the following question was posed, Does the company devote a disproportionate amount of time to policing low-risk areas instead of high-risk areas, such as questionable payments to third-party consultants, suspicious trading activity, or excessive discounts to resellers and distributors? Under the section entitled, Control Testing, the following question was posed, Has the company reviewed and audited its compliance program in the area relating to the misconduct? More generally, what testing of controls, collection and analysis of compliance data, and interviews of employees and third parties does the company undertake? Finally, under the section entitled, Payment Systems was the following query, How was the misconduct in question funded (e.g., purchase orders, employee reimbursements, discounts, petty cash)? What processes could have prevented or detected improper access to these funds? Have those processes been improved?  All of these questions make clear that the DOJ expects data analytics to be used to help detect or prevent bribery and corruption where the primary sales force used by a company is third-parties. A clear majority of FCPA violations and related enforcement actions have come from the use of third-parties. While sham contracting (i.e., using a third-party to channel the payment of a bribe) has lessened in recent years, there are related data analysis that can be performed to ascertain whether a third-party is likely performing legitimate services for your company and is not a sham. There are several more complex analytics that can be run in combination to identify suspicious third-parties, and some of the simplest can be to look for duplicate or erroneous payments. This final concept of finding patterns that can be discerned through the aggregation of huge amounts of transactions, is the next step for compliance functions. Yet data analysis does far more than simply allowing you to follow the money. It can be a part of your third-party ongoing monitoring as well by allowing you to partner the information on third-parties who might come into your company where there was no proper compliance vetting. Such capabilities are clearly where you need to be heading. Three key takeaways: Always remember to follow the money to see where a pot of money could be created to fund a bribe. Transaction monitoring techniques around fraud monitoring translate to data analysis for compliance. Do not forget to check names against known PEP and SDN lists. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 19 Apr 2023 04:00:00 -0000 Ongoing Monitoring of 3rd Parties full Thomas Fox Today, we consider the ongoing Monitoring of 3rd Parties. One of the key themes in the Evaluation of Corporate Compliance Programs is the use of data and data analytics in a best practices compliance program. This has specific application to third-parties. In the section entitled, Risk-Tailored Resource Allocation, the following question was posed, Does the company devote a disproportionate amount of time to policing low-risk areas instead of high-risk areas, such as questionable payments to third-party consultants, suspicious trading activity, or excessive discounts to resellers and distributors? Under the section entitled, Control Testing, the following question was posed, Has the company reviewed and audited its compliance program in the area relating to the misconduct? More generally, what testing of controls, collection and analysis of compliance data, and interviews of employees and third parties does the company undertake? Finally, under the section entitled, Payment Systems was the following query, How was the misconduct in question funded (e.g., purchase orders, employee reimbursements, discounts, petty cash)? What processes could have prevented or detected improper access to these funds? Have those processes been improved?  All of these questions make clear that the DOJ expects data analytics to be used to help detect or prevent bribery and corruption where the primary sales force used by a company is third-parties. A clear majority of FCPA violations and related enforcement actions have come from the use of third-parties. While sham contracting (i.e., using a third-party to channel the payment of a bribe) has lessened in recent years, there are related data analysis that can be performed to ascertain whether a third-party is likely performing legitimate services for your company and is not a sham. There are several more complex analytics that can be run in combination to identify suspicious third-parties, and some of the simplest can be to look for duplicate or erroneous payments. This final concept of finding patterns that can be discerned through the aggregation of huge amounts of transactions, is the next step for compliance functions. Yet data analysis does far more than simply allowing you to follow the money. It can be a part of your third-party ongoing monitoring as well by allowing you to partner the information on third-parties who might come into your company where there was no proper compliance vetting. Such capabilities are clearly where you need to be heading. Three key takeaways: Always remember to follow the money to see where a pot of money could be created to fund a bribe. Transaction monitoring techniques around fraud monitoring translate to data analysis for compliance. Do not forget to check names against known PEP and SDN lists. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the key themes in the Evaluation of Corporate Compliance Programs is the use of data and data analytics in a best practices compliance program. This has specific application to third-parties. In the section entitled, Risk-Tailored Resource Allocation, the following question was posed, Does the company devote a disproportionate amount of time to policing low-risk areas instead of high-risk areas, such as questionable payments to third-party consultants, suspicious trading activity, or excessive discounts to resellers and distributors? Under the section entitled, Control Testing, the following question was posed, Has the company reviewed and audited its compliance program in the area relating to the misconduct? More generally, what testing of controls, collection and analysis of compliance data, and interviews of employees and third parties does the company undertake? Finally, under the section entitled, Payment Systems was the following query, How was the misconduct in question funded (e.g., purchase orders, employee reimbursements, discounts, petty cash)? What processes could have prevented or detected improper access to these funds? Have those processes been improved?

 All of these questions make clear that the DOJ expects data analytics to be used to help detect or prevent bribery and corruption where the primary sales force used by a company is third-parties. A clear majority of FCPA violations and related enforcement actions have come from the use of third-parties. While sham contracting (i.e., using a third-party to channel the payment of a bribe) has lessened in recent years, there are related data analysis that can be performed to ascertain whether a third-party is likely performing legitimate services for your company and is not a sham. There are several more complex analytics that can be run in combination to identify suspicious third-parties, and some of the simplest can be to look for duplicate or erroneous payments. This final concept of finding patterns that can be discerned through the aggregation of huge amounts of transactions, is the next step for compliance functions. Yet data analysis does far more than simply allowing you to follow the money. It can be a part of your third-party ongoing monitoring as well by allowing you to partner the information on third-parties who might come into your company where there was no proper compliance vetting. Such capabilities are clearly where you need to be heading.

Three key takeaways:

  1. Always remember to follow the money to see where a pot of money could be created to fund a bribe.
  2. Transaction monitoring techniques around fraud monitoring translate to data analysis for compliance.
  3. Do not forget to check names against known PEP and SDN lists.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 483 One Month to a More Effective Compliance Program for 3rd Parties-Auditing 3rd Parties Auditing of third parties is critical to any best practices compliance program and an important tool in operationalizing your compliance program. This is a key manner in which a company can manage the third-party relationship after the contract is signed and one which the government will expect you to engage in going forward. As stated in the 2020 Update, under the section entitled, Management of Relationships, is the following query: Does the company have audit rights to analyze the books and accounts of third parties, and has the company exercised those rights in the past? This means you must not only have audit rights but also exercise them.  Three key takeaways: 1. Be prepared. 2. It is not an investigative interview but an audit interview. 3. Listen, listen, and listen. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 18 Apr 2023 04:00:00 -0000 Auditing 3rd Parties full Thomas Fox Today, we consider the Auditing of 3rd Parties. Auditing of third parties is critical to any best practices compliance program and an important tool in operationalizing your compliance program. This is a key manner in which a company can manage the third-party relationship after the contract is signed and one which the government will expect you to engage in going forward. As stated in the 2020 Update, under the section entitled, Management of Relationships, is the following query: Does the company have audit rights to analyze the books and accounts of third parties, and has the company exercised those rights in the past? This means you must not only have audit rights but also exercise them.  Three key takeaways: 1. Be prepared. 2. It is not an investigative interview but an audit interview. 3. Listen, listen, and listen. Learn more about your ad choices. Visit megaphone.fm/adchoices Auditing of third parties is critical to any best practices compliance program and an important tool in operationalizing your compliance program. This is a key manner in which a company can manage the third-party relationship after the contract is signed and one which the government will expect you to engage in going forward. As stated in the 2020 Update, under the section entitled, Management of Relationships, is the following query: Does the company have audit rights to analyze the books and accounts of third parties, and has the company exercised those rights in the past? This means you must not only have audit rights but also exercise them.

 Three key takeaways:

1. Be prepared.

2. It is not an investigative interview but an audit interview.

3. Listen, listen, and listen.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 501 no One Month to a More Effective Compliance Program for 3rd Parties-Managing 3rd Party After the Contract is Signed The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the life cycle management of third parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation, and contract compliance terms and conditions. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also where the rubber meets the road of operationalizing compliance. It is also an area the DOJ specifically articulated in the 2020 Update that companies need to consider. Managing your third parties is where the rubber meets the road in your overall third-party risk management program. You must execute this task. Even if you successfully navigate the first four steps in your third-party risk management program, those are in reality the easy steps. Managing the relationship is where the real work begins. Three key takeaways: Have a strategic approach to third-party risk management. Rank third parties based on a variety of factors including compliance and business performance, length of the relationship, benchmarking metrics, and KPIs for ongoing monitoring and auditing. Managing the relationship is where the real work begins. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 17 Apr 2023 04:00:00 -0000 Managing 3rd Party After the Contract is Signed full Thomas Fox Today, we consider best practices in Managing 3rd Parties After the Contract is Signed. The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the life cycle management of third parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation, and contract compliance terms and conditions. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also where the rubber meets the road of operationalizing compliance. It is also an area the DOJ specifically articulated in the 2020 Update that companies need to consider. Managing your third parties is where the rubber meets the road in your overall third-party risk management program. You must execute this task. Even if you successfully navigate the first four steps in your third-party risk management program, those are in reality the easy steps. Managing the relationship is where the real work begins. Three key takeaways: Have a strategic approach to third-party risk management. Rank third parties based on a variety of factors including compliance and business performance, length of the relationship, benchmarking metrics, and KPIs for ongoing monitoring and auditing. Managing the relationship is where the real work begins. Learn more about your ad choices. Visit megaphone.fm/adchoices The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the life cycle management of third parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation, and contract compliance terms and conditions. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also where the rubber meets the road of operationalizing compliance. It is also an area the DOJ specifically articulated in the 2020 Update that companies need to consider.

Managing your third parties is where the rubber meets the road in your overall third-party risk management program. You must execute this task. Even if you successfully navigate the first four steps in your third-party risk management program, those are in reality the easy steps. Managing the relationship is where the real work begins.

Three key takeaways:

  1. Have a strategic approach to third-party risk management.
  2. Rank third parties based on a variety of factors including compliance and business performance, length of the relationship, benchmarking metrics, and KPIs for ongoing monitoring and auditing.
  3. Managing the relationship is where the real work begins.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 501 no One Month to a More Effective Compliance Program for 3rd Parties-DOJ Metrics on Third Parties In a 2015 speech before the SIFMA Compliance and Legal Society New York Regional Seminar, former Assistant Attorney General Leslie Caldwell for the first time, laid out metrics the DOJ would consider in evaluating a corporate compliance program around third parties. Caldwell began with the following question, “Does the institution sensitize third parties like vendors, agents or consultants to the company’s expectation that its partners are also serious about compliance?” This inquiry was brought forward into the DOJ’s 2017 Evaluation and all subsequent updates, including the most recent.  Three key takeaways: 1. It all starts with a Relationship Manager. 2. Have company oversight of all third parties. 3. Audit, monitor, and remediate on an ongoing basis. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 14 Apr 2023 04:00:00 -0000 DOJ Metrics on Third Parties full Thomas Fox In this episode, we consider DOJ metrics on 3rd parties. In a 2015 speech before the SIFMA Compliance and Legal Society New York Regional Seminar, former Assistant Attorney General Leslie Caldwell for the first time, laid out metrics the DOJ would consider in evaluating a corporate compliance program around third parties. Caldwell began with the following question, “Does the institution sensitize third parties like vendors, agents or consultants to the company’s expectation that its partners are also serious about compliance?” This inquiry was brought forward into the DOJ’s 2017 Evaluation and all subsequent updates, including the most recent.  Three key takeaways: 1. It all starts with a Relationship Manager. 2. Have company oversight of all third parties. 3. Audit, monitor, and remediate on an ongoing basis. Learn more about your ad choices. Visit megaphone.fm/adchoices In a 2015 speech before the SIFMA Compliance and Legal Society New York Regional Seminar, former Assistant Attorney General Leslie Caldwell for the first time, laid out metrics the DOJ would consider in evaluating a corporate compliance program around third parties. Caldwell began with the following question, “Does the institution sensitize third parties like vendors, agents or consultants to the company’s expectation that its partners are also serious about compliance?” This inquiry was brought forward into the DOJ’s 2017 Evaluation and all subsequent updates, including the most recent.

 Three key takeaways:

1. It all starts with a Relationship Manager.

2. Have company oversight of all third parties.

3. Audit, monitor, and remediate on an ongoing basis.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 502 no One Month to a More Effective Compliance Program for 3rd Parties-The How Question in Due Diligence What is satisfactory due diligence under the FCPA? That question seems to be more important after the story on Unaoil S.A.M. and the subsequent release of the Panama and Paradise Papers. However, both events largely focused on the “who” part of due diligence and the need to know with whom you are doing business with going forward. However, there is another important question which does not come up as often in due diligence, which is how? How does a third party perform its services with or for your company? If it is on the sales side of things, how can a third party help you make sales? If a third party comes through the supply chain, how do their products or services meet the needs of your company? If the third party has a closer business relationship, such as a JV, teaming agreement or other similar arrangement, you may well need a much deeper understand of how this third party does business because the relationship may well become so close you will be intertwined with the party. It may mean more than simply how does their product work but how does this third party conduct themselves and their business?  Three key takeaways: 1. The how question can be as critical as the who question. 2. The more integrated a third party is into your operations the more important this question becomes. 3. Incorporate a how question into not only your due diligence but also your ongoing monitoring and auditing, after the contract is signed. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 13 Apr 2023 04:00:00 -0000 The How Question in Due Diligence full Thomas Fox Today we take up the How Questions in Due Diligence. What is satisfactory due diligence under the FCPA? That question seems to be more important after the story on Unaoil S.A.M. and the subsequent release of the Panama and Paradise Papers. However, both events largely focused on the “who” part of due diligence and the need to know with whom you are doing business with going forward. However, there is another important question which does not come up as often in due diligence, which is how? How does a third party perform its services with or for your company? If it is on the sales side of things, how can a third party help you make sales? If a third party comes through the supply chain, how do their products or services meet the needs of your company? If the third party has a closer business relationship, such as a JV, teaming agreement or other similar arrangement, you may well need a much deeper understand of how this third party does business because the relationship may well become so close you will be intertwined with the party. It may mean more than simply how does their product work but how does this third party conduct themselves and their business?  Three key takeaways: 1. The how question can be as critical as the who question. 2. The more integrated a third party is into your operations the more important this question becomes. 3. Incorporate a how question into not only your due diligence but also your ongoing monitoring and auditing, after the contract is signed. Learn more about your ad choices. Visit megaphone.fm/adchoices What is satisfactory due diligence under the FCPA? That question seems to be more important after the story on Unaoil S.A.M. and the subsequent release of the Panama and Paradise Papers. However, both events largely focused on the “who” part of due diligence and the need to know with whom you are doing business with going forward. However, there is another important question which does not come up as often in due diligence, which is how?

How does a third party perform its services with or for your company? If it is on the sales side of things, how can a third party help you make sales? If a third party comes through the supply chain, how do their products or services meet the needs of your company? If the third party has a closer business relationship, such as a JV, teaming agreement or other similar arrangement, you may well need a much deeper understand of how this third party does business because the relationship may well become so close you will be intertwined with the party. It may mean more than simply how does their product work but how does this third party conduct themselves and their business?

 Three key takeaways:

1. The how question can be as critical as the who question.

2. The more integrated a third party is into your operations the more important this question becomes.

3. Incorporate a how question into not only your due diligence but also your ongoing monitoring and auditing, after the contract is signed.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 502 no One Month to a More Effective Compliance Program for 3rd Parties-3rd Party Compliance Terms and Conditions The 2020 Resource Guide stated, “In addition to considering a company’s due diligence on third parties, DOJ and SEC also assess whether the company has informed third parties of the company’s compliance program and commitment to ethical and lawful business practices and, where appropriate, whether it has sought assurances from third parties, through certifications and otherwise, of reciprocal commitments. These can be meaningful ways to mitigate third-party risk.” You should incorporate appropriate compliance terms and conditions into every contract with third parties. I would suggest that you prepare a template, which can be used as a starting point for your negotiations. The advantages of such a template are several, and they include: (1) the contract language is tested against real events; (2) the contract language assists the company in managing its compliance risks; (3) the contract language fits into a series of related contracts; (4) the contract language is straight-forward to administer; and (5) the contract language helps to manage the expectations of both contracting parties regarding anti-bribery and anti-corruption. Many do not believe they will get the third party to agree to such compliance terms and conditions. I have found that while it may not be easy, it is relatively simple to get a third party to agree to these or similar terms and conditions. One approach to take is that they are not negotiable. When faced with such a position on non-commercial terms, many third parties will not fight such a position. There is some flexibility, but the DOJ will require minimum compliance terms and conditions. But the best position I have found is that if a third party agrees with these terms and conditions, they can use that as a market differentiator.  Three key takeaways: Compliance terms and conditions are mandatory for any best practices compliance program. A key clause is a right-to-audit clause. Third parties can favor robust compliance terms and conditions as a market differentiator. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 12 Apr 2023 11:52:17 -0000 One Month to a More Effective Compliance Program for 3rd Parties-3rd Party Compliance Terms and Conditions full Thomas Fox Today, we consider compliance terms and conditions for 3rd parties. The 2020 Resource Guide stated, “In addition to considering a company’s due diligence on third parties, DOJ and SEC also assess whether the company has informed third parties of the company’s compliance program and commitment to ethical and lawful business practices and, where appropriate, whether it has sought assurances from third parties, through certifications and otherwise, of reciprocal commitments. These can be meaningful ways to mitigate third-party risk.” You should incorporate appropriate compliance terms and conditions into every contract with third parties. I would suggest that you prepare a template, which can be used as a starting point for your negotiations. The advantages of such a template are several, and they include: (1) the contract language is tested against real events; (2) the contract language assists the company in managing its compliance risks; (3) the contract language fits into a series of related contracts; (4) the contract language is straight-forward to administer; and (5) the contract language helps to manage the expectations of both contracting parties regarding anti-bribery and anti-corruption. Many do not believe they will get the third party to agree to such compliance terms and conditions. I have found that while it may not be easy, it is relatively simple to get a third party to agree to these or similar terms and conditions. One approach to take is that they are not negotiable. When faced with such a position on non-commercial terms, many third parties will not fight such a position. There is some flexibility, but the DOJ will require minimum compliance terms and conditions. But the best position I have found is that if a third party agrees with these terms and conditions, they can use that as a market differentiator.  Three key takeaways: Compliance terms and conditions are mandatory for any best practices compliance program. A key clause is a right-to-audit clause. Third parties can favor robust compliance terms and conditions as a market differentiator. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2020 Resource Guide stated, “In addition to considering a company’s due diligence on third parties, DOJ and SEC also assess whether the company has informed third parties of the company’s compliance program and commitment to ethical and lawful business practices and, where appropriate, whether it has sought assurances from third parties, through certifications and otherwise, of reciprocal commitments. These can be meaningful ways to mitigate third-party risk.”

You should incorporate appropriate compliance terms and conditions into every contract with third parties. I would suggest that you prepare a template, which can be used as a starting point for your negotiations. The advantages of such a template are several, and they include: (1) the contract language is tested against real events; (2) the contract language assists the company in managing its compliance risks; (3) the contract language fits into a series of related contracts; (4) the contract language is straight-forward to administer; and (5) the contract language helps to manage the expectations of both contracting parties regarding anti-bribery and anti-corruption.

Many do not believe they will get the third party to agree to such compliance terms and conditions. I have found that while it may not be easy, it is relatively simple to get a third party to agree to these or similar terms and conditions. One approach to take is that they are not negotiable. When faced with such a position on non-commercial terms, many third parties will not fight such a position. There is some flexibility, but the DOJ will require minimum compliance terms and conditions. But the best position I have found is that if a third party agrees with these terms and conditions, they can use that as a market differentiator. 

Three key takeaways:

  1. Compliance terms and conditions are mandatory for any best practices compliance program.
  2. A key clause is a right-to-audit clause.
  3. Third parties can favor robust compliance terms and conditions as a market differentiator.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 496 no One Month to a More Effective Compliance Program for 3rd Parties-Evaluation of Due Diligence With Candice Tal An important part of the job duties of any compliance practitioner is clearing red flags which might appear for a proposed third-party relationship during the due diligence process. It is mandatory that not only must all red flags be cleared but there also be evidence of the decision-making process to show to a regulator if one comes knocking. Around third-parties, consider what risks you face in both your sales and supply chain. If there is a key player several tiers down the line who creates or builds a key component or delivers a critical service, you may want to put more management around that relationship from the compliance perspective. For anything below a tier 2; you may be able to manage your risks through having your direct tier one counter-party take the lead in managing such compliance risks. But make sure that the expectation is communicated to your direct counter-party so that if the government comes knocking you can show that not only did you contractually obligate your direct counter-party to do so but that you provided them the tools and training to do so. Finally, you will need to be able to show that your direct counter-party did so. Three key takeaways: There is no set formula for clearing of red flags or the evaluation of due diligence. Know when to say enough has been done. You must “Document, Document, and Document” your evaluation of any red flags. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 11 Apr 2023 04:00:00 -0000 Evaluation of Due Diligence With Candice Tal full Thomas Fox Today, Candice Tal returns to discuss the evaluation of due diligence. An important part of the job duties of any compliance practitioner is clearing red flags which might appear for a proposed third-party relationship during the due diligence process. It is mandatory that not only must all red flags be cleared but there also be evidence of the decision-making process to show to a regulator if one comes knocking. Around third-parties, consider what risks you face in both your sales and supply chain. If there is a key player several tiers down the line who creates or builds a key component or delivers a critical service, you may want to put more management around that relationship from the compliance perspective. For anything below a tier 2; you may be able to manage your risks through having your direct tier one counter-party take the lead in managing such compliance risks. But make sure that the expectation is communicated to your direct counter-party so that if the government comes knocking you can show that not only did you contractually obligate your direct counter-party to do so but that you provided them the tools and training to do so. Finally, you will need to be able to show that your direct counter-party did so. Three key takeaways: There is no set formula for clearing of red flags or the evaluation of due diligence. Know when to say enough has been done. You must “Document, Document, and Document” your evaluation of any red flags. Learn more about your ad choices. Visit megaphone.fm/adchoices An important part of the job duties of any compliance practitioner is clearing red flags which might appear for a proposed third-party relationship during the due diligence process. It is mandatory that not only must all red flags be cleared but there also be evidence of the decision-making process to show to a regulator if one comes knocking. Around third-parties, consider what risks you face in both your sales and supply chain. If there is a key player several tiers down the line who creates or builds a key component or delivers a critical service, you may want to put more management around that relationship from the compliance perspective. For anything below a tier 2; you may be able to manage your risks through having your direct tier one counter-party take the lead in managing such compliance risks. But make sure that the expectation is communicated to your direct counter-party so that if the government comes knocking you can show that not only did you contractually obligate your direct counter-party to do so but that you provided them the tools and training to do so. Finally, you will need to be able to show that your direct counter-party did so.

Three key takeaways:

  1. There is no set formula for clearing of red flags or the evaluation of due diligence.
  2. Know when to say enough has been done.
  3. You must “Document, Document, and Document” your evaluation of any red flags.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 486 no One Month to a More Effective Compliance Program for 3rd Parties-Levels of Due Diligence With Candice Tal Today, I am joined by Candice Tal, founder of Infortal to explain the 3 levels of due diligence. Due diligence is generally recognized in Level I, Level II, and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward. The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward. There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions of your program. The Level I, II, and III trichotomy appear to have the greatest favor and one that you should be able to implement straightforwardly. But the key is to assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence. Three key takeaways: Level I due diligence should only be used where there is a low risk of corruption. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared. Level III due diligence is deep dive, boots-on-the-ground investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 10 Apr 2023 04:00:00 -0000 Levels of Due Diligence With Candice Tal full Thomas Fox Today, I am joined by Candice Tal to explore levels of due diligence. Today, I am joined by Candice Tal, founder of Infortal to explain the 3 levels of due diligence. Due diligence is generally recognized in Level I, Level II, and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward. The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward. There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions of your program. The Level I, II, and III trichotomy appear to have the greatest favor and one that you should be able to implement straightforwardly. But the key is to assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence. Three key takeaways: Level I due diligence should only be used where there is a low risk of corruption. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared. Level III due diligence is deep dive, boots-on-the-ground investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Today, I am joined by Candice Tal, founder of Infortal to explain the 3 levels of due diligence. Due diligence is generally recognized in Level I, Level II, and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward.

The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward.

There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions of your program. The Level I, II, and III trichotomy appear to have the greatest favor and one that you should be able to implement straightforwardly. But the key is to assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence.

Three key takeaways:

  1. Level I due diligence should only be used where there is a low risk of corruption.
  2. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared.
  3. Level III due diligence is deep dive, boots-on-the-ground investigation.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 no One Month to a More Effective Compliance Program for 3rd Parties-Due Diligence Most companies fully understand the need to comply with the requirements around third parties as they represent the greatest risks for bribery and corruption. However, most companies are not created out of new cloth but are ongoing enterprises with a fully up-and-running business in place. This means they may need to bring resources to bear to do so while continuing operating an ongoing business. This can be particularly true in the area of performing due diligence on third parties. Many companies understand the need for a robust due diligence program to investigate third parties but have struggled with how to create an inventory to define the basis of third-party risk and, thereby, perform the requisite due diligence required. It is stated in the 2023 ECCP that: “Risk-Based and Integrated Processes—How has the management of the company’s third-party process corresponded to the nature and level of the enterprise risk identified by the company? How has this process been integrated into the relevant procurement and vendor management processes?” Getting your arms around due diligence can sometimes seem bewildering for the compliance practitioner. The information that you gathered in Steps 1-Business Justification and 2-Questionnaire of the third-party management process should provide you with the initial information to consider the level of due diligence needed. This leads to Step 3 of the third-party management process: due diligence. The 2020 Resource Guide stated, “as part of risk-based due diligence, companies should understand the qualifications and associations of its third-party partners, including its business reputation, and relationship, if any, with foreign officials. The degree of scrutiny should increase as red flags surface.”  Three key takeaways: 1. Risk rank your third parties and use this as a basis to begin with an adequate level of due diligence. 2. Any red flags which appear must be cleared and there must be documented evidence of such clearance. 3. There must be documented evidence of review of the due diligence. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 07 Apr 2023 04:00:00 -0000 Due Diligence full Thomas Fox Today, we introduce the topic of due diligence. Most companies fully understand the need to comply with the requirements around third parties as they represent the greatest risks for bribery and corruption. However, most companies are not created out of new cloth but are ongoing enterprises with a fully up-and-running business in place. This means they may need to bring resources to bear to do so while continuing operating an ongoing business. This can be particularly true in the area of performing due diligence on third parties. Many companies understand the need for a robust due diligence program to investigate third parties but have struggled with how to create an inventory to define the basis of third-party risk and, thereby, perform the requisite due diligence required. It is stated in the 2023 ECCP that: “Risk-Based and Integrated Processes—How has the management of the company’s third-party process corresponded to the nature and level of the enterprise risk identified by the company? How has this process been integrated into the relevant procurement and vendor management processes?” Getting your arms around due diligence can sometimes seem bewildering for the compliance practitioner. The information that you gathered in Steps 1-Business Justification and 2-Questionnaire of the third-party management process should provide you with the initial information to consider the level of due diligence needed. This leads to Step 3 of the third-party management process: due diligence. The 2020 Resource Guide stated, “as part of risk-based due diligence, companies should understand the qualifications and associations of its third-party partners, including its business reputation, and relationship, if any, with foreign officials. The degree of scrutiny should increase as red flags surface.”  Three key takeaways: 1. Risk rank your third parties and use this as a basis to begin with an adequate level of due diligence. 2. Any red flags which appear must be cleared and there must be documented evidence of such clearance. 3. There must be documented evidence of review of the due diligence. Learn more about your ad choices. Visit megaphone.fm/adchoices Most companies fully understand the need to comply with the requirements around third parties as they represent the greatest risks for bribery and corruption. However, most companies are not created out of new cloth but are ongoing enterprises with a fully up-and-running business in place. This means they may need to bring resources to bear to do so while continuing operating an ongoing business. This can be particularly true in the area of performing due diligence on third parties. Many companies understand the need for a robust due diligence program to investigate third parties but have struggled with how to create an inventory to define the basis of third-party risk and, thereby, perform the requisite due diligence required.

It is stated in the 2023 ECCP that: “Risk-Based and Integrated Processes—How has the management of the company’s third-party process corresponded to the nature and level of the enterprise risk identified by the company? How has this process been integrated into the relevant procurement and vendor management processes?”

Getting your arms around due diligence can sometimes seem bewildering for the compliance practitioner. The information that you gathered in Steps 1-Business Justification and 2-Questionnaire of the third-party management process should provide you with the initial information to consider the level of due diligence needed. This leads to Step 3 of the third-party management process: due diligence. The 2020 Resource Guide stated, “as part of risk-based due diligence, companies should understand the qualifications and associations of its third-party partners, including its business reputation, and relationship, if any, with foreign officials. The degree of scrutiny should increase as red flags surface.”

 Three key takeaways:

1. Risk rank your third parties and use this as a basis to begin with an adequate level of due diligence.

2. Any red flags which appear must be cleared and there must be documented evidence of such clearance.

3. There must be documented evidence of review of the due diligence.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 481 One Month to a More Effective Compliance Program for 3rd Parties-Questionnaire The next step in the five-step process is the questionnaire. The term ‘questionnaire’ is mentioned several times in the 2020 FCPA Resource Guide. It is generally recognized as one of the tools that a company should complete in its investigation to better understand with whom it is doing business. The questionnaire should be mandatory step for any third-party that desires to work with your company as it mandates the proposed business partner, commit to certain required information in writing prior to beginning the due diligence process. Remember if a third-party does not want to fill out the questionnaire or will not fill it out completely you should not walk but run away from doing business with such a party. One of the key requirements of any successful compliance program is that a company must make an initial assessment of a proposed third-party. The size of a company does not matter as small businesses can face quite significant risks and will need more extensive procedures than other businesses facing limited risks. The level of risk that companies face will also vary with the type and nature of the third-parties with which it may have business relationships. For example, a company that properly assesses that there is no risk of bribery on the part of one group of its third-parties will require nothing in the way of procedures to prevent bribery in the context of those relationships. By the same token the bribery risks associated with reliance on a third-party agent representing a company in negotiations with foreign government officials may be assessed as significant and, accordingly, requires much more in the way of procedures to mitigate those risks. The questionnaire fills several key roles in your overall management of third-parties. Obviously, it provides key information that you need to know about who you are doing business with and whether they have the capabilities to fulfill your commercial needs. Just as important is what is said if the questionnaire is not completed or is only partially completed, such as the lack of awareness of the FCPA, U.K. Bribery Act or anti-corruption/anti-bribery programs generally. Lastly, the information provided (or not provided) in the questionnaire will assist you in determining what level of due diligence to perform. Three key takeaways: You must have enough information to fully identify the owners, UBOs and related parties to determine if there is foreign official involvement. All commentary on best practices compliance programs requires questionnaires. If a third-party refuses to fully respond to your questionnaire, run, don’t walk away from the proposed relationship. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 06 Apr 2023 04:00:00 -0000 Questionnaire full Thomas Fox Today we consider the Questionnaire. The next step in the five-step process is the questionnaire. The term ‘questionnaire’ is mentioned several times in the 2020 FCPA Resource Guide. It is generally recognized as one of the tools that a company should complete in its investigation to better understand with whom it is doing business. The questionnaire should be mandatory step for any third-party that desires to work with your company as it mandates the proposed business partner, commit to certain required information in writing prior to beginning the due diligence process. Remember if a third-party does not want to fill out the questionnaire or will not fill it out completely you should not walk but run away from doing business with such a party. One of the key requirements of any successful compliance program is that a company must make an initial assessment of a proposed third-party. The size of a company does not matter as small businesses can face quite significant risks and will need more extensive procedures than other businesses facing limited risks. The level of risk that companies face will also vary with the type and nature of the third-parties with which it may have business relationships. For example, a company that properly assesses that there is no risk of bribery on the part of one group of its third-parties will require nothing in the way of procedures to prevent bribery in the context of those relationships. By the same token the bribery risks associated with reliance on a third-party agent representing a company in negotiations with foreign government officials may be assessed as significant and, accordingly, requires much more in the way of procedures to mitigate those risks. The questionnaire fills several key roles in your overall management of third-parties. Obviously, it provides key information that you need to know about who you are doing business with and whether they have the capabilities to fulfill your commercial needs. Just as important is what is said if the questionnaire is not completed or is only partially completed, such as the lack of awareness of the FCPA, U.K. Bribery Act or anti-corruption/anti-bribery programs generally. Lastly, the information provided (or not provided) in the questionnaire will assist you in determining what level of due diligence to perform. Three key takeaways: You must have enough information to fully identify the owners, UBOs and related parties to determine if there is foreign official involvement. All commentary on best practices compliance programs requires questionnaires. If a third-party refuses to fully respond to your questionnaire, run, don’t walk away from the proposed relationship. Learn more about your ad choices. Visit megaphone.fm/adchoices The next step in the five-step process is the questionnaire. The term ‘questionnaire’ is mentioned several times in the 2020 FCPA Resource Guide. It is generally recognized as one of the tools that a company should complete in its investigation to better understand with whom it is doing business. The questionnaire should be mandatory step for any third-party that desires to work with your company as it mandates the proposed business partner, commit to certain required information in writing prior to beginning the due diligence process. Remember if a third-party does not want to fill out the questionnaire or will not fill it out completely you should not walk but run away from doing business with such a party.

One of the key requirements of any successful compliance program is that a company must make an initial assessment of a proposed third-party. The size of a company does not matter as small businesses can face quite significant risks and will need more extensive procedures than other businesses facing limited risks. The level of risk that companies face will also vary with the type and nature of the third-parties with which it may have business relationships. For example, a company that properly assesses that there is no risk of bribery on the part of one group of its third-parties will require nothing in the way of procedures to prevent bribery in the context of those relationships. By the same token the bribery risks associated with reliance on a third-party agent representing a company in negotiations with foreign government officials may be assessed as significant and, accordingly, requires much more in the way of procedures to mitigate those risks.

The questionnaire fills several key roles in your overall management of third-parties. Obviously, it provides key information that you need to know about who you are doing business with and whether they have the capabilities to fulfill your commercial needs. Just as important is what is said if the questionnaire is not completed or is only partially completed, such as the lack of awareness of the FCPA, U.K. Bribery Act or anti-corruption/anti-bribery programs generally. Lastly, the information provided (or not provided) in the questionnaire will assist you in determining what level of due diligence to perform.

Three key takeaways:

  1. You must have enough information to fully identify the owners, UBOs and related parties to determine if there is foreign official involvement.
  2. All commentary on best practices compliance programs requires questionnaires.
  3. If a third-party refuses to fully respond to your questionnaire, run, don’t walk away from the proposed relationship.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 497 no One Month to a More Effective Compliance Program for 3rd Parties-Business Justification The 2023 Evaluation of Corporate Compliance Programs stated, “Prosecutors should also assess whether the company knows the business rationale for needing the third party in the transaction, and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials.” This standard articulates one of the most basic tools to operationalize your compliance program and should form the basis of your third-party risk management process. Indeed, this is viewed as an internal control with the 2023 ECCP going on to pose the following question, “How does the company ensure there is an appropriate business rationale for the use of third parties?” What should go into your business justification? At the most basic level, you should craft a document, which works for both you as the compliance practitioner and the business folks in your company, that details some basic concepts which includes the following: 1) The name and contact information for both the Relationship Manager and the proposed third party; 2) How the Relationship Manager came to know about the third party because it is a red flag if a customer or government representative points you towards a specific third party; 3) What services the third party will perform for your company, the length of time and compensation rate for the third party; and 4) An explanation of why this specific third party should be used as opposed to an existing or other third party, if such were considered. All this information should be documented and then signed by the Relationship Manager. Remember, the purpose of the business rationale is to document the satisfactoriness of the business case to retain a third party. The business rationale should be included in the compliance review file assembled on every third party at the time of initial certification and again if the third-party relationship is renewed. This means “Document, Document, and Document.”  Three key takeaways: 1. You should always have a business reason for using a third party which is articulated by the business folks, not compliance. 2. A Relationship Manager is the key going forward in operationalizing your compliance program through the life of the third-party relationship with your company. 3. Always remember to “Document, Document, and Document”. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 05 Apr 2023 04:00:00 -0000 Business Justification full Thomas Fox Today, we consider the business justification in the 3rd party risk management process. The 2023 Evaluation of Corporate Compliance Programs stated, “Prosecutors should also assess whether the company knows the business rationale for needing the third party in the transaction, and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials.” This standard articulates one of the most basic tools to operationalize your compliance program and should form the basis of your third-party risk management process. Indeed, this is viewed as an internal control with the 2023 ECCP going on to pose the following question, “How does the company ensure there is an appropriate business rationale for the use of third parties?” What should go into your business justification? At the most basic level, you should craft a document, which works for both you as the compliance practitioner and the business folks in your company, that details some basic concepts which includes the following: 1) The name and contact information for both the Relationship Manager and the proposed third party; 2) How the Relationship Manager came to know about the third party because it is a red flag if a customer or government representative points you towards a specific third party; 3) What services the third party will perform for your company, the length of time and compensation rate for the third party; and 4) An explanation of why this specific third party should be used as opposed to an existing or other third party, if such were considered. All this information should be documented and then signed by the Relationship Manager. Remember, the purpose of the business rationale is to document the satisfactoriness of the business case to retain a third party. The business rationale should be included in the compliance review file assembled on every third party at the time of initial certification and again if the third-party relationship is renewed. This means “Document, Document, and Document.”  Three key takeaways: 1. You should always have a business reason for using a third party which is articulated by the business folks, not compliance. 2. A Relationship Manager is the key going forward in operationalizing your compliance program through the life of the third-party relationship with your company. 3. Always remember to “Document, Document, and Document”. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2023 Evaluation of Corporate Compliance Programs stated, “Prosecutors should also assess whether the company knows the business rationale for needing the third party in the transaction, and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials.” This standard articulates one of the most basic tools to operationalize your compliance program and should form the basis of your third-party risk management process. Indeed, this is viewed as an internal control with the 2023 ECCP going on to pose the following question, “How does the company ensure there is an appropriate business rationale for the use of third parties?”

What should go into your business justification? At the most basic level, you should craft a document, which works for both you as the compliance practitioner and the business folks in your company, that details some basic concepts which includes the following: 1) The name and contact information for both the Relationship Manager and the proposed third party; 2) How the Relationship Manager came to know about the third party because it is a red flag if a customer or government representative points you towards a specific third party; 3) What services the third party will perform for your company, the length of time and compensation rate for the third party; and 4) An explanation of why this specific third party should be used as opposed to an existing or other third party, if such were considered. All this information should be documented and then signed by the Relationship Manager.

Remember, the purpose of the business rationale is to document the satisfactoriness of the business case to retain a third party. The business rationale should be included in the compliance review file assembled on every third party at the time of initial certification and again if the third-party relationship is renewed. This means “Document, Document, and Document.”

 Three key takeaways:

1. You should always have a business reason for using a third party which is articulated by the business folks, not compliance.

2. A Relationship Manager is the key going forward in operationalizing your compliance program through the life of the third-party relationship with your company.

3. Always remember to “Document, Document, and Document”.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 476 no One Month to a More Effective Compliance Program for 3rd Parties-3rd Party Risk Management Process As every compliance practitioner is well aware, third parties still present the highest risk under the FCPA. The 2020 Update devotes an entire prong to third-party management. It begins with the following:  Prosecutors should also assess whether the company knows the business rationale for needing the third party in the transaction and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials. For example, a prosecutor should analyze whether the company has ensured that contract terms with third parties specifically describe the services to be performed, that the third party is performing the work, and that its compensation is commensurate with the work provided in that industry and geographical region.   Prosecutors should further assess whether the company engaged in ongoing monitoring of the third-party relationships through updated due diligence, training, audits, and/or annual compliance certifications by the third party. This specifies that the DOJ expects an integrated approach operationalized throughout the company. This means you must have a process for the full life cycle of third-party risk management. Five steps in the life cycle of third-party risk management will fulfill the DOJ requirements as laid out in the 2020 FCPA Resource Guide and in the Hallmarks of an Effective Compliance Program. The five steps in the lifecycle of third-party management are: Business Justification by the Business Sponsor; Questionnaire to Third-party; Due Diligence on Third-party, including triage of results; Compliance Terms and Conditions, including payment terms; and Management and Oversight of Third Parties After Contract Signing. Three key takeaways: Use the full 5-step process for third-party management. Make sure you have business development involvement and buy-in. Operationalize all steps going forward by including business unit representatives. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 04 Apr 2023 13:08:14 -0000 3rd Party Risk Management Process full Thomas Fox Today we review the risk management process for 3rd parties. As every compliance practitioner is well aware, third parties still present the highest risk under the FCPA. The 2020 Update devotes an entire prong to third-party management. It begins with the following:  Prosecutors should also assess whether the company knows the business rationale for needing the third party in the transaction and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials. For example, a prosecutor should analyze whether the company has ensured that contract terms with third parties specifically describe the services to be performed, that the third party is performing the work, and that its compensation is commensurate with the work provided in that industry and geographical region.   Prosecutors should further assess whether the company engaged in ongoing monitoring of the third-party relationships through updated due diligence, training, audits, and/or annual compliance certifications by the third party. This specifies that the DOJ expects an integrated approach operationalized throughout the company. This means you must have a process for the full life cycle of third-party risk management. Five steps in the life cycle of third-party risk management will fulfill the DOJ requirements as laid out in the 2020 FCPA Resource Guide and in the Hallmarks of an Effective Compliance Program. The five steps in the lifecycle of third-party management are: Business Justification by the Business Sponsor; Questionnaire to Third-party; Due Diligence on Third-party, including triage of results; Compliance Terms and Conditions, including payment terms; and Management and Oversight of Third Parties After Contract Signing. Three key takeaways: Use the full 5-step process for third-party management. Make sure you have business development involvement and buy-in. Operationalize all steps going forward by including business unit representatives. Learn more about your ad choices. Visit megaphone.fm/adchoices As every compliance practitioner is well aware, third parties still present the highest risk under the FCPA. The 2020 Update devotes an entire prong to third-party management. It begins with the following:

 Prosecutors should also assess whether the company knows the business rationale for needing the third party in the transaction and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials. For example, a prosecutor should analyze whether the company has ensured that contract terms with third parties specifically describe the services to be performed, that the third party is performing the work, and that its compensation is commensurate with the work provided in that industry and geographical region.   Prosecutors should further assess whether the company engaged in ongoing monitoring of the third-party relationships through updated due diligence, training, audits, and/or annual compliance certifications by the third party.

This specifies that the DOJ expects an integrated approach operationalized throughout the company. This means you must have a process for the full life cycle of third-party risk management. Five steps in the life cycle of third-party risk management will fulfill the DOJ requirements as laid out in the 2020 FCPA Resource Guide and in the Hallmarks of an Effective Compliance Program. The five steps in the lifecycle of third-party management are:

  1. Business Justification by the Business Sponsor;
  2. Questionnaire to Third-party;
  3. Due Diligence on Third-party, including triage of results;
  4. Compliance Terms and Conditions, including payment terms; and
  5. Management and Oversight of Third Parties After Contract Signing.

Three key takeaways:

  1. Use the full 5-step process for third-party management.
  2. Make sure you have business development involvement and buy-in.
  3. Operationalize all steps going forward by including business unit representatives.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 420 no One Month to a More Effective Compliance Program for 3rd Parties-Introduction and Key 2022 Enforcement Actions Involving 3rd Parties Over the month of April, I will consider the risk management of third parties in an operationalized compliance program. As every compliance practitioner is aware, third parties still present the highest risk under the FCPA. You must assess whether the company has a business rationale for needing the third party in the transaction, and the risks posed by third parties, including their reputations and relationships, if any, with foreign government officials. You should ensure that contract terms with third parties specifically describe the services to be performed, the third party is actually performing the work, and that its compensation is commensurate with the work being provided in that industry and geographical region.   Finally, you must engage in ongoing monitoring of the third-party relationships, through updated due diligence, training, audits, and/or annual compliance certifications by the third party. In this introduction, I visit with Alexander Cotoia, a Regulatory and Compliance Attorney at the Volkov Law Group to consider how recent FCPA enforcement actions point toward the use cases for a robust third-party risk management system. In 2022, the overwhelming majority of FCPA-related enforcement actions involved third parties and required organizations to reprioritize third-party risk management. In this episode, we consider case studies involving ABB Limited, GOL Airlines, and Oracle which all demonstrated the importance of understanding bribery and corruption schemes, making voluntary disclosures, and reassessing third-party risk management. 3 Key Takeaways 1. How can organizations reprioritize third-party risk management as a core compliance function?  2. What strategies can organizations use to avoid FCPA violations and maximize cooperation credit?  3. How can organizations effectively assess the risks posed by potential business partners? Check out The Compliance Handbook, 3rd edition here Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 03 Apr 2023 04:00:00 -0000 Introduction and Key 2022 Enforcement Actions Involving 3rd Parties full Thomas Fox In April we consider 3rd risk management. We being by looking at key 2022 FCPA enforcement actions involving 3rd parties. Over the month of April, I will consider the risk management of third parties in an operationalized compliance program. As every compliance practitioner is aware, third parties still present the highest risk under the FCPA. You must assess whether the company has a business rationale for needing the third party in the transaction, and the risks posed by third parties, including their reputations and relationships, if any, with foreign government officials. You should ensure that contract terms with third parties specifically describe the services to be performed, the third party is actually performing the work, and that its compensation is commensurate with the work being provided in that industry and geographical region.   Finally, you must engage in ongoing monitoring of the third-party relationships, through updated due diligence, training, audits, and/or annual compliance certifications by the third party. In this introduction, I visit with Alexander Cotoia, a Regulatory and Compliance Attorney at the Volkov Law Group to consider how recent FCPA enforcement actions point toward the use cases for a robust third-party risk management system. In 2022, the overwhelming majority of FCPA-related enforcement actions involved third parties and required organizations to reprioritize third-party risk management. In this episode, we consider case studies involving ABB Limited, GOL Airlines, and Oracle which all demonstrated the importance of understanding bribery and corruption schemes, making voluntary disclosures, and reassessing third-party risk management. 3 Key Takeaways 1. How can organizations reprioritize third-party risk management as a core compliance function?  2. What strategies can organizations use to avoid FCPA violations and maximize cooperation credit?  3. How can organizations effectively assess the risks posed by potential business partners? Check out The Compliance Handbook, 3rd edition here Learn more about your ad choices. Visit megaphone.fm/adchoices Over the month of April, I will consider the risk management of third parties in an operationalized compliance program. As every compliance practitioner is aware, third parties still present the highest risk under the FCPA. You must assess whether the company has a business rationale for needing the third party in the transaction, and the risks posed by third parties, including their reputations and relationships, if any, with foreign government officials. You should ensure that contract terms with third parties specifically describe the services to be performed, the third party is actually performing the work, and that its compensation is commensurate with the work being provided in that industry and geographical region.   Finally, you must engage in ongoing monitoring of the third-party relationships, through updated due diligence, training, audits, and/or annual compliance certifications by the third party.

In this introduction, I visit with Alexander Cotoia, a Regulatory and Compliance Attorney at the Volkov Law Group to consider how recent FCPA enforcement actions point toward the use cases for a robust third-party risk management system. In 2022, the overwhelming majority of FCPA-related enforcement actions involved third parties and required organizations to reprioritize third-party risk management. In this episode, we consider case studies involving ABB Limited, GOL Airlines, and Oracle which all demonstrated the importance of understanding bribery and corruption schemes, making voluntary disclosures, and reassessing third-party risk management.

3 Key Takeaways

1. How can organizations reprioritize third-party risk management as a core compliance function? 

2. What strategies can organizations use to avoid FCPA violations and maximize cooperation credit? 

3. How can organizations effectively assess the risks posed by potential business partners?

Check out The Compliance Handbook, 3rd edition here

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 748 no One Month to a More Effective Compliance Program for Business Ventures-Why Business Ventures are Different than 3rd Parties Business ventures, whether JVs, partnerships, franchises, team agreements, strategic alliances or one of the myriad types of business relationships a U.S. company can form outside the U.S., are different than the usual risk presented by third-parties under compliance requirements such as those mandated by the FCPA. The problems for companies is that they tend to treat business venture risk the same as third-party risk. They are different and must be managed differently. The bottom line is that may compliance practitioners have not thought through the specific risks of business ventures such as JVs, franchises, strategic alliances, teaming partner or others as opposed to sales agents or representatives on the sales side of the business. I hope that this will help facilitate a discussion that maybe people will begin to think about more of the issues, more of the risk parameters and perhaps put a better risk management strategy in place. Three key takeaways:  Business ventures bring different FCPA risks from third-parties. JVs have both external compliance risks and corporate governance risks. Use your full compliance tool kit for business ventures in managing the FCPA risk for franchises. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 30 Mar 2023 04:00:00 -0000 Why Business Ventures are Different than 3rd Parties full Thomas Fox Why Business Ventures are Different than 3rd Parties? Find out in this month's final episode. Business ventures, whether JVs, partnerships, franchises, team agreements, strategic alliances or one of the myriad types of business relationships a U.S. company can form outside the U.S., are different than the usual risk presented by third-parties under compliance requirements such as those mandated by the FCPA. The problems for companies is that they tend to treat business venture risk the same as third-party risk. They are different and must be managed differently. The bottom line is that may compliance practitioners have not thought through the specific risks of business ventures such as JVs, franchises, strategic alliances, teaming partner or others as opposed to sales agents or representatives on the sales side of the business. I hope that this will help facilitate a discussion that maybe people will begin to think about more of the issues, more of the risk parameters and perhaps put a better risk management strategy in place. Three key takeaways:  Business ventures bring different FCPA risks from third-parties. JVs have both external compliance risks and corporate governance risks. Use your full compliance tool kit for business ventures in managing the FCPA risk for franchises. Learn more about your ad choices. Visit megaphone.fm/adchoices Business ventures, whether JVs, partnerships, franchises, team agreements, strategic alliances or one of the myriad types of business relationships a U.S. company can form outside the U.S., are different than the usual risk presented by third-parties under compliance requirements such as those mandated by the FCPA. The problems for companies is that they tend to treat business venture risk the same as third-party risk. They are different and must be managed differently.

The bottom line is that may compliance practitioners have not thought through the specific risks of business ventures such as JVs, franchises, strategic alliances, teaming partner or others as opposed to sales agents or representatives on the sales side of the business. I hope that this will help facilitate a discussion that maybe people will begin to think about more of the issues, more of the risk parameters and perhaps put a better risk management strategy in place.

Three key takeaways: 

  1. Business ventures bring different FCPA risks from third-parties.
  2. JVs have both external compliance risks and corporate governance risks.
  3. Use your full compliance tool kit for business ventures in managing the FCPA risk for franchises.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 869 no One Month to a More Effective Compliance Program for Business Ventures-Distributor Liability Under the FCPA Three enforcement actions which made clear that there were no distinctions between agents and distributors. They were the Smith & Nephew, Inc., Oracle (2012 and 2022) and Eli Lilly and Company. Each of these enforcement actions had different FCPA violations and they each revealed separate steps which a company should take to both prevent and detect FCPA violations in their company. These three separate bribery schemes call for three different but overlapping responses. The Lilly enforcement action also makes clear the need for internal audit to follow up with ongoing monitoring and auditing. Internal audit can be used to help determine the reasonableness of a commission rate outside the accepted corporate norm. The 2012 and 2022 Oracle enforcement actions demonstrated that Oracle needed to institute the proper controls to prevent its employees at Oracle India from creating and misusing the parked funds in the distributor’s account. The Company needed to audit and compare the distributor’s margin against the end user price to ensure excess margins were not being built into the pricing structure. Smith & Nephew did not perform sufficient due diligence on these distributors nor did they document any. Further, the distributor was domiciled in a location separate and apart, the UK, from the sole location it was designed to deliver products or services into, Greece. This clearly demonstrated that the entities were used for a purpose that the company wished to hide from Greek authorities. While it is true that a distributor might sell products into a country different than its domicile, if the products are going into a single country, this should have raised several Red Flags. Three Key Takeaways Use auditing and monitoring. Distributors will be treated the same as other business ventures. Robust due diligence must be performed. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 29 Mar 2023 04:00:00 -0000 Distributor Liability Under the FCPA full Thomas Fox What is distributor liability under the FCPA? Find out in this episode. Three enforcement actions which made clear that there were no distinctions between agents and distributors. They were the Smith & Nephew, Inc., Oracle (2012 and 2022) and Eli Lilly and Company. Each of these enforcement actions had different FCPA violations and they each revealed separate steps which a company should take to both prevent and detect FCPA violations in their company. These three separate bribery schemes call for three different but overlapping responses. The Lilly enforcement action also makes clear the need for internal audit to follow up with ongoing monitoring and auditing. Internal audit can be used to help determine the reasonableness of a commission rate outside the accepted corporate norm. The 2012 and 2022 Oracle enforcement actions demonstrated that Oracle needed to institute the proper controls to prevent its employees at Oracle India from creating and misusing the parked funds in the distributor’s account. The Company needed to audit and compare the distributor’s margin against the end user price to ensure excess margins were not being built into the pricing structure. Smith & Nephew did not perform sufficient due diligence on these distributors nor did they document any. Further, the distributor was domiciled in a location separate and apart, the UK, from the sole location it was designed to deliver products or services into, Greece. This clearly demonstrated that the entities were used for a purpose that the company wished to hide from Greek authorities. While it is true that a distributor might sell products into a country different than its domicile, if the products are going into a single country, this should have raised several Red Flags. Three Key Takeaways Use auditing and monitoring. Distributors will be treated the same as other business ventures. Robust due diligence must be performed. Learn more about your ad choices. Visit megaphone.fm/adchoices Three enforcement actions which made clear that there were no distinctions between agents and distributors. They were the Smith & Nephew, Inc., Oracle (2012 and 2022) and Eli Lilly and Company. Each of these enforcement actions had different FCPA violations and they each revealed separate steps which a company should take to both prevent and detect FCPA violations in their company.

These three separate bribery schemes call for three different but overlapping responses. The Lilly enforcement action also makes clear the need for internal audit to follow up with ongoing monitoring and auditing. Internal audit can be used to help determine the reasonableness of a commission rate outside the accepted corporate norm. The 2012 and 2022 Oracle enforcement actions demonstrated that Oracle needed to institute the proper controls to prevent its employees at Oracle India from creating and misusing the parked funds in the distributor’s account. The Company needed to audit and compare the distributor’s margin against the end user price to ensure excess margins were not being built into the pricing structure. Smith & Nephew did not perform sufficient due diligence on these distributors nor did they document any. Further, the distributor was domiciled in a location separate and apart, the UK, from the sole location it was designed to deliver products or services into, Greece. This clearly demonstrated that the entities were used for a purpose that the company wished to hide from Greek authorities. While it is true that a distributor might sell products into a country different than its domicile, if the products are going into a single country, this should have raised several Red Flags.

Three Key Takeaways

  1. Use auditing and monitoring.
  2. Distributors will be treated the same as other business ventures.
  3. Robust due diligence must be performed.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 488 no One Month to a More Effective Compliance Program for Business Ventures-Following the Money Through Distributors Polycom came to FCPA grief in China, as have many other US companies. The bribery scheme was long running, occurring from 2006-2014. They included the creation of an off-the books accounting and recordation system for corrupt payments made by or on behalf of Polycom China. The money to fund these bribes came through variations of the basic bribery scheme. There would be a discount between the price reported to Polycom and that paid by the buyer. These discounts were not passed on to the end customer, but instead were intended to cover the cost of the payments the distributors made to the Chinese government officials. In other words, this discount would form the basis of the pot of money to pay the bribe. The Chinese business unit was equally creative with the reasons for the discounts, which were listed in the CRM. Polycom China usually cited competition with one or more vendors was required to give discounts on pricing. They also claimed that some end-using customers refused to pay full price. However these were all false excuses entered into the CRM to hide the truth from auditors and others charged with reviewing and approving the discounts. Three Key Takeaways Channel your inner Woodward and Bernstein and follow the money. Simply because some type of compliance oversight is difficult or requires extra effort, it is no excuse not to monitor. Channel you inner Ronnie Reagan as well and ‘trust but verify. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 28 Mar 2023 04:00:00 -0000 Following the Money Through Distributors full Thomas Fox In this episode we consider the importance of following the money through distributors. Polycom came to FCPA grief in China, as have many other US companies. The bribery scheme was long running, occurring from 2006-2014. They included the creation of an off-the books accounting and recordation system for corrupt payments made by or on behalf of Polycom China. The money to fund these bribes came through variations of the basic bribery scheme. There would be a discount between the price reported to Polycom and that paid by the buyer. These discounts were not passed on to the end customer, but instead were intended to cover the cost of the payments the distributors made to the Chinese government officials. In other words, this discount would form the basis of the pot of money to pay the bribe. The Chinese business unit was equally creative with the reasons for the discounts, which were listed in the CRM. Polycom China usually cited competition with one or more vendors was required to give discounts on pricing. They also claimed that some end-using customers refused to pay full price. However these were all false excuses entered into the CRM to hide the truth from auditors and others charged with reviewing and approving the discounts. Three Key Takeaways Channel your inner Woodward and Bernstein and follow the money. Simply because some type of compliance oversight is difficult or requires extra effort, it is no excuse not to monitor. Channel you inner Ronnie Reagan as well and ‘trust but verify. Learn more about your ad choices. Visit megaphone.fm/adchoices Polycom came to FCPA grief in China, as have many other US companies. The bribery scheme was long running, occurring from 2006-2014. They included the creation of an off-the books accounting and recordation system for corrupt payments made by or on behalf of Polycom China. The money to fund these bribes came through variations of the basic bribery scheme. There would be a discount between the price reported to Polycom and that paid by the buyer. These discounts were not passed on to the end customer, but instead were intended to cover the cost of the payments the distributors made to the Chinese government officials. In other words, this discount would form the basis of the pot of money to pay the bribe.

The Chinese business unit was equally creative with the reasons for the discounts, which were listed in the CRM. Polycom China usually cited competition with one or more vendors was required to give discounts on pricing. They also claimed that some end-using customers refused to pay full price. However these were all false excuses entered into the CRM to hide the truth from auditors and others charged with reviewing and approving the discounts.

Three Key Takeaways

  1. Channel your inner Woodward and Bernstein and follow the money.
  2. Simply because some type of compliance oversight is difficult or requires extra effort, it is no excuse not to monitor.
  3. Channel you inner Ronnie Reagan as well and ‘trust but verify.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 368 no One Month to a More Effective Compliance Program for Business Ventures-Franchisor Compliance Most franchisors have thorough financial vetting requirements before allowing any person or business to become a franchisee. However, how many of these same businesses perform compliance due diligence on their prospective overseas franchises? How many U.S. franchisors have compliance training programs? How many evaluate, on an ongoing basis, the compliance program of their overseas franchisees? How many U.S. franchisors have a compliance hotline or other reporting mechanism for any compliance violations made against their franchisees? Some issues include health and wage compliance officials who may appear during routine health inspections or local wage and hour compliance determinations; intellectual property officials, as maintaining intellectual property rights is critical for any franchise model; utility officials as every franchise operation needs power maintained; and government procurement officials if the franchise is selling to a foreign government or state owned enterprise. How would all of this play out for a franchisor? As a franchisor moves into foreign markets there could well be the temptation to “grease the skids” and make payments or offer gifts to government officials, or their family members, to get the permits or permissions necessary to open and operate. In many countries, bribery is a common way of getting business done, and there can be tremendous pressure from local agents or franchisee candidates to follow regional customs and use bribes to become or remain competitive. Even if it is not the U.S. franchisor’s own employees that engage in the FCPA violations, the U.S. franchisor will still face the risk of an enforcement action if the franchisee’s employees engage in such conduct. Three key takeaways:  Franchises can bring an unexpected level of FCPA exposure. Franchisors must have more than financial vetting for potential franchisees. Use your compliance tool kit for business. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 27 Mar 2023 04:00:00 -0000 Franchisor Compliance full Thomas Fox In this episode, we consider Franchisor Compliance. Most franchisors have thorough financial vetting requirements before allowing any person or business to become a franchisee. However, how many of these same businesses perform compliance due diligence on their prospective overseas franchises? How many U.S. franchisors have compliance training programs? How many evaluate, on an ongoing basis, the compliance program of their overseas franchisees? How many U.S. franchisors have a compliance hotline or other reporting mechanism for any compliance violations made against their franchisees? Some issues include health and wage compliance officials who may appear during routine health inspections or local wage and hour compliance determinations; intellectual property officials, as maintaining intellectual property rights is critical for any franchise model; utility officials as every franchise operation needs power maintained; and government procurement officials if the franchise is selling to a foreign government or state owned enterprise. How would all of this play out for a franchisor? As a franchisor moves into foreign markets there could well be the temptation to “grease the skids” and make payments or offer gifts to government officials, or their family members, to get the permits or permissions necessary to open and operate. In many countries, bribery is a common way of getting business done, and there can be tremendous pressure from local agents or franchisee candidates to follow regional customs and use bribes to become or remain competitive. Even if it is not the U.S. franchisor’s own employees that engage in the FCPA violations, the U.S. franchisor will still face the risk of an enforcement action if the franchisee’s employees engage in such conduct. Three key takeaways:  Franchises can bring an unexpected level of FCPA exposure. Franchisors must have more than financial vetting for potential franchisees. Use your compliance tool kit for business. Learn more about your ad choices. Visit megaphone.fm/adchoices Most franchisors have thorough financial vetting requirements before allowing any person or business to become a franchisee. However, how many of these same businesses perform compliance due diligence on their prospective overseas franchises? How many U.S. franchisors have compliance training programs? How many evaluate, on an ongoing basis, the compliance program of their overseas franchisees? How many U.S. franchisors have a compliance hotline or other reporting mechanism for any compliance violations made against their franchisees?

Some issues include health and wage compliance officials who may appear during routine health inspections or local wage and hour compliance determinations; intellectual property officials, as maintaining intellectual property rights is critical for any franchise model; utility officials as every franchise operation needs power maintained; and government procurement officials if the franchise is selling to a foreign government or state owned enterprise.

How would all of this play out for a franchisor? As a franchisor moves into foreign markets there could well be the temptation to “grease the skids” and make payments or offer gifts to government officials, or their family members, to get the permits or permissions necessary to open and operate. In many countries, bribery is a common way of getting business done, and there can be tremendous pressure from local agents or franchisee candidates to follow regional customs and use bribes to become or remain competitive. Even if it is not the U.S. franchisor’s own employees that engage in the FCPA violations, the U.S. franchisor will still face the risk of an enforcement action if the franchisee’s employees engage in such conduct.

Three key takeaways: 

  1. Franchises can bring an unexpected level of FCPA exposure.
  2. Franchisors must have more than financial vetting for potential franchisees.
  3. Use your compliance tool kit for business.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 592 no One Month to a More Effective Compliance Program for Business Ventures-Franchisor Liability There remains a question about franchisor liability under the FCPA. Franchising has been a successful model in the U.S. and now many corporations are looking at overseas expansion opportunities. Franchise law has become well developed across the U.S., with many states developing laws to protect the rights and obligations of both parties in a franchise agreement. There are no reported FCPA enforcement actions regarding franchisors. However, the factors in a franchise relationship would appear to lead to clear FCPA responsibility of the franchisor for its overseas franchisee’s actions. Additionally, court interpretation of the FCPA has held that it is applicable where conduct is used “to obtain or retain business or secure an improper business advantage” which can cover almost any kind of advantage, including indirect monetary advantage even as nebulous as reputational advantage. As everyone knows, the FCPA prohibits payments to foreign officials to obtain or retain business or secure an improper business advantage. Nevertheless, many U.S. companies view franchisees as different from other types of more direct sales representatives, such as company sales representatives, agents, resellers or even JV partners, for the purposes of FCPA liability. The Master Franchise model is typically the most used model in international franchise expansion. It generally revolves around a Master Franchise agreement between the U.S. based franchisor and a franchisee in a specific geographic territory. This franchisee then contracts with third-party sub-franchisees within the specified territory. Typically, the U.S.-based franchisor will have no contractual relationship with the international sub-franchisees. The master franchisee acts as the franchisor in the local market and recruits, trains, and provides other support in the local area on behalf of the U.S. franchisor. Here the FCPA exposure is both direct and indirect. While some believe that a franchisor may not have direct involvement in conduct prohibited by the FCPA, as there may not be the requisite corrupt intent required under the statute. However, unless a franchisor has an adequate compliance program in place, a franchisor may well find itself in the shoes of Frederic Bourke and sustain a finding of conscious indifference. Three key takeaways:  Consider the different types of international franchise agreements to help assess your compliance risk. There are no reported FCPA enforcement actions involving international franchisors, yet. Franchisors must conduct thorough research in both the foreign market they hope to enter and on their potential franchisees. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 24 Mar 2023 04:00:00 -0000 Franchisor Liability full Thomas Fox Today we consider Franchisor Liability under the FCPA. There remains a question about franchisor liability under the FCPA. Franchising has been a successful model in the U.S. and now many corporations are looking at overseas expansion opportunities. Franchise law has become well developed across the U.S., with many states developing laws to protect the rights and obligations of both parties in a franchise agreement. There are no reported FCPA enforcement actions regarding franchisors. However, the factors in a franchise relationship would appear to lead to clear FCPA responsibility of the franchisor for its overseas franchisee’s actions. Additionally, court interpretation of the FCPA has held that it is applicable where conduct is used “to obtain or retain business or secure an improper business advantage” which can cover almost any kind of advantage, including indirect monetary advantage even as nebulous as reputational advantage. As everyone knows, the FCPA prohibits payments to foreign officials to obtain or retain business or secure an improper business advantage. Nevertheless, many U.S. companies view franchisees as different from other types of more direct sales representatives, such as company sales representatives, agents, resellers or even JV partners, for the purposes of FCPA liability. The Master Franchise model is typically the most used model in international franchise expansion. It generally revolves around a Master Franchise agreement between the U.S. based franchisor and a franchisee in a specific geographic territory. This franchisee then contracts with third-party sub-franchisees within the specified territory. Typically, the U.S.-based franchisor will have no contractual relationship with the international sub-franchisees. The master franchisee acts as the franchisor in the local market and recruits, trains, and provides other support in the local area on behalf of the U.S. franchisor. Here the FCPA exposure is both direct and indirect. While some believe that a franchisor may not have direct involvement in conduct prohibited by the FCPA, as there may not be the requisite corrupt intent required under the statute. However, unless a franchisor has an adequate compliance program in place, a franchisor may well find itself in the shoes of Frederic Bourke and sustain a finding of conscious indifference. Three key takeaways:  Consider the different types of international franchise agreements to help assess your compliance risk. There are no reported FCPA enforcement actions involving international franchisors, yet. Franchisors must conduct thorough research in both the foreign market they hope to enter and on their potential franchisees. Learn more about your ad choices. Visit megaphone.fm/adchoices There remains a question about franchisor liability under the FCPA. Franchising has been a successful model in the U.S. and now many corporations are looking at overseas expansion opportunities. Franchise law has become well developed across the U.S., with many states developing laws to protect the rights and obligations of both parties in a franchise agreement.

There are no reported FCPA enforcement actions regarding franchisors. However, the factors in a franchise relationship would appear to lead to clear FCPA responsibility of the franchisor for its overseas franchisee’s actions. Additionally, court interpretation of the FCPA has held that it is applicable where conduct is used “to obtain or retain business or secure an improper business advantage” which can cover almost any kind of advantage, including indirect monetary advantage even as nebulous as reputational advantage. As everyone knows, the FCPA prohibits payments to foreign officials to obtain or retain business or secure an improper business advantage. Nevertheless, many U.S. companies view franchisees as different from other types of more direct sales representatives, such as company sales representatives, agents, resellers or even JV partners, for the purposes of FCPA liability.

The Master Franchise model is typically the most used model in international franchise expansion. It generally revolves around a Master Franchise agreement between the U.S. based franchisor and a franchisee in a specific geographic territory. This franchisee then contracts with third-party sub-franchisees within the specified territory. Typically, the U.S.-based franchisor will have no contractual relationship with the international sub-franchisees. The master franchisee acts as the franchisor in the local market and recruits, trains, and provides other support in the local area on behalf of the U.S. franchisor. Here the FCPA exposure is both direct and indirect.

While some believe that a franchisor may not have direct involvement in conduct prohibited by the FCPA, as there may not be the requisite corrupt intent required under the statute. However, unless a franchisor has an adequate compliance program in place, a franchisor may well find itself in the shoes of Frederic Bourke and sustain a finding of conscious indifference.

Three key takeaways: 

  1. Consider the different types of international franchise agreements to help assess your compliance risk.
  2. There are no reported FCPA enforcement actions involving international franchisors, yet.
  3. Franchisors must conduct thorough research in both the foreign market they hope to enter and on their potential franchisees.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 561 One Month to More Effective Compliance for Business Ventures - Distributors as Business Venture Partners Many compliance practitioners generally view distributors as a part of their third-party risk management program, with most of their attention on the pre-contract phase of the risk management process. Typically, most of the efforts are spent on due diligence with less on managing the relationship after the contract is signed. However, many facets of a corporate relationship with a distributor are closer to those of other business venture partners. One of the issues in any compliance program is the compensation paid to a business venture partner as FCPA exposure arises when companies pay money - either directly or indirectly - to fund bribe payments. In the traditional intermediary scenario, the company funnels money to a business venture partner, who then passes on some or all of it to the bribe recipient. Often, the payment is disguised. Rethinking approaches to evaluating distributor activities is but one of the ways that the increased number of enforcement actions, 2020 FCPA Resource Guide, 2nd edition and DOJ’s 2020 Update to the Evaluation of Corporate Compliance Programs, have provided insight into how the government interprets and enforces the FCPA. This information, in turn, allows companies to get smarter about FCPA compliance. With a manageable amount of forethought, companies who rely on distributors can create, install and maintain systems which allow them to spend fewer resources to more effectively prevent violations. Moreover, these systems generate tangible proof of a company’s genuine commitment to FCPA compliance, by more fully operationalizing this aspect of their compliance program. Many companies have been involved in FCPA enforcement actions because of distributors. This sales side channel does not receive the focus equal to that of commissioned sales agents. Yet it can present an equally large compliance risk. By using this DAR approach, you will have created a well-thought out process which will operationalize your compliance program around distributor compensation, in a manner which documents your decision-making calculus. Three key takeaways:  The creation of well-thought out process which operationalizes your compliance program around distributor compensation, in a manner which documents your decision-making calculus is key. Require multiple levels of approval for an out of range distributor discount. Tracking distributor discounts globally makes your company more efficient. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 23 Mar 2023 04:00:00 -0000 Distributors as business venture partners full Thomas Fox Today, we consider Distributors as business venture partners. Many compliance practitioners generally view distributors as a part of their third-party risk management program, with most of their attention on the pre-contract phase of the risk management process. Typically, most of the efforts are spent on due diligence with less on managing the relationship after the contract is signed. However, many facets of a corporate relationship with a distributor are closer to those of other business venture partners. One of the issues in any compliance program is the compensation paid to a business venture partner as FCPA exposure arises when companies pay money - either directly or indirectly - to fund bribe payments. In the traditional intermediary scenario, the company funnels money to a business venture partner, who then passes on some or all of it to the bribe recipient. Often, the payment is disguised. Rethinking approaches to evaluating distributor activities is but one of the ways that the increased number of enforcement actions, 2020 FCPA Resource Guide, 2nd edition and DOJ’s 2020 Update to the Evaluation of Corporate Compliance Programs, have provided insight into how the government interprets and enforces the FCPA. This information, in turn, allows companies to get smarter about FCPA compliance. With a manageable amount of forethought, companies who rely on distributors can create, install and maintain systems which allow them to spend fewer resources to more effectively prevent violations. Moreover, these systems generate tangible proof of a company’s genuine commitment to FCPA compliance, by more fully operationalizing this aspect of their compliance program. Many companies have been involved in FCPA enforcement actions because of distributors. This sales side channel does not receive the focus equal to that of commissioned sales agents. Yet it can present an equally large compliance risk. By using this DAR approach, you will have created a well-thought out process which will operationalize your compliance program around distributor compensation, in a manner which documents your decision-making calculus. Three key takeaways:  The creation of well-thought out process which operationalizes your compliance program around distributor compensation, in a manner which documents your decision-making calculus is key. Require multiple levels of approval for an out of range distributor discount. Tracking distributor discounts globally makes your company more efficient. Learn more about your ad choices. Visit megaphone.fm/adchoices Many compliance practitioners generally view distributors as a part of their third-party risk management program, with most of their attention on the pre-contract phase of the risk management process. Typically, most of the efforts are spent on due diligence with less on managing the relationship after the contract is signed. However, many facets of a corporate relationship with a distributor are closer to those of other business venture partners.

One of the issues in any compliance program is the compensation paid to a business venture partner as FCPA exposure arises when companies pay money - either directly or indirectly - to fund bribe payments. In the traditional intermediary scenario, the company funnels money to a business venture partner, who then passes on some or all of it to the bribe recipient. Often, the payment is disguised. Rethinking approaches to evaluating distributor activities is but one of the ways that the increased number of enforcement actions, 2020 FCPA Resource Guide, 2nd edition and DOJ’s 2020 Update to the Evaluation of Corporate Compliance Programs, have provided insight into how the government interprets and enforces the FCPA. This information, in turn, allows companies to get smarter about FCPA compliance. With a manageable amount of forethought, companies who rely on distributors can create, install and maintain systems which allow them to spend fewer resources to more effectively prevent violations. Moreover, these systems generate tangible proof of a company’s genuine commitment to FCPA compliance, by more fully operationalizing this aspect of their compliance program.

Many companies have been involved in FCPA enforcement actions because of distributors. This sales side channel does not receive the focus equal to that of commissioned sales agents. Yet it can present an equally large compliance risk. By using this DAR approach, you will have created a well-thought out process which will operationalize your compliance program around distributor compensation, in a manner which documents your decision-making calculus.

Three key takeaways: 

  1. The creation of well-thought out process which operationalizes your compliance program around distributor compensation, in a manner which documents your decision-making calculus is key.
  2. Require multiple levels of approval for an out of range distributor discount.
  3. Tracking distributor discounts globally makes your company more efficient.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 580 no One Month to More Effective Compliance for Business Ventures - Financial Review of Your Business Venture Partner One area not usually considered around your business ventures is the financial health of JV partner, teaming partner, strategic partner or any other type of business partner or relationship which might occur in a business venture. It turns out such an oversight may have some significant ramifications for an accurate picture of a business venture partner. The financial health of a business venture partner as not only a key metric but also a key tool which allows a more robust assessment prior to contract signing and in managing the relationship after the contract has been signed. A business venture partner which is in a weakened financial position can come back to damage your business in a variety of ways. Obviously, a company which is under financial strain is more susceptible to cutting corners to obtain business. You can almost begin to see the fraud triangle forming at this point and a rationalization for committing a FCPA violation forming in the mind of a business venture partner. Continuous improvement through monitoring of ongoing financial health is a tool where technological solutions can have an impact. Understanding the financial viability of third-parties can help the compliance practitioner meet the DOJ requirement to more fully operationalize a compliance program. It can also lead to more and better operational stability and with that ever-sought increase in corporate profitability. As compliance moves into the business process, this type of review should become part of your compliance toolkit going forward. Three key takeaways:  What is the financial health of your business venture partners? Do you even know? Poor financial results can open a business venture partner to engaging in risky behavior. Financial health monitoring is key for monitoring business venture partners. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 22 Mar 2023 04:00:00 -0000 Financial Review of Your Business Venture Partner full Thomas Fox In this episode, we consider the need for a financial review of your business venture partner. One area not usually considered around your business ventures is the financial health of JV partner, teaming partner, strategic partner or any other type of business partner or relationship which might occur in a business venture. It turns out such an oversight may have some significant ramifications for an accurate picture of a business venture partner. The financial health of a business venture partner as not only a key metric but also a key tool which allows a more robust assessment prior to contract signing and in managing the relationship after the contract has been signed. A business venture partner which is in a weakened financial position can come back to damage your business in a variety of ways. Obviously, a company which is under financial strain is more susceptible to cutting corners to obtain business. You can almost begin to see the fraud triangle forming at this point and a rationalization for committing a FCPA violation forming in the mind of a business venture partner. Continuous improvement through monitoring of ongoing financial health is a tool where technological solutions can have an impact. Understanding the financial viability of third-parties can help the compliance practitioner meet the DOJ requirement to more fully operationalize a compliance program. It can also lead to more and better operational stability and with that ever-sought increase in corporate profitability. As compliance moves into the business process, this type of review should become part of your compliance toolkit going forward. Three key takeaways:  What is the financial health of your business venture partners? Do you even know? Poor financial results can open a business venture partner to engaging in risky behavior. Financial health monitoring is key for monitoring business venture partners. Learn more about your ad choices. Visit megaphone.fm/adchoices One area not usually considered around your business ventures is the financial health of JV partner, teaming partner, strategic partner or any other type of business partner or relationship which might occur in a business venture. It turns out such an oversight may have some significant ramifications for an accurate picture of a business venture partner. The financial health of a business venture partner as not only a key metric but also a key tool which allows a more robust assessment prior to contract signing and in managing the relationship after the contract has been signed.

A business venture partner which is in a weakened financial position can come back to damage your business in a variety of ways. Obviously, a company which is under financial strain is more susceptible to cutting corners to obtain business. You can almost begin to see the fraud triangle forming at this point and a rationalization for committing a FCPA violation forming in the mind of a business venture partner.

Continuous improvement through monitoring of ongoing financial health is a tool where technological solutions can have an impact. Understanding the financial viability of third-parties can help the compliance practitioner meet the DOJ requirement to more fully operationalize a compliance program. It can also lead to more and better operational stability and with that ever-sought increase in corporate profitability. As compliance moves into the business process, this type of review should become part of your compliance toolkit going forward.

Three key takeaways: 

  1. What is the financial health of your business venture partners? Do you even know?
  2. Poor financial results can open a business venture partner to engaging in risky behavior.
  3. Financial health monitoring is key for monitoring business venture partners.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 494 no One Month to a More Effective Compliance Program for Business Ventures-The Corporate Controller One area not often considered by the CCO as a key part of any compliance regime is the Corporate Controller. The Controller generally has the responsibility to accurately record and report the financial transactions of the company, to design, implement and execute the financial processes and controls of the company to be both effective and efficient, and to safeguard the financial assets of the company. Some of the compliance responsibilities of the Controller include: 1) Designing and implementing internal controls that impact ethics and compliance risks; 2) Accurately recording the financial transactions of the company; and 3) Preventing and detecting fraudulent activity. All of this means, in practical terms the Controller is both being the keeper of the books and records and the implementer of internal controls. Moreover, while many of these internal controls would most probably be viewed financial internal controls, there are additional internal controls which are not financial in nature. Russ Berland, has noted, “Those guys live really in the battle zone. They are constantly looking at financial transactions. They’re evaluating them. They’re figuring out where things go within the books and records. They are implementing the processes that should be keeping fraud from happening; keeping bribery and corruption from happening.” These benefits are not a one-way street for compliance as a Controller benefits from a closer relationship with the corporate compliance function as well. They can leverage compliance resources. The compliance function can bring its observations and insights from investigations and emerging risks to the Controller. A closer collaboration will broaden awareness of compliance risks which relate to the company’s financial processes. By more fully integrating compliance into the Controller function a more robust picture of enterprise risk emerges, one which encompasses legal, compliance, ethics, internal controls, financial, business and governance risks. Three key takeaways:  CCOs need to integrate the function of the Controller into their compliance regime. Offshore payments must be flagged for further investigations. The Controller is both the keeper of the books and records and the implementer of internal controls. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 21 Mar 2023 04:00:00 -0000 The Corporate Controller full Thomas Fox In this episode, I take up the role of the corporate controller in business ventures. One area not often considered by the CCO as a key part of any compliance regime is the Corporate Controller. The Controller generally has the responsibility to accurately record and report the financial transactions of the company, to design, implement and execute the financial processes and controls of the company to be both effective and efficient, and to safeguard the financial assets of the company. Some of the compliance responsibilities of the Controller include: 1) Designing and implementing internal controls that impact ethics and compliance risks; 2) Accurately recording the financial transactions of the company; and 3) Preventing and detecting fraudulent activity. All of this means, in practical terms the Controller is both being the keeper of the books and records and the implementer of internal controls. Moreover, while many of these internal controls would most probably be viewed financial internal controls, there are additional internal controls which are not financial in nature. Russ Berland, has noted, “Those guys live really in the battle zone. They are constantly looking at financial transactions. They’re evaluating them. They’re figuring out where things go within the books and records. They are implementing the processes that should be keeping fraud from happening; keeping bribery and corruption from happening.” These benefits are not a one-way street for compliance as a Controller benefits from a closer relationship with the corporate compliance function as well. They can leverage compliance resources. The compliance function can bring its observations and insights from investigations and emerging risks to the Controller. A closer collaboration will broaden awareness of compliance risks which relate to the company’s financial processes. By more fully integrating compliance into the Controller function a more robust picture of enterprise risk emerges, one which encompasses legal, compliance, ethics, internal controls, financial, business and governance risks. Three key takeaways:  CCOs need to integrate the function of the Controller into their compliance regime. Offshore payments must be flagged for further investigations. The Controller is both the keeper of the books and records and the implementer of internal controls. Learn more about your ad choices. Visit megaphone.fm/adchoices One area not often considered by the CCO as a key part of any compliance regime is the Corporate Controller. The Controller generally has the responsibility to accurately record and report the financial transactions of the company, to design, implement and execute the financial processes and controls of the company to be both effective and efficient, and to safeguard the financial assets of the company. Some of the compliance responsibilities of the Controller include: 1) Designing and implementing internal controls that impact ethics and compliance risks; 2) Accurately recording the financial transactions of the company; and 3) Preventing and detecting fraudulent activity. All of this means, in practical terms the Controller is both being the keeper of the books and records and the implementer of internal controls. Moreover, while many of these internal controls would most probably be viewed financial internal controls, there are additional internal controls which are not financial in nature.

Russ Berland, has noted, “Those guys live really in the battle zone. They are constantly looking at financial transactions. They’re evaluating them. They’re figuring out where things go within the books and records. They are implementing the processes that should be keeping fraud from happening; keeping bribery and corruption from happening.”

These benefits are not a one-way street for compliance as a Controller benefits from a closer relationship with the corporate compliance function as well. They can leverage compliance resources. The compliance function can bring its observations and insights from investigations and emerging risks to the Controller. A closer collaboration will broaden awareness of compliance risks which relate to the company’s financial processes. By more fully integrating compliance into the Controller function a more robust picture of enterprise risk emerges, one which encompasses legal, compliance, ethics, internal controls, financial, business and governance risks.

Three key takeaways: 

  1. CCOs need to integrate the function of the Controller into their compliance regime.
  2. Offshore payments must be flagged for further investigations.
  3. The Controller is both the keeper of the books and records and the implementer of internal controls.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 537 no One Month to More Effective Compliance for Business Ventures - Know Your Customer Do FCPA considerations come into play for customers? How should you think about your obligations under the FCPA for a group not traditionally associated with FCPA liability or even FCPA risk? These questions and perhaps others are raised by the FCPA investigation into certain transactions in Venezuela by Derwick Associates (Derwick) and a U.S. company ProEnergy Services (ProEnergy). ProEnergy supplied turbines that Derwick resold to the Venezuelan government and then installed in that country. This investigation demonstrates why businesses need to be more concerned with not only who they do business with but how their customers might be doing business. In banking and financial services parlance, you now need to ramp up your organization’s Know Your Customer (KYC) information to continue throughout a seller-purchaser relationship, in the context of the FCPA. There does not have to be a direct bribe or other corrupt payment made by a U.S. company to have liability under the FCPA. FCPA enforcement is littered with companies that have paid bribes through third-parties. However, as the Fifth Circuit said in US v. Kay, “[W]e hold that Congress intended for the FCPA to apply broadly to payments intended to assist the payor, either directly or indirectly,” [emphasis mine]. While at first blush, ProEnergy may appear to be at the edge of potential FCPA liability; if it knew, had reason to know, or should have taken steps to know about some nefarious conduct by its customer, it does not take too many steps to get to some FCPA exposure. The FinCEN rules on customer due diligence for financial institutions are a good starting point for other commercial entities to base their compliance program for customers around. Three key takeaways:  Non-banking and non-financial service entities need to consider their KYC obligations in the context of FCPA risk. FinCEN rules on customer due diligence are a good starting point for the non-financial institution. Ongoing monitoring should be used and the information incorporated into your customer risk profile going forward. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 20 Mar 2023 04:00:00 -0000 Know Your Customer full Thomas Fox Today we apply Know Your Customer to compliance. Do FCPA considerations come into play for customers? How should you think about your obligations under the FCPA for a group not traditionally associated with FCPA liability or even FCPA risk? These questions and perhaps others are raised by the FCPA investigation into certain transactions in Venezuela by Derwick Associates (Derwick) and a U.S. company ProEnergy Services (ProEnergy). ProEnergy supplied turbines that Derwick resold to the Venezuelan government and then installed in that country. This investigation demonstrates why businesses need to be more concerned with not only who they do business with but how their customers might be doing business. In banking and financial services parlance, you now need to ramp up your organization’s Know Your Customer (KYC) information to continue throughout a seller-purchaser relationship, in the context of the FCPA. There does not have to be a direct bribe or other corrupt payment made by a U.S. company to have liability under the FCPA. FCPA enforcement is littered with companies that have paid bribes through third-parties. However, as the Fifth Circuit said in US v. Kay, “[W]e hold that Congress intended for the FCPA to apply broadly to payments intended to assist the payor, either directly or indirectly,” [emphasis mine]. While at first blush, ProEnergy may appear to be at the edge of potential FCPA liability; if it knew, had reason to know, or should have taken steps to know about some nefarious conduct by its customer, it does not take too many steps to get to some FCPA exposure. The FinCEN rules on customer due diligence for financial institutions are a good starting point for other commercial entities to base their compliance program for customers around. Three key takeaways:  Non-banking and non-financial service entities need to consider their KYC obligations in the context of FCPA risk. FinCEN rules on customer due diligence are a good starting point for the non-financial institution. Ongoing monitoring should be used and the information incorporated into your customer risk profile going forward. Learn more about your ad choices. Visit megaphone.fm/adchoices Do FCPA considerations come into play for customers? How should you think about your obligations under the FCPA for a group not traditionally associated with FCPA liability or even FCPA risk? These questions and perhaps others are raised by the FCPA investigation into certain transactions in Venezuela by Derwick Associates (Derwick) and a U.S. company ProEnergy Services (ProEnergy). ProEnergy supplied turbines that Derwick resold to the Venezuelan government and then installed in that country. This investigation demonstrates why businesses need to be more concerned with not only who they do business with but how their customers might be doing business. In banking and financial services parlance, you now need to ramp up your organization’s Know Your Customer (KYC) information to continue throughout a seller-purchaser relationship, in the context of the FCPA.

There does not have to be a direct bribe or other corrupt payment made by a U.S. company to have liability under the FCPA. FCPA enforcement is littered with companies that have paid bribes through third-parties. However, as the Fifth Circuit said in US v. Kay, “[W]e hold that Congress intended for the FCPA to apply broadly to payments intended to assist the payor, either directly or indirectly,” [emphasis mine]. While at first blush, ProEnergy may appear to be at the edge of potential FCPA liability; if it knew, had reason to know, or should have taken steps to know about some nefarious conduct by its customer, it does not take too many steps to get to some FCPA exposure. The FinCEN rules on customer due diligence for financial institutions are a good starting point for other commercial entities to base their compliance program for customers around.

Three key takeaways: 

  1. Non-banking and non-financial service entities need to consider their KYC obligations in the context of FCPA risk.
  2. FinCEN rules on customer due diligence are a good starting point for the non-financial institution.
  3. Ongoing monitoring should be used and the information incorporated into your customer risk profile going forward.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 549 no One Month to More Effective Compliance for Business Ventures - Tying it all Together for Joint Ventures I want to emphasize again the risks JVs pose under the FCPA. Mike Volkov has stated, “A joint venture requires the integration of disparate company cultures. It can be successful and is usually one of the significant reason for the joint venture itself.” Both parties should assess each other and decide that the JV is a good fit, meaning that each side will benefit. Too much time is spent on looking at the JV partner’s compliance toolbox (i.e., policies, procedures, and controls), and not enough time is spent on identifying compliance strengths and weaknesses. You must bring it all together with one format. Indeed the 2020 Update to the Evaluation of Corporate Compliance Programs posed the following questions under the category, “Process Connecting Due Diligence to Implementation” What has been the company’s process for tracking and remediating misconduct or misconduct risks identified during the due diligence process? What has been the company’s process for implementing compliance policies and procedures, and conducting post- acquisition audits, at newly acquired entities? Remember a “newly acquired entity” can be a joint venture. Three key takeaways:  It all starts with a Relationship Manager. Have company oversight of all JVs. Couple this with a COC for a second set of eyes. Audit, monitor, and remediate (as appropriate) your JVs on an ongoing basis. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 17 Mar 2023 04:00:00 -0000 Tying it all Together for Joint Ventures full 13 Thomas Fox In this episode, I bring it all together for the intersection of joint ventures and compliance. I want to emphasize again the risks JVs pose under the FCPA. Mike Volkov has stated, “A joint venture requires the integration of disparate company cultures. It can be successful and is usually one of the significant reason for the joint venture itself.” Both parties should assess each other and decide that the JV is a good fit, meaning that each side will benefit. Too much time is spent on looking at the JV partner’s compliance toolbox (i.e., policies, procedures, and controls), and not enough time is spent on identifying compliance strengths and weaknesses. You must bring it all together with one format. Indeed the 2020 Update to the Evaluation of Corporate Compliance Programs posed the following questions under the category, “Process Connecting Due Diligence to Implementation” What has been the company’s process for tracking and remediating misconduct or misconduct risks identified during the due diligence process? What has been the company’s process for implementing compliance policies and procedures, and conducting post- acquisition audits, at newly acquired entities? Remember a “newly acquired entity” can be a joint venture. Three key takeaways:  It all starts with a Relationship Manager. Have company oversight of all JVs. Couple this with a COC for a second set of eyes. Audit, monitor, and remediate (as appropriate) your JVs on an ongoing basis. Learn more about your ad choices. Visit megaphone.fm/adchoices I want to emphasize again the risks JVs pose under the FCPA. Mike Volkov has stated, “A joint venture requires the integration of disparate company cultures. It can be successful and is usually one of the significant reason for the joint venture itself.” Both parties should assess each other and decide that the JV is a good fit, meaning that each side will benefit. Too much time is spent on looking at the JV partner’s compliance toolbox (i.e., policies, procedures, and controls), and not enough time is spent on identifying compliance strengths and weaknesses. You must bring it all together with one format.

Indeed the 2020 Update to the Evaluation of Corporate Compliance Programs posed the following questions under the category, “Process Connecting Due Diligence to Implementation” What has been the company’s process for tracking and remediating misconduct or misconduct risks identified during the due diligence process? What has been the company’s process for implementing compliance policies and procedures, and conducting post- acquisition audits, at newly acquired entities? Remember a “newly acquired entity” can be a joint venture.

Three key takeaways: 

  1. It all starts with a Relationship Manager.
  2. Have company oversight of all JVs. Couple this with a COC for a second set of eyes.
  3. Audit, monitor, and remediate (as appropriate) your JVs on an ongoing basis.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 479 no One Month to More Effective Compliance for Business Ventures - Post Acquisition Integration Your company has just made its largest acquisition ever and your CEO says that he wants you to have a compliance post-acquisition integration plan on his desk in one week. Where do you begin? Of course, you think about the 2020 FCPA Resource Guide, 2nd edition but you also remember that the established time frames in the enforcement actions involving Johnson & Johnson (J&J), Pfizer Inc. and DS&S and the Halliburton Opinion Release. While there are time frames listed in these DPAs, they are a guide of timeframes, not a ‘how to’ guide and many compliance professionals struggle with how to perform these post-acquisition compliance integrations. The 2020 Update to the Evaluation of Corporate Compliance Programs asked the following questions, What has been the company’s process for tracking and remediating misconduct or misconduct risks identified during the due diligence process? What has been the company’s process for implementing compliance policies and procedures, and conducting post- acquisition audits, at newly acquired entities? Whatever compendium of steps you utilize for post-acquisition integration, they should be taken as soon as practicable. Three key takeaways:  Planning is critical in the post-acquisition phase. Build upon what you learned in pre-acquisition due diligence. You need to be ready to hit the ground running when a transaction closes. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 16 Mar 2023 04:00:00 -0000 Post Acquisition Integration full 11 Thomas Fox Today we consider Post Acquisition Integration. Your company has just made its largest acquisition ever and your CEO says that he wants you to have a compliance post-acquisition integration plan on his desk in one week. Where do you begin? Of course, you think about the 2020 FCPA Resource Guide, 2nd edition but you also remember that the established time frames in the enforcement actions involving Johnson & Johnson (J&J), Pfizer Inc. and DS&S and the Halliburton Opinion Release. While there are time frames listed in these DPAs, they are a guide of timeframes, not a ‘how to’ guide and many compliance professionals struggle with how to perform these post-acquisition compliance integrations. The 2020 Update to the Evaluation of Corporate Compliance Programs asked the following questions, What has been the company’s process for tracking and remediating misconduct or misconduct risks identified during the due diligence process? What has been the company’s process for implementing compliance policies and procedures, and conducting post- acquisition audits, at newly acquired entities? Whatever compendium of steps you utilize for post-acquisition integration, they should be taken as soon as practicable. Three key takeaways:  Planning is critical in the post-acquisition phase. Build upon what you learned in pre-acquisition due diligence. You need to be ready to hit the ground running when a transaction closes. Learn more about your ad choices. Visit megaphone.fm/adchoices Your company has just made its largest acquisition ever and your CEO says that he wants you to have a compliance post-acquisition integration plan on his desk in one week. Where do you begin? Of course, you think about the 2020 FCPA Resource Guide, 2nd edition but you also remember that the established time frames in the enforcement actions involving Johnson & Johnson (J&J), Pfizer Inc. and DS&S and the Halliburton Opinion Release.

While there are time frames listed in these DPAs, they are a guide of timeframes, not a ‘how to’ guide and many compliance professionals struggle with how to perform these post-acquisition compliance integrations. The 2020 Update to the Evaluation of Corporate Compliance Programs asked the following questions, What has been the company’s process for tracking and remediating misconduct or misconduct risks identified during the due diligence process? What has been the company’s process for implementing compliance policies and procedures, and conducting post- acquisition audits, at newly acquired entities?

Whatever compendium of steps you utilize for post-acquisition integration, they should be taken as soon as practicable.

Three key takeaways: 

  1. Planning is critical in the post-acquisition phase.
  2. Build upon what you learned in pre-acquisition due diligence.
  3. You need to be ready to hit the ground running when a transaction closes.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 607 no One Month to More Effective Compliance For Business Ventures - Why engage in pre-acquisition due diligence? The Business Perspective Why should a company engage in pre-acquisition due diligence in the M&A context? In this episode, I am joined by Affiliated Monitors founder Vin DiCianni to explore the business reasons for engaging in what may be seen as a compliance exercise. Financial, legal, or reputational risk can have a significant impact the valuation or a transaction or its desirability. Factors such as current or historical bribery/corruption discovered at any point in the acquiring company provide the compliance practitioner with strong ammunition when confronted with a management that fails to understand the need for a robust due diligence in a M&A transaction. By not focusing on the regulatory aspects of M&A transactions, but more on the market reasons for engaging in the appropriate due diligence, you can emphasize the business reasons for compliance. Three key takeaways:  There are numerous legal and business reason to engage in anti-corruption due diligence in the M&A space. ESG can present significant corruption risks in emerging markets. Present your analysis in high, medium and low risk formats. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 14 Mar 2023 10:38:17 -0000 Why engage in pre-acquisition due diligence? The Business Perspective full Thomas Fox AMI founder Vin DiCianni joins Tom to explore why you need to engage in pre-acquisition due diligence, from the Business Perspective. Why should a company engage in pre-acquisition due diligence in the M&A context? In this episode, I am joined by Affiliated Monitors founder Vin DiCianni to explore the business reasons for engaging in what may be seen as a compliance exercise. Financial, legal, or reputational risk can have a significant impact the valuation or a transaction or its desirability. Factors such as current or historical bribery/corruption discovered at any point in the acquiring company provide the compliance practitioner with strong ammunition when confronted with a management that fails to understand the need for a robust due diligence in a M&A transaction. By not focusing on the regulatory aspects of M&A transactions, but more on the market reasons for engaging in the appropriate due diligence, you can emphasize the business reasons for compliance. Three key takeaways:  There are numerous legal and business reason to engage in anti-corruption due diligence in the M&A space. ESG can present significant corruption risks in emerging markets. Present your analysis in high, medium and low risk formats. Learn more about your ad choices. Visit megaphone.fm/adchoices Why should a company engage in pre-acquisition due diligence in the M&A context? In this episode, I am joined by Affiliated Monitors founder Vin DiCianni to explore the business reasons for engaging in what may be seen as a compliance exercise.

Financial, legal, or reputational risk can have a significant impact the valuation or a transaction or its desirability. Factors such as current or historical bribery/corruption discovered at any point in the acquiring company provide the compliance practitioner with strong ammunition when confronted with a management that fails to understand the need for a robust due diligence in a M&A transaction. By not focusing on the regulatory aspects of M&A transactions, but more on the market reasons for engaging in the appropriate due diligence, you can emphasize the business reasons for compliance.

Three key takeaways: 

  1. There are numerous legal and business reason to engage in anti-corruption due diligence in the M&A space.
  2. ESG can present significant corruption risks in emerging markets.
  3. Present your analysis in high, medium and low risk formats.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 491 no One Month to More Effective Compliance for Business Ventures - Pre-acquisition Due Diligence in Mergers and Acquisitions A company that does not perform adequate due diligence prior to a merger or acquisition may face both legal and business risks. Perhaps most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. While most compliance practitioners have been long aware of the requirement in the post-acquisition context, the the FCPA Resource Guide, 2nd edition, focused many compliance practitioners of the need to engage in robust pre-acquisition due diligence. The 2020 Update made even more clear the need for a robust compliance presence in the pre-acquisition phase. It stated, “A well-designed compliance program should include comprehensive due diligence of any acquisition targets, as well as a process for timely and orderly integration of the acquired entity into existing compliance program structures and internal controls. Pre-M&A due diligence, where possible, enables the acquiring company to evaluate more accurately each target’s value and negotiate for the costs of any corruption or misconduct to be borne by the target. Flawed or incomplete pre- or post-acquisition due diligence and integration can allow misconduct to continue at the target company, causing resulting harm to a business’s profitability and reputation and risking civil and criminal liability.” There are multiple red flags which could be raised in this process, which might well warrant further investigation. They include if the target has ineffective compliance program elements in their compliance program or if there were frequent breach of policies and procedures. Obviously, a target which is in financial difficulty would bear closer scrutiny. Structurally, if the company did not have a formal ethics and compliance committee at the senior management or Board of Directors’ level, this could present issues. From the CCO perspective, if the position did not have Board or CEO access or if there were not regular reports to the Board, it could present an issue for compliance. Conversely, if there were frequent requests to waive policies, management over-ride of compliance controls or no consistent consequence management for violations; it could present clear red flags for further investigation. Three key takeaways:  The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward. Periodically review your M&A due diligence protocol. If red flags appear in pre-acquisition due diligence, they should be cleared. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 14 Mar 2023 04:00:00 -0000 Pre-acquisition Due Diligence in Mergers and Acquisitions full 10 Thomas Fox Today we consider Pre-acquisition Due Diligence in Mergers and Acquisitions. A company that does not perform adequate due diligence prior to a merger or acquisition may face both legal and business risks. Perhaps most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. While most compliance practitioners have been long aware of the requirement in the post-acquisition context, the the FCPA Resource Guide, 2nd edition, focused many compliance practitioners of the need to engage in robust pre-acquisition due diligence. The 2020 Update made even more clear the need for a robust compliance presence in the pre-acquisition phase. It stated, “A well-designed compliance program should include comprehensive due diligence of any acquisition targets, as well as a process for timely and orderly integration of the acquired entity into existing compliance program structures and internal controls. Pre-M&A due diligence, where possible, enables the acquiring company to evaluate more accurately each target’s value and negotiate for the costs of any corruption or misconduct to be borne by the target. Flawed or incomplete pre- or post-acquisition due diligence and integration can allow misconduct to continue at the target company, causing resulting harm to a business’s profitability and reputation and risking civil and criminal liability.” There are multiple red flags which could be raised in this process, which might well warrant further investigation. They include if the target has ineffective compliance program elements in their compliance program or if there were frequent breach of policies and procedures. Obviously, a target which is in financial difficulty would bear closer scrutiny. Structurally, if the company did not have a formal ethics and compliance committee at the senior management or Board of Directors’ level, this could present issues. From the CCO perspective, if the position did not have Board or CEO access or if there were not regular reports to the Board, it could present an issue for compliance. Conversely, if there were frequent requests to waive policies, management over-ride of compliance controls or no consistent consequence management for violations; it could present clear red flags for further investigation. Three key takeaways:  The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward. Periodically review your M&A due diligence protocol. If red flags appear in pre-acquisition due diligence, they should be cleared. Learn more about your ad choices. Visit megaphone.fm/adchoices A company that does not perform adequate due diligence prior to a merger or acquisition may face both legal and business risks. Perhaps most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. While most compliance practitioners have been long aware of the requirement in the post-acquisition context, the the FCPA Resource Guide, 2nd edition, focused many compliance practitioners of the need to engage in robust pre-acquisition due diligence.

The 2020 Update made even more clear the need for a robust compliance presence in the pre-acquisition phase. It stated, “A well-designed compliance program should include comprehensive due diligence of any acquisition targets, as well as a process for timely and orderly integration of the acquired entity into existing compliance program structures and internal controls. Pre-M&A due diligence, where possible, enables the acquiring company to evaluate more accurately each target’s value and negotiate for the costs of any corruption or misconduct to be borne by the target. Flawed or incomplete pre- or post-acquisition due diligence and integration can allow misconduct to continue at the target company, causing resulting harm to a business’s profitability and reputation and risking civil and criminal liability.”

There are multiple red flags which could be raised in this process, which might well warrant further investigation. They include if the target has ineffective compliance program elements in their compliance program or if there were frequent breach of policies and procedures. Obviously, a target which is in financial difficulty would bear closer scrutiny. Structurally, if the company did not have a formal ethics and compliance committee at the senior management or Board of Directors’ level, this could present issues. From the CCO perspective, if the position did not have Board or CEO access or if there were not regular reports to the Board, it could present an issue for compliance. Conversely, if there were frequent requests to waive policies, management over-ride of compliance controls or no consistent consequence management for violations; it could present clear red flags for further investigation.

Three key takeaways: 

  1. The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward.
  2. Periodically review your M&A due diligence protocol.
  3. If red flags appear in pre-acquisition due diligence, they should be cleared.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 496 no One Month to More Effective Compliance for Business Ventures - Pre-acquisition Risk Assessment One of the clearest themes from the original, 2012 FCPA Resource Guide was around the importance of your pre-acquisition work in any M&A on a target company. In the section on Declinations, the 2012 FCPA Resource Guide provided an example of a company which had received a declination in large part because of its pre-acquisition work, which then served as a basis of its post-acquisition remediation. I find it appropriate to think of the process as a straight line, directly from the pre-acquisition phase through to closing and then to remediation, integration and self-reporting in the post-acquisition phase. These same concepts were brought forward in the 2020 FCPA Resource Guide, 2nd edition. It should all begin with a preliminary pre-acquisition assessment of risk. Such an early assessment will inform the transaction research and evaluation phases. This could include an objective view of the risks faced and the level of risk exposure, such as best/worst case scenarios. A pre-acquisition risk assessment could also be used as a mechanism through which to view the feasibility of the business strategy and help to value the potential target. The pre-acquisition risk assessment can be a critical element in any M&A work for compliance. Use this opportunity to see where the target might stand on compliance. Your risk assessment can evolve as you obtain greater information. Finally, use this pre-acquisition risk assessment as a base document to plan, resource and budget for your post-acquisition remediation, integration and reporting. Three key takeaways:  One never has enough time to engage in all of the pre-acquisition review you might want to do, so optimize your time and resources. Consider what you can review to put together a preliminary risk assessment on the target. As with most compliance initiatives, you are only limited by your imagination, so if you are limited in time and scope, try something new and different. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 13 Mar 2023 04:00:00 -0000 Pre-acquisition Risk Assessment full 9 Thomas Fox Today we consider the Pre-acquisition Risk Assessment. One of the clearest themes from the original, 2012 FCPA Resource Guide was around the importance of your pre-acquisition work in any M&A on a target company. In the section on Declinations, the 2012 FCPA Resource Guide provided an example of a company which had received a declination in large part because of its pre-acquisition work, which then served as a basis of its post-acquisition remediation. I find it appropriate to think of the process as a straight line, directly from the pre-acquisition phase through to closing and then to remediation, integration and self-reporting in the post-acquisition phase. These same concepts were brought forward in the 2020 FCPA Resource Guide, 2nd edition. It should all begin with a preliminary pre-acquisition assessment of risk. Such an early assessment will inform the transaction research and evaluation phases. This could include an objective view of the risks faced and the level of risk exposure, such as best/worst case scenarios. A pre-acquisition risk assessment could also be used as a mechanism through which to view the feasibility of the business strategy and help to value the potential target. The pre-acquisition risk assessment can be a critical element in any M&A work for compliance. Use this opportunity to see where the target might stand on compliance. Your risk assessment can evolve as you obtain greater information. Finally, use this pre-acquisition risk assessment as a base document to plan, resource and budget for your post-acquisition remediation, integration and reporting. Three key takeaways:  One never has enough time to engage in all of the pre-acquisition review you might want to do, so optimize your time and resources. Consider what you can review to put together a preliminary risk assessment on the target. As with most compliance initiatives, you are only limited by your imagination, so if you are limited in time and scope, try something new and different. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the clearest themes from the original, 2012 FCPA Resource Guide was around the importance of your pre-acquisition work in any M&A on a target company. In the section on Declinations, the 2012 FCPA Resource Guide provided an example of a company which had received a declination in large part because of its pre-acquisition work, which then served as a basis of its post-acquisition remediation. I find it appropriate to think of the process as a straight line, directly from the pre-acquisition phase through to closing and then to remediation, integration and self-reporting in the post-acquisition phase. These same concepts were brought forward in the 2020 FCPA Resource Guide, 2nd edition.

It should all begin with a preliminary pre-acquisition assessment of risk. Such an early assessment will inform the transaction research and evaluation phases. This could include an objective view of the risks faced and the level of risk exposure, such as best/worst case scenarios. A pre-acquisition risk assessment could also be used as a mechanism through which to view the feasibility of the business strategy and help to value the potential target.

The pre-acquisition risk assessment can be a critical element in any M&A work for compliance. Use this opportunity to see where the target might stand on compliance. Your risk assessment can evolve as you obtain greater information. Finally, use this pre-acquisition risk assessment as a base document to plan, resource and budget for your post-acquisition remediation, integration and reporting.

Three key takeaways: 

  1. One never has enough time to engage in all of the pre-acquisition review you might want to do, so optimize your time and resources.
  2. Consider what you can review to put together a preliminary risk assessment on the target.
  3. As with most compliance initiatives, you are only limited by your imagination, so if you are limited in time and scope, try something new and different.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 499 no One Month to More Effective Compliance for Business Ventures - Safe Harbor in M&A White collar defense practitioners have long called for a specific safe harbor for companies in the mergers and acquisition context where they meet the criteria set out by the DOJ. This clarion call was answered in the summer, 2018 when in July 2018, the DOJ announced a revision to the FCPA Corporation Enforcement Policy, specifically around mergers and acquisitions. The new language read: M&A Due Diligence and Remediation: The Department recognizes the potential benefits of corporate mergers and acquisitions, particularly when the acquiring entity has a robust compliance program in place and implements that program as quickly as practicable at the merged or acquired entity. Accordingly, where a company undertakes a merger or acquisition, uncovers misconduct through thorough and timely due diligence or, in appropriate instances, through post-acquisition audits or compliance integration efforts, and voluntarily self-discloses the misconduct and otherwise takes action consistent with this Policy (including, among other requirements, the timely implementation of an effective compliance program at the merged or acquired entity), there will be a presumption of a declination in accordance with and subject to the other requirements of this Policy. In announcing the change, then Deputy Assistant Attorney General Matthew Miner, that while the 2012 FCPA Resource Guide did provide some guidance on what may constitute a safe harbor; that word ‘may’ was a “sticking point for corporate management when deciding whether and how to proceed with a potential merger or acquisition. There is a big difference between a theoretical outcome and one that is concrete and presumptively available.” Three Key Takeaways The FCPA Corporate Enforcement Policy was amended in 2018 to provide a safe harbor in the M&A context. Pre and post-acquisition compliance work must be equally robust. If you find misconduct, report and remediate. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 10 Mar 2023 05:00:00 -0000 Safe Harbor in M&A full Thomas Fox In this episode, we consider safe harbor in M&A transactions under the FCPA. White collar defense practitioners have long called for a specific safe harbor for companies in the mergers and acquisition context where they meet the criteria set out by the DOJ. This clarion call was answered in the summer, 2018 when in July 2018, the DOJ announced a revision to the FCPA Corporation Enforcement Policy, specifically around mergers and acquisitions. The new language read: M&A Due Diligence and Remediation: The Department recognizes the potential benefits of corporate mergers and acquisitions, particularly when the acquiring entity has a robust compliance program in place and implements that program as quickly as practicable at the merged or acquired entity. Accordingly, where a company undertakes a merger or acquisition, uncovers misconduct through thorough and timely due diligence or, in appropriate instances, through post-acquisition audits or compliance integration efforts, and voluntarily self-discloses the misconduct and otherwise takes action consistent with this Policy (including, among other requirements, the timely implementation of an effective compliance program at the merged or acquired entity), there will be a presumption of a declination in accordance with and subject to the other requirements of this Policy. In announcing the change, then Deputy Assistant Attorney General Matthew Miner, that while the 2012 FCPA Resource Guide did provide some guidance on what may constitute a safe harbor; that word ‘may’ was a “sticking point for corporate management when deciding whether and how to proceed with a potential merger or acquisition. There is a big difference between a theoretical outcome and one that is concrete and presumptively available.” Three Key Takeaways The FCPA Corporate Enforcement Policy was amended in 2018 to provide a safe harbor in the M&A context. Pre and post-acquisition compliance work must be equally robust. If you find misconduct, report and remediate. Learn more about your ad choices. Visit megaphone.fm/adchoices White collar defense practitioners have long called for a specific safe harbor for companies in the mergers and acquisition context where they meet the criteria set out by the DOJ. This clarion call was answered in the summer, 2018 when in July 2018, the DOJ announced a revision to the FCPA Corporation Enforcement Policy, specifically around mergers and acquisitions. The new language read:

M&A Due Diligence and Remediation: The Department recognizes the potential benefits of corporate mergers and acquisitions, particularly when the acquiring entity has a robust compliance program in place and implements that program as quickly as practicable at the merged or acquired entity. Accordingly, where a company undertakes a merger or acquisition, uncovers misconduct through thorough and timely due diligence or, in appropriate instances, through post-acquisition audits or compliance integration efforts, and voluntarily self-discloses the misconduct and otherwise takes action consistent with this Policy (including, among other requirements, the timely implementation of an effective compliance program at the merged or acquired entity), there will be a presumption of a declination in accordance with and subject to the other requirements of this Policy.

In announcing the change, then Deputy Assistant Attorney General Matthew Miner, that while the 2012 FCPA Resource Guide did provide some guidance on what may constitute a safe harbor; that word ‘may’ was a “sticking point for corporate management when deciding whether and how to proceed with a potential merger or acquisition. There is a big difference between a theoretical outcome and one that is concrete and presumptively available.”

Three Key Takeaways

  1. The FCPA Corporate Enforcement Policy was amended in 2018 to provide a safe harbor in the M&A context.
  2. Pre and post-acquisition compliance work must be equally robust.
  3. If you find misconduct, report and remediate.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 503 no One Month to More Effective Compliance for Business Ventures - Auditing Joint Ventures JVs provide many FCPA risks that other types of business relationships do not bring. For instance, the JV may interact with foreign government officials or employees of a state-owned enterprise; then leverage those relationships for an improper benefit relating to contracts, regulatory licenses, permits or customs approvals. It is difficult to regulate a JVs interaction with foreign government officials when your partner is a state-owned enterprise, or where your company is relying on the local company for its local contacts and expertise for business development and/or regulatory knowledge and experience. The risks are compounded when the U.S. company does not exercise control of the JV. This is further compounded by the fact there is no minimum threshold for a FCPA enforcement action against a U.S. company for the actions of a JV in which it holds an interest. If a company holds something less than majority rights, it must to urge, beg and plead for the majority partner to adhere to anti-corruption compliance standards and controls. Often, these requirements are established in the JV agreement but the success in securing such contract protections depends on the importance of the global company to the JV itself. Another set of issues comes from the JV when it seeks to retain third-party agents and/or distributors. Depending on the amount of control, the U.S. company usually can impose its set of standards for conducting due diligence of third-party agents and distributors. These risks become more difficult when the JV partner brings a proposed third-party agent or distributor and vouches for the agent or distributor. If the JV partner is a state-owned enterprise, the issues become even more complicated as such a referral creates an obvious red flag for a government-sponsored referral. Three key takeaways:  JVs present unique FCPA risks and must be managed accordingly. Your final report needs to consider the final viewer of the document, potentially the DOJ or SEC. Be sure to follow up on any red flags raised but not cleared and action items for remediation or additional scrutiny. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 09 Mar 2023 05:00:00 -0000 Auditing Joint Ventures full Thomas Fox In this episode we consider the auditing of joint ventures. JVs provide many FCPA risks that other types of business relationships do not bring. For instance, the JV may interact with foreign government officials or employees of a state-owned enterprise; then leverage those relationships for an improper benefit relating to contracts, regulatory licenses, permits or customs approvals. It is difficult to regulate a JVs interaction with foreign government officials when your partner is a state-owned enterprise, or where your company is relying on the local company for its local contacts and expertise for business development and/or regulatory knowledge and experience. The risks are compounded when the U.S. company does not exercise control of the JV. This is further compounded by the fact there is no minimum threshold for a FCPA enforcement action against a U.S. company for the actions of a JV in which it holds an interest. If a company holds something less than majority rights, it must to urge, beg and plead for the majority partner to adhere to anti-corruption compliance standards and controls. Often, these requirements are established in the JV agreement but the success in securing such contract protections depends on the importance of the global company to the JV itself. Another set of issues comes from the JV when it seeks to retain third-party agents and/or distributors. Depending on the amount of control, the U.S. company usually can impose its set of standards for conducting due diligence of third-party agents and distributors. These risks become more difficult when the JV partner brings a proposed third-party agent or distributor and vouches for the agent or distributor. If the JV partner is a state-owned enterprise, the issues become even more complicated as such a referral creates an obvious red flag for a government-sponsored referral. Three key takeaways:  JVs present unique FCPA risks and must be managed accordingly. Your final report needs to consider the final viewer of the document, potentially the DOJ or SEC. Be sure to follow up on any red flags raised but not cleared and action items for remediation or additional scrutiny. Learn more about your ad choices. Visit megaphone.fm/adchoices JVs provide many FCPA risks that other types of business relationships do not bring. For instance, the JV may interact with foreign government officials or employees of a state-owned enterprise; then leverage those relationships for an improper benefit relating to contracts, regulatory licenses, permits or customs approvals. It is difficult to regulate a JVs interaction with foreign government officials when your partner is a state-owned enterprise, or where your company is relying on the local company for its local contacts and expertise for business development and/or regulatory knowledge and experience.

The risks are compounded when the U.S. company does not exercise control of the JV. This is further compounded by the fact there is no minimum threshold for a FCPA enforcement action against a U.S. company for the actions of a JV in which it holds an interest. If a company holds something less than majority rights, it must to urge, beg and plead for the majority partner to adhere to anti-corruption compliance standards and controls. Often, these requirements are established in the JV agreement but the success in securing such contract protections depends on the importance of the global company to the JV itself.

Another set of issues comes from the JV when it seeks to retain third-party agents and/or distributors. Depending on the amount of control, the U.S. company usually can impose its set of standards for conducting due diligence of third-party agents and distributors. These risks become more difficult when the JV partner brings a proposed third-party agent or distributor and vouches for the agent or distributor. If the JV partner is a state-owned enterprise, the issues become even more complicated as such a referral creates an obvious red flag for a government-sponsored referral.

Three key takeaways: 

  1. JVs present unique FCPA risks and must be managed accordingly.
  2. Your final report needs to consider the final viewer of the document, potentially the DOJ or SEC.
  3. Be sure to follow up on any red flags raised but not cleared and action items for remediation or additional scrutiny.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 528 no One Month to More Effective Compliance for Business Ventures - Compliance Terms and Conditions for TVs Numerous U.S. companies have come to FCPA grief for their overseas JVs and this continues to be a bane for many companies under the FCPA. There are some basic compliance terms and conditions which should be considered for any foreign JV agreement to help U.S. companies manage these compliance risks. As a starting point, it is important to have compliance terms and conditions, these reasons can include some of the following: 1) to set expectations between the parties; 2) to demonstrate the seriousness of the issue to the non-U.S. party; and 3) to provide a financial incentive to do business in compliant manner. This all must be spelled out for them, so you should have language regarding the following: Prohibition of all forms of bribery and corruption.  Right to cancel, and recoupment rights. Duties in JV Governance. Audit rights. Prohibited Parties. Certifications. After the contract is signed your company will have to work just as hard to keep the compliance program for any JV robust and meaningful. However, with these terms and conditions in place, you will have a chance to maintain your FCPA obligations and to manage the risk that is involved when working jointly with non-U.S. companies. Three key takeaways:  Failure to secure appropriate compliance terms and conditions in a JV agreement can cause great FCPA risk for a U.S. company. Certifications are important requirements to obtain. Audit rights must be secured and equally importantly, exercised. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 08 Mar 2023 05:00:00 -0000 Compliance Terms and Conditions full Thomas Fox In this episode, we consider Compliance Terms and Conditions for Joint Ventures. Numerous U.S. companies have come to FCPA grief for their overseas JVs and this continues to be a bane for many companies under the FCPA. There are some basic compliance terms and conditions which should be considered for any foreign JV agreement to help U.S. companies manage these compliance risks. As a starting point, it is important to have compliance terms and conditions, these reasons can include some of the following: 1) to set expectations between the parties; 2) to demonstrate the seriousness of the issue to the non-U.S. party; and 3) to provide a financial incentive to do business in compliant manner. This all must be spelled out for them, so you should have language regarding the following: Prohibition of all forms of bribery and corruption.  Right to cancel, and recoupment rights. Duties in JV Governance. Audit rights. Prohibited Parties. Certifications. After the contract is signed your company will have to work just as hard to keep the compliance program for any JV robust and meaningful. However, with these terms and conditions in place, you will have a chance to maintain your FCPA obligations and to manage the risk that is involved when working jointly with non-U.S. companies. Three key takeaways:  Failure to secure appropriate compliance terms and conditions in a JV agreement can cause great FCPA risk for a U.S. company. Certifications are important requirements to obtain. Audit rights must be secured and equally importantly, exercised. Learn more about your ad choices. Visit megaphone.fm/adchoices Numerous U.S. companies have come to FCPA grief for their overseas JVs and this continues to be a bane for many companies under the FCPA. There are some basic compliance terms and conditions which should be considered for any foreign JV agreement to help U.S. companies manage these compliance risks.

As a starting point, it is important to have compliance terms and conditions, these reasons can include some of the following: 1) to set expectations between the parties; 2) to demonstrate the seriousness of the issue to the non-U.S. party; and 3) to provide a financial incentive to do business in compliant manner. This all must be spelled out for them, so you should have language regarding the following:

  • Prohibition of all forms of bribery and corruption. 
  • Right to cancel, and recoupment rights.
  • Duties in JV Governance.
  • Audit rights.
  • Prohibited Parties.
  • Certifications.

After the contract is signed your company will have to work just as hard to keep the compliance program for any JV robust and meaningful. However, with these terms and conditions in place, you will have a chance to maintain your FCPA obligations and to manage the risk that is involved when working jointly with non-U.S. companies.

Three key takeaways: 

  1. Failure to secure appropriate compliance terms and conditions in a JV agreement can cause great FCPA risk for a U.S. company.
  2. Certifications are important requirements to obtain.
  3. Audit rights must be secured and equally importantly, exercised.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 502 no One Month to More Effective Compliance for Business Ventures - JV Due Diligence When you bring two entities together to operate jointly, there are several difficult issues to analyze. For the U.S. company operating under the FCPA, there must be an adequate business justification for a JV with a specific partner, all in writing and approved by an appropriate level of the organization. This is where the due diligence process comes into play. The due diligence process should be built on principles similar to those involving third-parties. The procedure should be robust, documented and address all potential risks involved. A company should use its due diligence review of the JV partner to properly assess and uncover any corruption risk. Using this due diligence and its evaluation, you can then move to contractual clauses, certifications, representations and warranties from a JV partner or insist on other remedial measures to minimize its risk exposure. A U.S. business looking to engage a JV partner must consider the people who make up its JV partner. As you will have to mesh what may be two very different cultures and understandings of compliance, it is important to assess how your potential JV partner will take these obligations before, rather than after you ink the JV agreement. Three key takeaways:  JV due diligence must focus on the unique risks. Ask for a detailed list of information from your potential JV partner. Be sure to do onsite investigation of your potential JV partner. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 07 Mar 2023 05:00:00 -0000 JV Due Diligence full Thomas Fox In this episode, we take up Joint Venture Due Diligence. When you bring two entities together to operate jointly, there are several difficult issues to analyze. For the U.S. company operating under the FCPA, there must be an adequate business justification for a JV with a specific partner, all in writing and approved by an appropriate level of the organization. This is where the due diligence process comes into play. The due diligence process should be built on principles similar to those involving third-parties. The procedure should be robust, documented and address all potential risks involved. A company should use its due diligence review of the JV partner to properly assess and uncover any corruption risk. Using this due diligence and its evaluation, you can then move to contractual clauses, certifications, representations and warranties from a JV partner or insist on other remedial measures to minimize its risk exposure. A U.S. business looking to engage a JV partner must consider the people who make up its JV partner. As you will have to mesh what may be two very different cultures and understandings of compliance, it is important to assess how your potential JV partner will take these obligations before, rather than after you ink the JV agreement. Three key takeaways:  JV due diligence must focus on the unique risks. Ask for a detailed list of information from your potential JV partner. Be sure to do onsite investigation of your potential JV partner. Learn more about your ad choices. Visit megaphone.fm/adchoices When you bring two entities together to operate jointly, there are several difficult issues to analyze. For the U.S. company operating under the FCPA, there must be an adequate business justification for a JV with a specific partner, all in writing and approved by an appropriate level of the organization. This is where the due diligence process comes into play. The due diligence process should be built on principles similar to those involving third-parties.

The procedure should be robust, documented and address all potential risks involved. A company should use its due diligence review of the JV partner to properly assess and uncover any corruption risk. Using this due diligence and its evaluation, you can then move to contractual clauses, certifications, representations and warranties from a JV partner or insist on other remedial measures to minimize its risk exposure.

A U.S. business looking to engage a JV partner must consider the people who make up its JV partner. As you will have to mesh what may be two very different cultures and understandings of compliance, it is important to assess how your potential JV partner will take these obligations before, rather than after you ink the JV agreement.

Three key takeaways: 

  1. JV due diligence must focus on the unique risks.
  2. Ask for a detailed list of information from your potential JV partner.
  3. Be sure to do onsite investigation of your potential JV partner.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 565 no One Month to More Effective Compliance for Business Ventures - JV risks under the FCPA Just as the FCPA enforcement field is covered with actions centering around M&A, there are multiple actions involving JVs. JVs continue to plague many U.S. companies up to this day. In many ways, JVs present more difficult issues for the compliance practitioner than M&A because of the control issues present in JVs with foreign governments or state-owned enterprises ownership. There are other risks that a company must seek to avoid. These include the transfer of things of value to a state-owned enterprise for benefits of someone outside the JV. A company must avoid payments for which there is no legitimate business purpose to the state-owned enterprise in the JV itself; as they will be deemed to be illegal benefits to the state-owned enterprise outside the JV.  The bottom line is JVs present a unique set of FCPA risks for the compliance practitioner. You will need to incorporate risk management techniques in all phases of the JV relations; pre-formation, the JV agreement and in operations after the JV has begun operation. The compliance obligations and compliance process are ongoing. Three key takeaways:  JVs present unique FCPA risks. Control is only one issue a compliance practitioner must consider in evaluating JV risks. Companies continue to have significant FCPA risks from JVs. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 06 Mar 2023 05:00:00 -0000 JV risks under the FCPA full Thomas Fox Today, I look at JV risks under the FCPA. Just as the FCPA enforcement field is covered with actions centering around M&A, there are multiple actions involving JVs. JVs continue to plague many U.S. companies up to this day. In many ways, JVs present more difficult issues for the compliance practitioner than M&A because of the control issues present in JVs with foreign governments or state-owned enterprises ownership. There are other risks that a company must seek to avoid. These include the transfer of things of value to a state-owned enterprise for benefits of someone outside the JV. A company must avoid payments for which there is no legitimate business purpose to the state-owned enterprise in the JV itself; as they will be deemed to be illegal benefits to the state-owned enterprise outside the JV.  The bottom line is JVs present a unique set of FCPA risks for the compliance practitioner. You will need to incorporate risk management techniques in all phases of the JV relations; pre-formation, the JV agreement and in operations after the JV has begun operation. The compliance obligations and compliance process are ongoing. Three key takeaways:  JVs present unique FCPA risks. Control is only one issue a compliance practitioner must consider in evaluating JV risks. Companies continue to have significant FCPA risks from JVs. Learn more about your ad choices. Visit megaphone.fm/adchoices Just as the FCPA enforcement field is covered with actions centering around M&A, there are multiple actions involving JVs. JVs continue to plague many U.S. companies up to this day. In many ways, JVs present more difficult issues for the compliance practitioner than M&A because of the control issues present in JVs with foreign governments or state-owned enterprises ownership.

There are other risks that a company must seek to avoid. These include the transfer of things of value to a state-owned enterprise for benefits of someone outside the JV. A company must avoid payments for which there is no legitimate business purpose to the state-owned enterprise in the JV itself; as they will be deemed to be illegal benefits to the state-owned enterprise outside the JV. 

The bottom line is JVs present a unique set of FCPA risks for the compliance practitioner. You will need to incorporate risk management techniques in all phases of the JV relations; pre-formation, the JV agreement and in operations after the JV has begun operation. The compliance obligations and compliance process are ongoing.

Three key takeaways: 

  1. JVs present unique FCPA risks.
  2. Control is only one issue a compliance practitioner must consider in evaluating JV risks.
  3. Companies continue to have significant FCPA risks from JVs.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 614 no One Month to More Effective Compliance on Business Ventures: Dis-Linking Illegal Conduct One of my favorite words in the context of FCPA enforcement is dis-link. It a useful adjective in explaining how certain conduct by a company must be separated from the winning of business and more broadly it works on many different levels when discussing the FCPA. This concept of dis-linking was most prominently laid out in Opinion Release 14-02. It provided one of the most concrete statements from the DOJ on the unidimensional nature of compliance in the M&A context; both in the pre-acquisition and post-acquisition phases. Opinion Release 14-02, taken together with the steps laid out in the 2020 FCPA Resource Guide, 2nd edition, has provided the post-acquisition actions a compliance professional needs to take after the transaction is closed. If you cannot perform any or even an adequate pre-acquisition due diligence, the time frames you put in place after the acquisition closes will need to be compressed to make sure that you are not continuing any nefarious FCPA conduct going forward. But it all goes back to dis-linking. If a Target is engaging in conduct that violates the FCPA but the Target itself is not subject to the jurisdiction of the FCPA, you simply cannot afford to allow that conduct to continue. If you do allow such conduct to continue your company will be actively engaging and participating in an ongoing FCPA violation. That is the final takeaway from this Opinion Release; it is allowing corruption and bribery to continue which brings companies into FCPA grief. Opinion Release 14-02 provides a roadmap of the steps you can take to prevent such exposure. Three key takeaways:  In the M&A context, the key is to dis-link any illegal conduct going forward. Opinion Release 14-02 provides the clearest roadmap for pre- and post-acquisition compliance actions in the M&A context. Never forget the Opinion Release procedure. It has been used successfully in two important M&A matters (08-02 and 14-02). Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 03 Mar 2023 05:00:00 -0000 Dis-Linking Illegal Conduct full Thomas Fox In this episode, we discuss the dis-linking of illegal conduct in the M&A context. One of my favorite words in the context of FCPA enforcement is dis-link. It a useful adjective in explaining how certain conduct by a company must be separated from the winning of business and more broadly it works on many different levels when discussing the FCPA. This concept of dis-linking was most prominently laid out in Opinion Release 14-02. It provided one of the most concrete statements from the DOJ on the unidimensional nature of compliance in the M&A context; both in the pre-acquisition and post-acquisition phases. Opinion Release 14-02, taken together with the steps laid out in the 2020 FCPA Resource Guide, 2nd edition, has provided the post-acquisition actions a compliance professional needs to take after the transaction is closed. If you cannot perform any or even an adequate pre-acquisition due diligence, the time frames you put in place after the acquisition closes will need to be compressed to make sure that you are not continuing any nefarious FCPA conduct going forward. But it all goes back to dis-linking. If a Target is engaging in conduct that violates the FCPA but the Target itself is not subject to the jurisdiction of the FCPA, you simply cannot afford to allow that conduct to continue. If you do allow such conduct to continue your company will be actively engaging and participating in an ongoing FCPA violation. That is the final takeaway from this Opinion Release; it is allowing corruption and bribery to continue which brings companies into FCPA grief. Opinion Release 14-02 provides a roadmap of the steps you can take to prevent such exposure. Three key takeaways:  In the M&A context, the key is to dis-link any illegal conduct going forward. Opinion Release 14-02 provides the clearest roadmap for pre- and post-acquisition compliance actions in the M&A context. Never forget the Opinion Release procedure. It has been used successfully in two important M&A matters (08-02 and 14-02). Learn more about your ad choices. Visit megaphone.fm/adchoices One of my favorite words in the context of FCPA enforcement is dis-link. It a useful adjective in explaining how certain conduct by a company must be separated from the winning of business and more broadly it works on many different levels when discussing the FCPA. This concept of dis-linking was most prominently laid out in Opinion Release 14-02. It provided one of the most concrete statements from the DOJ on the unidimensional nature of compliance in the M&A context; both in the pre-acquisition and post-acquisition phases.

Opinion Release 14-02, taken together with the steps laid out in the 2020 FCPA Resource Guide, 2nd edition, has provided the post-acquisition actions a compliance professional needs to take after the transaction is closed. If you cannot perform any or even an adequate pre-acquisition due diligence, the time frames you put in place after the acquisition closes will need to be compressed to make sure that you are not continuing any nefarious FCPA conduct going forward.

But it all goes back to dis-linking. If a Target is engaging in conduct that violates the FCPA but the Target itself is not subject to the jurisdiction of the FCPA, you simply cannot afford to allow that conduct to continue. If you do allow such conduct to continue your company will be actively engaging and participating in an ongoing FCPA violation. That is the final takeaway from this Opinion Release; it is allowing corruption and bribery to continue which brings companies into FCPA grief. Opinion Release 14-02 provides a roadmap of the steps you can take to prevent such exposure.

Three key takeaways: 

  1. In the M&A context, the key is to dis-link any illegal conduct going forward.
  2. Opinion Release 14-02 provides the clearest roadmap for pre- and post-acquisition compliance actions in the M&A context.
  3. Never forget the Opinion Release procedure. It has been used successfully in two important M&A matters (08-02 and 14-02).


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 599 no One Month to More Effective Compliance on Business Ventures: Key M&A cases under the FCPA What are some of the key FCPA enforcement actions involving M&A? These enforcement actions, FCPA Resource Guide and the Evaluation of Corporate Compliance Program (and Update) have all made clear that the DOJ and SEC will vigorously prosecute companies which allow bribery and corruption to continue after a merger or purchase occurs. The key point to remember is that if a company was engaging in bribery and corruption before it was acquired and continues to do so after the transaction is completed, it is now you who is engaging in bribery and corruption, not them. Syncor International Corporation, 2002.  This was the first time the DOJ charged a foreign company under the 1998 amendments, for acts taking place in the U.S. (i.e., Chairman’s approval). Parent liability was established through the foreign subsidiary’s books and records and employees of a state-owned entity are instrumentalities of the government. This case also demonstrated how a government investigation can slow the closing of an acquisition as the acquisition by Cardinal Health was delayed until the investigation was concluded and agreements were struck with the DOJ and SEC. The acquirer brought Syncor for a lower price than originally negotiated. Titan Corporation, 2005. Some of the basic tenets of a compliance program were laid out in this enforcement action. They included: a company must conduct meaningful due diligence with respect to foreign agents and consultants and must ensure that the services alleged to be performed are provided. Internal controls must be designed to detect “red flags”, such as offshore payments and inconsistent invoices. From the M&A perspective, representations and warranties in a merger agreement must be accurate (or qualified) when included in a proxy statement. There can be a risk of additional prosecution under the International Traffic in Arms Regulations (ITAR) and possible suspension of export privileges, potential U.S. and foreign tax exposure and possible contractor debarment issues by the Department of Defense. Ultimately and most importantly from the business perspective, the merger failed when Titan was unable to meet contractual agreement to settle with the U.S. government by a certain time. Latin Node, 2009. This was the first FCPA enforcement action based entirely on pre-acquisition conduct that was unknown to the buyer when the transaction closed. The purchaser’s entire $22+ million investment in Latin Node was wiped out due to inflated acquisition price of corrupt company and investigation costs. All of this demonstrated the need for rigorous pre-acquisition due diligence in addition to the post-acquisition integration. It also exposed individuals to the real possibility of jail time for their actions. There have been several M&A cases since these three, but they set the model for the DOJ’s prosecution going forward. Every compliance practitioner should be aware of these cases and communicate to management that one of the most well settled areas of FCPA enforcement is around M&A. Simply put if you do not engage in appropriate pre-acquisition due diligence and there continues to be ongoing bribery and corruption after you acquire an entity, your company will bear the brunt of any prosecution. Three key takeaways:  FCPA enforcement in the M&A space is one of the most well settled areas of enforcement.  Failure to perform pre-acquisition due diligence can significantly devalue a purchased asset. Always remember that if bribery continues after an acquisition it is no longer them engaging in bribery and corruption but you who are engaging in bribery and corruption. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 02 Mar 2023 05:00:00 -0000 Key M&A cases under the FCPA full Thomas Fox What are the key M&A Foreign Corrupt Practices Act enforcement actions? What are some of the key FCPA enforcement actions involving M&A? These enforcement actions, FCPA Resource Guide and the Evaluation of Corporate Compliance Program (and Update) have all made clear that the DOJ and SEC will vigorously prosecute companies which allow bribery and corruption to continue after a merger or purchase occurs. The key point to remember is that if a company was engaging in bribery and corruption before it was acquired and continues to do so after the transaction is completed, it is now you who is engaging in bribery and corruption, not them. Syncor International Corporation, 2002.  This was the first time the DOJ charged a foreign company under the 1998 amendments, for acts taking place in the U.S. (i.e., Chairman’s approval). Parent liability was established through the foreign subsidiary’s books and records and employees of a state-owned entity are instrumentalities of the government. This case also demonstrated how a government investigation can slow the closing of an acquisition as the acquisition by Cardinal Health was delayed until the investigation was concluded and agreements were struck with the DOJ and SEC. The acquirer brought Syncor for a lower price than originally negotiated. Titan Corporation, 2005. Some of the basic tenets of a compliance program were laid out in this enforcement action. They included: a company must conduct meaningful due diligence with respect to foreign agents and consultants and must ensure that the services alleged to be performed are provided. Internal controls must be designed to detect “red flags”, such as offshore payments and inconsistent invoices. From the M&A perspective, representations and warranties in a merger agreement must be accurate (or qualified) when included in a proxy statement. There can be a risk of additional prosecution under the International Traffic in Arms Regulations (ITAR) and possible suspension of export privileges, potential U.S. and foreign tax exposure and possible contractor debarment issues by the Department of Defense. Ultimately and most importantly from the business perspective, the merger failed when Titan was unable to meet contractual agreement to settle with the U.S. government by a certain time. Latin Node, 2009. This was the first FCPA enforcement action based entirely on pre-acquisition conduct that was unknown to the buyer when the transaction closed. The purchaser’s entire $22+ million investment in Latin Node was wiped out due to inflated acquisition price of corrupt company and investigation costs. All of this demonstrated the need for rigorous pre-acquisition due diligence in addition to the post-acquisition integration. It also exposed individuals to the real possibility of jail time for their actions. There have been several M&A cases since these three, but they set the model for the DOJ’s prosecution going forward. Every compliance practitioner should be aware of these cases and communicate to management that one of the most well settled areas of FCPA enforcement is around M&A. Simply put if you do not engage in appropriate pre-acquisition due diligence and there continues to be ongoing bribery and corruption after you acquire an entity, your company will bear the brunt of any prosecution. Three key takeaways:  FCPA enforcement in the M&A space is one of the most well settled areas of enforcement.  Failure to perform pre-acquisition due diligence can significantly devalue a purchased asset. Always remember that if bribery continues after an acquisition it is no longer them engaging in bribery and corruption but you who are engaging in bribery and corruption. Learn more about your ad choices. Visit megaphone.fm/adchoices What are some of the key FCPA enforcement actions involving M&A? These enforcement actions, FCPA Resource Guide and the Evaluation of Corporate Compliance Program (and Update) have all made clear that the DOJ and SEC will vigorously prosecute companies which allow bribery and corruption to continue after a merger or purchase occurs. The key point to remember is that if a company was engaging in bribery and corruption before it was acquired and continues to do so after the transaction is completed, it is now you who is engaging in bribery and corruption, not them.

Syncor International Corporation, 2002.  This was the first time the DOJ charged a foreign company under the 1998 amendments, for acts taking place in the U.S. (i.e., Chairman’s approval). Parent liability was established through the foreign subsidiary’s books and records and employees of a state-owned entity are instrumentalities of the government. This case also demonstrated how a government investigation can slow the closing of an acquisition as the acquisition by Cardinal Health was delayed until the investigation was concluded and agreements were struck with the DOJ and SEC. The acquirer brought Syncor for a lower price than originally negotiated.

Titan Corporation, 2005. Some of the basic tenets of a compliance program were laid out in this enforcement action. They included: a company must conduct meaningful due diligence with respect to foreign agents and consultants and must ensure that the services alleged to be performed are provided. Internal controls must be designed to detect “red flags”, such as offshore payments and inconsistent invoices. From the M&A perspective, representations and warranties in a merger agreement must be accurate (or qualified) when included in a proxy statement. There can be a risk of additional prosecution under the International Traffic in Arms Regulations (ITAR) and possible suspension of export privileges, potential U.S. and foreign tax exposure and possible contractor debarment issues by the Department of Defense. Ultimately and most importantly from the business perspective, the merger failed when Titan was unable to meet contractual agreement to settle with the U.S. government by a certain time.

Latin Node, 2009. This was the first FCPA enforcement action based entirely on pre-acquisition conduct that was unknown to the buyer when the transaction closed. The purchaser’s entire $22+ million investment in Latin Node was wiped out due to inflated acquisition price of corrupt company and investigation costs. All of this demonstrated the need for rigorous pre-acquisition due diligence in addition to the post-acquisition integration. It also exposed individuals to the real possibility of jail time for their actions.

There have been several M&A cases since these three, but they set the model for the DOJ’s prosecution going forward. Every compliance practitioner should be aware of these cases and communicate to management that one of the most well settled areas of FCPA enforcement is around M&A. Simply put if you do not engage in appropriate pre-acquisition due diligence and there continues to be ongoing bribery and corruption after you acquire an entity, your company will bear the brunt of any prosecution.

Three key takeaways: 

  1. FCPA enforcement in the M&A space is one of the most well settled areas of enforcement.
  2.  Failure to perform pre-acquisition due diligence can significantly devalue a purchased asset.
  3. Always remember that if bribery continues after an acquisition it is no longer them engaging in bribery and corruption but you who are engaging in bribery and corruption.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 628 no One Month to More Effective Compliance on Business Ventures: Introduction For the month of March, we will be considering how to create a more effective compliance program involving business ventures. This will include the role of compliance in M&A, JV agreements, distributorships, teaming agreements and franchises as well as other forms of business relationships. The FCPA Resource Guide, 2nd edition made clear that one of the Hallmarks of An Effective Compliance Program is around M&A, in both the pre- and post-acquisition context. A company that does not perform adequate due diligence prior to a merger or acquisition it may face both legal and business risks. Perhaps, most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. In contrast, companies that conduct effective due diligence on their acquisition targets can evaluate more accurately each target’s value and negotiate for the costs of the bribery to be borne by the target. Equally important is that if a company engages in the suggested actions, they will go a long way towards insulating, or at least lessening, the risk of FCPA liability going forward. The 2020 Update went on to say that to “The extent to which a company subjects its acquisition targets to appropriate scrutiny is indicative of whether its compliance program is, as implemented, able to effectively enforce its internal controls and remediate misconduct at all levels of the organization” and posed the following queries. One of the key themes in this chapter is the integrated nature of compliance and business ventures. Whether the compliance work is seen in the M&A context, JV context or one of the myriad of other business relationships of the current business world, there is an approach that a CCO or compliance professional should take to assess the risk, monitor the risk and then manage the risk with continued monitoring with a feedback of data and information into your risk management strategy. Three key takeaways:  Consider the role of compliance in a wide variety of business relationships, including M&A, JV agreements, distributorships and franchises as well as other forms of business relationships. Compliance for M&A should be seen as a unidimensional continuum. The Evaluationfocuses on what data did your risk monitoring system turn up and how did you utilize it going forward? Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 01 Mar 2023 05:00:00 -0000 Introduction to Business Ventures full Thomas Fox In this episode, we introduce March's topic on One Month to a More Effective Compliance Program; business ventures. For the month of March, we will be considering how to create a more effective compliance program involving business ventures. This will include the role of compliance in M&A, JV agreements, distributorships, teaming agreements and franchises as well as other forms of business relationships. The FCPA Resource Guide, 2nd edition made clear that one of the Hallmarks of An Effective Compliance Program is around M&A, in both the pre- and post-acquisition context. A company that does not perform adequate due diligence prior to a merger or acquisition it may face both legal and business risks. Perhaps, most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. In contrast, companies that conduct effective due diligence on their acquisition targets can evaluate more accurately each target’s value and negotiate for the costs of the bribery to be borne by the target. Equally important is that if a company engages in the suggested actions, they will go a long way towards insulating, or at least lessening, the risk of FCPA liability going forward. The 2020 Update went on to say that to “The extent to which a company subjects its acquisition targets to appropriate scrutiny is indicative of whether its compliance program is, as implemented, able to effectively enforce its internal controls and remediate misconduct at all levels of the organization” and posed the following queries. One of the key themes in this chapter is the integrated nature of compliance and business ventures. Whether the compliance work is seen in the M&A context, JV context or one of the myriad of other business relationships of the current business world, there is an approach that a CCO or compliance professional should take to assess the risk, monitor the risk and then manage the risk with continued monitoring with a feedback of data and information into your risk management strategy. Three key takeaways:  Consider the role of compliance in a wide variety of business relationships, including M&A, JV agreements, distributorships and franchises as well as other forms of business relationships. Compliance for M&A should be seen as a unidimensional continuum. The Evaluationfocuses on what data did your risk monitoring system turn up and how did you utilize it going forward? Learn more about your ad choices. Visit megaphone.fm/adchoices For the month of March, we will be considering how to create a more effective compliance program involving business ventures. This will include the role of compliance in M&A, JV agreements, distributorships, teaming agreements and franchises as well as other forms of business relationships.

The FCPA Resource Guide, 2nd edition made clear that one of the Hallmarks of An Effective Compliance Program is around M&A, in both the pre- and post-acquisition context. A company that does not perform adequate due diligence prior to a merger or acquisition it may face both legal and business risks. Perhaps, most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. In contrast, companies that conduct effective due diligence on their acquisition targets can evaluate more accurately each target’s value and negotiate for the costs of the bribery to be borne by the target. Equally important is that if a company engages in the suggested actions, they will go a long way towards insulating, or at least lessening, the risk of FCPA liability going forward.

The 2020 Update went on to say that to “The extent to which a company subjects its acquisition targets to appropriate scrutiny is indicative of whether its compliance program is, as implemented, able to effectively enforce its internal controls and remediate misconduct at all levels of the organization” and posed the following queries.

One of the key themes in this chapter is the integrated nature of compliance and business ventures. Whether the compliance work is seen in the M&A context, JV context or one of the myriad of other business relationships of the current business world, there is an approach that a CCO or compliance professional should take to assess the risk, monitor the risk and then manage the risk with continued monitoring with a feedback of data and information into your risk management strategy.

Three key takeaways: 

  1. Consider the role of compliance in a wide variety of business relationships, including M&A, JV agreements, distributorships and franchises as well as other forms of business relationships.
  2. Compliance for M&A should be seen as a unidimensional continuum.
  3. The Evaluationfocuses on what data did your risk monitoring system turn up and how did you utilize it going forward?


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 515 no One Month to More Effective Internal Controls - Culture as a Foundational Internal Control To conclude this month's series on Internal Controls, I am joined by Vin DiCianni, Founder and CEO of AMI. We discuss how corporate culture is a foundational internal control. It is a fascinating topic that is not discussed enough by compliance professionals. 3 Key Takeaways. It must start at the top. Hiring is critical to creating and sustaining an ethical culture. Creative internal controls around culture. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 28 Feb 2023 05:00:00 -0000 Culture as a Foundational Internal Control full Thomas Fox How is Culture as a Foundational Internal Control? Find out in the concluding episode of this month's 31 Days to a More Effective Compliance Program. To conclude this month's series on Internal Controls, I am joined by Vin DiCianni, Founder and CEO of AMI. We discuss how corporate culture is a foundational internal control. It is a fascinating topic that is not discussed enough by compliance professionals. 3 Key Takeaways. It must start at the top. Hiring is critical to creating and sustaining an ethical culture. Creative internal controls around culture. Learn more about your ad choices. Visit megaphone.fm/adchoices To conclude this month's series on Internal Controls, I am joined by Vin DiCianni, Founder and CEO of AMI. We discuss how corporate culture is a foundational internal control. It is a fascinating topic that is not discussed enough by compliance professionals.

3 Key Takeaways.

  1. It must start at the top.
  2. Hiring is critical to creating and sustaining an ethical culture.
  3. Creative internal controls around culture.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 645 no One Month to More Effective Internal Controls - Assessing compliance internal controls One of the specific requirements laid out in the 2020 Update, is around internal controls and more specifically control testing. It stated: Control Testing – Has the company reviewed and audited its compliance program in the area relating to the misconduct? More generally, what testing of controls, collection and analysis of compliance data, and interviews of employees and third-parties does the company undertake? How are the results reported and action items tracked?    Fortunately, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) 2013 Internal Controls Framework considers assessing compliance internal controls. In “Internal Controls – Integrated Framework, Illustrative Tools for Assessing Effectiveness of a System of Internal Controls”, COSO laid out its views on assessing the effectiveness of internal controls. It noted that an effective system of internal controls provides “reasonable assurance of achievement of the entity’s objectives, relating to operations, reporting and compliance.” Moreover, there are two over-arching requirements that can only be met through such a structured protocol. First, each of the five components are present and functioning. Second, that the five components operate in an integrated fashion with each other. One of the most critical components of the COSO Framework is that it sets internal control standards against those which you can audit to assess the strength of your compliance internal controls. Three key takeaways: An effective system of internal controls provides reasonable assurance of achievement of the company’s objectives, relating to operations, reporting and compliance. There are two over-arching requirements for effective internal controls. First, each of the five components are present and function. Second, are the five components operating together in an integrated approach. For an anti-corruption compliance program, you can use the Hallmarks of an Effective Compliance Program as your guide to test against. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 27 Feb 2023 05:00:00 -0000 Assessing compliance internal controls full Thomas Fox In this episode, we consider assessing compliance internal controls. One of the specific requirements laid out in the 2020 Update, is around internal controls and more specifically control testing. It stated: Control Testing – Has the company reviewed and audited its compliance program in the area relating to the misconduct? More generally, what testing of controls, collection and analysis of compliance data, and interviews of employees and third-parties does the company undertake? How are the results reported and action items tracked?    Fortunately, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) 2013 Internal Controls Framework considers assessing compliance internal controls. In “Internal Controls – Integrated Framework, Illustrative Tools for Assessing Effectiveness of a System of Internal Controls”, COSO laid out its views on assessing the effectiveness of internal controls. It noted that an effective system of internal controls provides “reasonable assurance of achievement of the entity’s objectives, relating to operations, reporting and compliance.” Moreover, there are two over-arching requirements that can only be met through such a structured protocol. First, each of the five components are present and functioning. Second, that the five components operate in an integrated fashion with each other. One of the most critical components of the COSO Framework is that it sets internal control standards against those which you can audit to assess the strength of your compliance internal controls. Three key takeaways: An effective system of internal controls provides reasonable assurance of achievement of the company’s objectives, relating to operations, reporting and compliance. There are two over-arching requirements for effective internal controls. First, each of the five components are present and function. Second, are the five components operating together in an integrated approach. For an anti-corruption compliance program, you can use the Hallmarks of an Effective Compliance Program as your guide to test against. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the specific requirements laid out in the 2020 Update, is around internal controls and more specifically control testing. It stated:

Control Testing – Has the company reviewed and audited its compliance program in the area relating to the misconduct? More generally, what testing of controls, collection and analysis of compliance data, and interviews of employees and third-parties does the company undertake? How are the results reported and action items tracked?   

Fortunately, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) 2013 Internal Controls Framework considers assessing compliance internal controls. In “Internal Controls – Integrated Framework, Illustrative Tools for Assessing Effectiveness of a System of Internal Controls”, COSO laid out its views on assessing the effectiveness of internal controls. It noted that an effective system of internal controls provides “reasonable assurance of achievement of the entity’s objectives, relating to operations, reporting and compliance.” Moreover, there are two over-arching requirements that can only be met through such a structured protocol. First, each of the five components are present and functioning. Second, that the five components operate in an integrated fashion with each other. One of the most critical components of the COSO Framework is that it sets internal control standards against those which you can audit to assess the strength of your compliance internal controls.

Three key takeaways:

  1. An effective system of internal controls provides reasonable assurance of achievement of the company’s objectives, relating to operations, reporting and compliance.
  2. There are two over-arching requirements for effective internal controls. First, each of the five components are present and function. Second, are the five components operating together in an integrated approach.
  3. For an anti-corruption compliance program, you can use the Hallmarks of an Effective Compliance Program as your guide to test against.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 481 no One Month to More Effective Internal Controls - COSO Objective V: Monitoring Activities The fifth and final Objective is Monitoring Activities and as with all other components of the COSO Cube, Monitoring Activities are part of an inter-related whole and cannot be taken singularly. For the CCO or compliance practitioner, Monitoring Activities has been growing in importance over the past few years and will continue to do so in the future as is reinforced in the COSO 2013 Internal Controls Framework. The Monitoring Activities objective consists of two principles: 1) The organization selects, develops and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning; and 2) the organization evaluates and communicates internal control deficiencies timely to those parties responsible for taking corrective action, including senior management and the Board of Directors, as appropriate. Principle 16: Ongoing evaluation. Principle 17: Evaluation and communication of deficiencies.  Monitoring Activities should bring together your entire compliance program and give you a sense of whether it is running properly. Both ongoing monitoring and auditing are tools the CCO and compliance practitioner should use in support of this objective. The most important item to note is that all the controls need to be sustainable. You cannot just build one-off controls and not have a process in place to help you monitor all the controls that you need to cover. Controls cannot just be a one and done. Many companies are going to find that their initial approach to all of this is one and done. There must also be a mechanism in place for the communication of controls which do not work or can readily be over-ridden. From there, you must be able to remediate your controls going forward. This will align with the compliance professional’s requirement to prevent, detect and remediate going forward. Three key takeaways: Monitoring activities is inter-related with all other Principles and cannot be taken singularly. Monitoring activities helps to ensure that all controls are present and functioning. Monitoring Activities should bring together your entire compliance program and give you a sense of whether it is running properly. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 24 Feb 2023 05:00:00 -0000 COSO Objective V: Monitoring Activities full Thomas Fox Today we take up COSO Objective V: Monitoring Activities. The fifth and final Objective is Monitoring Activities and as with all other components of the COSO Cube, Monitoring Activities are part of an inter-related whole and cannot be taken singularly. For the CCO or compliance practitioner, Monitoring Activities has been growing in importance over the past few years and will continue to do so in the future as is reinforced in the COSO 2013 Internal Controls Framework. The Monitoring Activities objective consists of two principles: 1) The organization selects, develops and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning; and 2) the organization evaluates and communicates internal control deficiencies timely to those parties responsible for taking corrective action, including senior management and the Board of Directors, as appropriate. Principle 16: Ongoing evaluation. Principle 17: Evaluation and communication of deficiencies.  Monitoring Activities should bring together your entire compliance program and give you a sense of whether it is running properly. Both ongoing monitoring and auditing are tools the CCO and compliance practitioner should use in support of this objective. The most important item to note is that all the controls need to be sustainable. You cannot just build one-off controls and not have a process in place to help you monitor all the controls that you need to cover. Controls cannot just be a one and done. Many companies are going to find that their initial approach to all of this is one and done. There must also be a mechanism in place for the communication of controls which do not work or can readily be over-ridden. From there, you must be able to remediate your controls going forward. This will align with the compliance professional’s requirement to prevent, detect and remediate going forward. Three key takeaways: Monitoring activities is inter-related with all other Principles and cannot be taken singularly. Monitoring activities helps to ensure that all controls are present and functioning. Monitoring Activities should bring together your entire compliance program and give you a sense of whether it is running properly. Learn more about your ad choices. Visit megaphone.fm/adchoices The fifth and final Objective is Monitoring Activities and as with all other components of the COSO Cube, Monitoring Activities are part of an inter-related whole and cannot be taken singularly. For the CCO or compliance practitioner, Monitoring Activities has been growing in importance over the past few years and will continue to do so in the future as is reinforced in the COSO 2013 Internal Controls Framework.

The Monitoring Activities objective consists of two principles: 1) The organization selects, develops and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning; and 2) the organization evaluates and communicates internal control deficiencies timely to those parties responsible for taking corrective action, including senior management and the Board of Directors, as appropriate.

Principle 16: Ongoing evaluation.

Principle 17: Evaluation and communication of deficiencies. 

Monitoring Activities should bring together your entire compliance program and give you a sense of whether it is running properly. Both ongoing monitoring and auditing are tools the CCO and compliance practitioner should use in support of this objective.

The most important item to note is that all the controls need to be sustainable. You cannot just build one-off controls and not have a process in place to help you monitor all the controls that you need to cover. Controls cannot just be a one and done. Many companies are going to find that their initial approach to all of this is one and done.

There must also be a mechanism in place for the communication of controls which do not work or can readily be over-ridden. From there, you must be able to remediate your controls going forward. This will align with the compliance professional’s requirement to prevent, detect and remediate going forward.

Three key takeaways:

  1. Monitoring activities is inter-related with all other Principles and cannot be taken singularly.
  2. Monitoring activities helps to ensure that all controls are present and functioning.
  3. Monitoring Activities should bring together your entire compliance program and give you a sense of whether it is running properly.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 579 no One Month to More Effective Internal Controls - COSO Objective IV: Information and Communication As with the other components of the COSO Cube, the objective of Information and Communication is not to be taken in a vacuum. Indeed, one of the more interesting aspects of this objective is that it runs not only vertically but also horizontally. Principle 13: Use of relevant and quality information. Principle 14: Communicate internally. Principle 15: Communicate externally. Obviously, there must be communications up and down from the Board but also within an organization for dissemination of the appropriate compliance related information. For this principle, the CCO or compliance practitioner should also evaluate the communication lines to third parties. This communication can flow both ways, as noted, with compliance obligations to third parties but also information in the form of compliance issues back from third parties. Communication internally is how you establish the communications with your sales organization, with your sales operations. How do you establish communications with the legal organization? How do you establish information with the post-sales organizations? Even with the auditors, and your internal auditors and your external auditors and the board, to give the Audit Committee of the Board comfort that the company has put in place the right levels of controls. Three key takeaways: Consider the use of relevant and quality information. You need to document your internal communications so auditors can review the audit trail. This objective relates to your third-party compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 23 Feb 2023 05:00:00 -0000 COSO Objective IV: Information and Communication full Thomas Fox In this episode, we consider COSO Objective IV: Information and Communication. As with the other components of the COSO Cube, the objective of Information and Communication is not to be taken in a vacuum. Indeed, one of the more interesting aspects of this objective is that it runs not only vertically but also horizontally. Principle 13: Use of relevant and quality information. Principle 14: Communicate internally. Principle 15: Communicate externally. Obviously, there must be communications up and down from the Board but also within an organization for dissemination of the appropriate compliance related information. For this principle, the CCO or compliance practitioner should also evaluate the communication lines to third parties. This communication can flow both ways, as noted, with compliance obligations to third parties but also information in the form of compliance issues back from third parties. Communication internally is how you establish the communications with your sales organization, with your sales operations. How do you establish communications with the legal organization? How do you establish information with the post-sales organizations? Even with the auditors, and your internal auditors and your external auditors and the board, to give the Audit Committee of the Board comfort that the company has put in place the right levels of controls. Three key takeaways: Consider the use of relevant and quality information. You need to document your internal communications so auditors can review the audit trail. This objective relates to your third-party compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices As with the other components of the COSO Cube, the objective of Information and Communication is not to be taken in a vacuum. Indeed, one of the more interesting aspects of this objective is that it runs not only vertically but also horizontally.

Principle 13: Use of relevant and quality information.

Principle 14: Communicate internally.

Principle 15: Communicate externally.

Obviously, there must be communications up and down from the Board but also within an organization for dissemination of the appropriate compliance related information. For this principle, the CCO or compliance practitioner should also evaluate the communication lines to third parties. This communication can flow both ways, as noted, with compliance obligations to third parties but also information in the form of compliance issues back from third parties.

Communication internally is how you establish the communications with your sales organization, with your sales operations. How do you establish communications with the legal organization? How do you establish information with the post-sales organizations? Even with the auditors, and your internal auditors and your external auditors and the board, to give the Audit Committee of the Board comfort that the company has put in place the right levels of controls.

Three key takeaways:

  1. Consider the use of relevant and quality information.
  2. You need to document your internal communications so auditors can review the audit trail.
  3. This objective relates to your third-party compliance program.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 661 no One Month to More Effective Internal Controls: COSO Objective III: Control Activities In its Framework Volume, COSO Control Activities “are the actions established through policies and procedures that help ensure that management’s directives to mitigate risks to the achievement of objectives are carried out.” They should be performed at all levels in an organization’s process cycle. Principle 10: Selects and develops controls activities. Principle 11: Selects and develops general controls over technology. Principle 12: Control activities established through policies and procedures. Discussion. While the objective of Control Activities should be the most familiar to the CCO or compliance practitioner, this objective demonstrates the inter-relatedness of all the five COSO Objectives and the corporate functions in your organization. It is your control environment and then risk assessment that should lead you to this point. It is the Control Activities objective that lays the groundwork for a living, breathing compliance program going forward. This objective requires that you have new ways of capturing, gathering, confirming the accuracy and completeness of the information and the controls reporting it. The Control Activities regarding the policies and procedures needed is certainly an important consideration going forward. Three key takeaways: Think of a “second set of eyes” as a primary control activity. SODs must always be employed. Control Activities should be performed at all levels in the business process cycle and this speaks directly to the operationalization of your compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 22 Feb 2023 05:00:00 -0000 COSO Objective III: Control Activities full Thomas Fox Today we take up COSO Objective III: Control Activities. In its Framework Volume, COSO Control Activities “are the actions established through policies and procedures that help ensure that management’s directives to mitigate risks to the achievement of objectives are carried out.” They should be performed at all levels in an organization’s process cycle. Principle 10: Selects and develops controls activities. Principle 11: Selects and develops general controls over technology. Principle 12: Control activities established through policies and procedures. Discussion. While the objective of Control Activities should be the most familiar to the CCO or compliance practitioner, this objective demonstrates the inter-relatedness of all the five COSO Objectives and the corporate functions in your organization. It is your control environment and then risk assessment that should lead you to this point. It is the Control Activities objective that lays the groundwork for a living, breathing compliance program going forward. This objective requires that you have new ways of capturing, gathering, confirming the accuracy and completeness of the information and the controls reporting it. The Control Activities regarding the policies and procedures needed is certainly an important consideration going forward. Three key takeaways: Think of a “second set of eyes” as a primary control activity. SODs must always be employed. Control Activities should be performed at all levels in the business process cycle and this speaks directly to the operationalization of your compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices In its Framework Volume, COSO Control Activities “are the actions established through policies and procedures that help ensure that management’s directives to mitigate risks to the achievement of objectives are carried out.” They should be performed at all levels in an organization’s process cycle.

Principle 10: Selects and develops controls activities.

Principle 11: Selects and develops general controls over technology.

Principle 12: Control activities established through policies and procedures.

Discussion. While the objective of Control Activities should be the most familiar to the CCO or compliance practitioner, this objective demonstrates the inter-relatedness of all the five COSO Objectives and the corporate functions in your organization. It is your control environment and then risk assessment that should lead you to this point. It is the Control Activities objective that lays the groundwork for a living, breathing compliance program going forward.

This objective requires that you have new ways of capturing, gathering, confirming the accuracy and completeness of the information and the controls reporting it. The Control Activities regarding the policies and procedures needed is certainly an important consideration going forward.

Three key takeaways:

  1. Think of a “second set of eyes” as a primary control activity.
  2. SODs must always be employed.
  3. Control Activities should be performed at all levels in the business process cycle and this speaks directly to the operationalization of your compliance program.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 577 no One Month to More Effective Internal Controls - COSO Objective II: Risk Assessments Objective II is designed to provide a company with a “dynamic and iterative process for identifying and assessing risks.” For the compliance practitioner, none of this will sound new or even insightful, however the Framework requires a component of management input and oversight that was perhaps not as well understood. The objective of Risk Assessment consists of four principles. Principle 6: Suitable objectives. Principle 7: Identifies and analyzes risk. Principle 8: Fraud risk. Principle 9: Identifies and analyzes significant change.  The SEC has made it clear that companies should be expanding their view of risk in implementing the COSO 2013 Internal Controls Framework. Obviously, risk assessments are a cornerstone of a best practices compliance program as laid out in the 2012 FCPA Guidance and in the DOJ’s Evaluation. The regulators are telling companies specifically that they should be seeing new risks that they need address because of the changes brought about by the new standard. Three key takeaways: Risk assessments are required under the COSO 2013 Internal Controls Framework, the 2012 FCPA Guidance and almost all other best practices compliance programs. Look at your risks across your organization and not in a siloed manner. Risks, both determination and management of, changes over time so be cognizant of changes in business practices on the ground. For more information on how to build out a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 21 Feb 2023 05:00:00 -0000 COSO Objective II: Risk Assessments full Thomas Fox We continue to look at the COSO Objective, today's it is COSO Objective II: Risk Assessments. Objective II is designed to provide a company with a “dynamic and iterative process for identifying and assessing risks.” For the compliance practitioner, none of this will sound new or even insightful, however the Framework requires a component of management input and oversight that was perhaps not as well understood. The objective of Risk Assessment consists of four principles. Principle 6: Suitable objectives. Principle 7: Identifies and analyzes risk. Principle 8: Fraud risk. Principle 9: Identifies and analyzes significant change.  The SEC has made it clear that companies should be expanding their view of risk in implementing the COSO 2013 Internal Controls Framework. Obviously, risk assessments are a cornerstone of a best practices compliance program as laid out in the 2012 FCPA Guidance and in the DOJ’s Evaluation. The regulators are telling companies specifically that they should be seeing new risks that they need address because of the changes brought about by the new standard. Three key takeaways: Risk assessments are required under the COSO 2013 Internal Controls Framework, the 2012 FCPA Guidance and almost all other best practices compliance programs. Look at your risks across your organization and not in a siloed manner. Risks, both determination and management of, changes over time so be cognizant of changes in business practices on the ground. For more information on how to build out a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition. Learn more about your ad choices. Visit megaphone.fm/adchoices Objective II is designed to provide a company with a “dynamic and iterative process for identifying and assessing risks.” For the compliance practitioner, none of this will sound new or even insightful, however the Framework requires a component of management input and oversight that was perhaps not as well understood.

The objective of Risk Assessment consists of four principles.

Principle 6: Suitable objectives.

Principle 7: Identifies and analyzes risk.

Principle 8: Fraud risk.

Principle 9: Identifies and analyzes significant change. 

The SEC has made it clear that companies should be expanding their view of risk in implementing the COSO 2013 Internal Controls Framework. Obviously, risk assessments are a cornerstone of a best practices compliance program as laid out in the 2012 FCPA Guidance and in the DOJ’s Evaluation. The regulators are telling companies specifically that they should be seeing new risks that they need address because of the changes brought about by the new standard.

Three key takeaways:

  1. Risk assessments are required under the COSO 2013 Internal Controls Framework, the 2012 FCPA Guidance and almost all other best practices compliance programs.
  2. Look at your risks across your organization and not in a siloed manner.
  3. Risks, both determination and management of, changes over time so be cognizant of changes in business practices on the ground.

For more information on how to build out a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 693 no One Month to More Effective Internal Controls-COSO Objective I-Control Environment Both Board of Directors’ independence and Compliance Committee (or other applicable committees) oversight issue are essential to this Objective because the Compliance Committee needs to be actively engaged to be comfortable that the company has implemented the internal controls under Sarbanes-Oxley (SOX) 404(a); as required under Principles 1 & 2. The external auditors must then be comfortable that this requirement is met. Finally, there must be evidence that the company has appropriate disclosure controls in place because that is central to the objective. This is all tested against Board independence and Compliance Committee oversight over those activities that management has undertaken and their engagement and conversations with their external auditor. Under Principle 3, structures in reporting lines, authority and responsibility are essential to recognizing revenue. In an entity’s internal controls or financial reporting details, there are processes, and there are policies, there is documentation, the authority and documentation of the judgments are being made, the review of those in responsibility for making those ultimate judgments about the recognition of revenue and the recognition or timing of the revenue and the expenses, that those need to be in place. Under Principle 4, a business must attract, develop, and retain competent talent. Of course, this is good business as well. But it is more than simply some appropriate levels of staffing; one of the reasons that companies have said do not have money to invest again the deep dive study and process improvement necessary to implement it [the 2013 Framework], is that it comes down to both to commitment level from the top and the tone at the top that this important and these financial disclosures are critical to the ability of the investors to rely on the company’s disclosures. You must ensure the team can access the right level of technical accounting talent and business process and controls talent to make the judgments.” All these leads, of course, tie into Principle 5, which mandates that individuals be held responsible. This requires someone to document that they have made a judgment based upon the evidence that they have been able to accumulate, that the company has analyzed that evidence, and has gone through the process of comparing this to the COSO 2013 Framework and the spirit of the standard. Howell said, “those individuals are being held responsible for doing that properly. When you tie all that back together, when you get to the control environment, the COSO principle number one is it can be completely tied back to what is being required.”   Three Key Takeaways: What controls do you have in place to measure conduct at the top? Reporting lines must be clear and functioning. You must provide the right personnel with the right resources. For more information on how to build out a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 20 Feb 2023 05:00:00 -0000 One Month to More Effective Internal Controls-COSO Objective I-Control Environment full Thomas Fox Today we being a look at the COSO Objectives and Principles by reviewing COSO Objective I-Control Environment. Both Board of Directors’ independence and Compliance Committee (or other applicable committees) oversight issue are essential to this Objective because the Compliance Committee needs to be actively engaged to be comfortable that the company has implemented the internal controls under Sarbanes-Oxley (SOX) 404(a); as required under Principles 1 & 2. The external auditors must then be comfortable that this requirement is met. Finally, there must be evidence that the company has appropriate disclosure controls in place because that is central to the objective. This is all tested against Board independence and Compliance Committee oversight over those activities that management has undertaken and their engagement and conversations with their external auditor. Under Principle 3, structures in reporting lines, authority and responsibility are essential to recognizing revenue. In an entity’s internal controls or financial reporting details, there are processes, and there are policies, there is documentation, the authority and documentation of the judgments are being made, the review of those in responsibility for making those ultimate judgments about the recognition of revenue and the recognition or timing of the revenue and the expenses, that those need to be in place. Under Principle 4, a business must attract, develop, and retain competent talent. Of course, this is good business as well. But it is more than simply some appropriate levels of staffing; one of the reasons that companies have said do not have money to invest again the deep dive study and process improvement necessary to implement it [the 2013 Framework], is that it comes down to both to commitment level from the top and the tone at the top that this important and these financial disclosures are critical to the ability of the investors to rely on the company’s disclosures. You must ensure the team can access the right level of technical accounting talent and business process and controls talent to make the judgments.” All these leads, of course, tie into Principle 5, which mandates that individuals be held responsible. This requires someone to document that they have made a judgment based upon the evidence that they have been able to accumulate, that the company has analyzed that evidence, and has gone through the process of comparing this to the COSO 2013 Framework and the spirit of the standard. Howell said, “those individuals are being held responsible for doing that properly. When you tie all that back together, when you get to the control environment, the COSO principle number one is it can be completely tied back to what is being required.”   Three Key Takeaways: What controls do you have in place to measure conduct at the top? Reporting lines must be clear and functioning. You must provide the right personnel with the right resources. For more information on how to build out a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition. Learn more about your ad choices. Visit megaphone.fm/adchoices Both Board of Directors’ independence and Compliance Committee (or other applicable committees) oversight issue are essential to this Objective because the Compliance Committee needs to be actively engaged to be comfortable that the company has implemented the internal controls under Sarbanes-Oxley (SOX) 404(a); as required under Principles 1 & 2. The external auditors must then be comfortable that this requirement is met. Finally, there must be evidence that the company has appropriate disclosure controls in place because that is central to the objective. This is all tested against Board independence and Compliance Committee oversight over those activities that management has undertaken and their engagement and conversations with their external auditor. Under Principle 3, structures in reporting lines, authority and responsibility are essential to recognizing revenue. In an entity’s internal controls or financial reporting details, there are processes, and there are policies, there is documentation, the authority and documentation of the judgments are being made, the review of those in responsibility for making those ultimate judgments about the recognition of revenue and the recognition or timing of the revenue and the expenses, that those need to be in place.

Under Principle 4, a business must attract, develop, and retain competent talent. Of course, this is good business as well. But it is more than simply some appropriate levels of staffing; one of the reasons that companies have said do not have money to invest again the deep dive study and process improvement necessary to implement it [the 2013 Framework], is that it comes down to both to commitment level from the top and the tone at the top that this important and these financial disclosures are critical to the ability of the investors to rely on the company’s disclosures. You must ensure the team can access the right level of technical accounting talent and business process and controls talent to make the judgments.” All these leads, of course, tie into Principle 5, which mandates that individuals be held responsible. This requires someone to document that they have made a judgment based upon the evidence that they have been able to accumulate, that the company has analyzed that evidence, and has gone through the process of comparing this to the COSO 2013 Framework and the spirit of the standard. Howell said, “those individuals are being held responsible for doing that properly. When you tie all that back together, when you get to the control environment, the COSO principle number one is it can be completely tied back to what is being required.”  

Three Key Takeaways:

  1. What controls do you have in place to measure conduct at the top?
  2. Reporting lines must be clear and functioning.
  3. You must provide the right personnel with the right resources.

For more information on how to build out a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 693 no One Month to More Effective Internal Controls- the COSO 2013 Internal Controls Framework COSO was adopted in 1992 as a framework for basis to design and then test the effectiveness of internal controls. In 2010, it was deemed necessary to update this more than 20-year old COSO Framework, to provide a more supportable approach when adversarial third parties challenged whether a company has effective internal controls (such as the SEC). , I believe that the SEC will use this to review a company’s compliance internal controls. This means that you need to understand what is required under the COSO 2013 Internal Controls Framework and can show adherence to it or justify an exception if you receive a letter from the SEC asking for evidence of your company’s compliance with the internal controls provisions of the FCPA. The COSO 2013 Internal Controls Framework defines internal controls, from bottom to top, with the following Objectives: a) Control Environment, b) Risk Assessment, c) Control Activities, d) Information and Communication, and e) Monitoring. From these five Objectives come 17 Principles which we explore in more detail. Three key takeaways: You must use the 2013 Internal Controls Framework or a similar source for your internal controls structure. The 2013 Internal Controls Framework identifies the following areas: a) Control Environment, b) Risk Assessment, c) Control Activities, d) Information and Communication, and e) Monitoring. Your internal controls must be sustainable. For more information on how to build out a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 17 Feb 2023 05:00:00 -0000 COSO 2013 Internal Controls Framework full 13 Thomas Fox Today we take up the COSO 2013 Internal Controls Framework. COSO was adopted in 1992 as a framework for basis to design and then test the effectiveness of internal controls. In 2010, it was deemed necessary to update this more than 20-year old COSO Framework, to provide a more supportable approach when adversarial third parties challenged whether a company has effective internal controls (such as the SEC). , I believe that the SEC will use this to review a company’s compliance internal controls. This means that you need to understand what is required under the COSO 2013 Internal Controls Framework and can show adherence to it or justify an exception if you receive a letter from the SEC asking for evidence of your company’s compliance with the internal controls provisions of the FCPA. The COSO 2013 Internal Controls Framework defines internal controls, from bottom to top, with the following Objectives: a) Control Environment, b) Risk Assessment, c) Control Activities, d) Information and Communication, and e) Monitoring. From these five Objectives come 17 Principles which we explore in more detail. Three key takeaways: You must use the 2013 Internal Controls Framework or a similar source for your internal controls structure. The 2013 Internal Controls Framework identifies the following areas: a) Control Environment, b) Risk Assessment, c) Control Activities, d) Information and Communication, and e) Monitoring. Your internal controls must be sustainable. For more information on how to build out a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition. Learn more about your ad choices. Visit megaphone.fm/adchoices COSO was adopted in 1992 as a framework for basis to design and then test the effectiveness of internal controls. In 2010, it was deemed necessary to update this more than 20-year old COSO Framework, to provide a more supportable approach when adversarial third parties challenged whether a company has effective internal controls (such as the SEC). , I believe that the SEC will use this to review a company’s compliance internal controls. This means that you need to understand what is required under the COSO 2013 Internal Controls Framework and can show adherence to it or justify an exception if you receive a letter from the SEC asking for evidence of your company’s compliance with the internal controls provisions of the FCPA.

The COSO 2013 Internal Controls Framework defines internal controls, from bottom to top, with the following Objectives: a) Control Environment, b) Risk Assessment, c) Control Activities, d) Information and Communication, and e) Monitoring. From these five Objectives come 17 Principles which we explore in more detail.

Three key takeaways:

  1. You must use the 2013 Internal Controls Framework or a similar source for your internal controls structure.
  2. The 2013 Internal Controls Framework identifies the following areas: a) Control Environment, b) Risk Assessment, c) Control Activities, d) Information and Communication, and e) Monitoring.
  3. Your internal controls must be sustainable.

For more information on how to build out a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 573 no One Month to More Effective Internal Controls-Code of Conduct as an Internal Control In 2016, one of the most interesting non-international-focused FCPA enforcement actions was announced by the SEC. It involved a clear quid pro quo benefit paid out by United Airlines, Inc. to David Samson, the former chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity which has authority over, among other things, United’s operations at the company’s huge east coast hub at Newark, New Jersey. At the time, United’s Code of Conduct prohibited “United employees from directly or indirectly making bribes, kickbacks or other improper payments to government officials, civil servants or anyone else to influence their acts or decisions” and that “[n]o gift may be offered or accepted if it will create a feeling of obligation, compromise judgment or appear to improperly influence the recipient.” Only the United Board of Director’s could grant a waiver to the code and none was sought or obtained by Smisek. The Order concluded, “The [Chairman’s] Route was initiated in violation of United’s policies.” The company was also sanctioned for not having internal controls in place to prevent such actions as those taken by Smisek, with the SEC also finding this was a violation of Section 13. This was in the face of detailing the protocol for United instituting or reinstituting a route. The Order stated, “In particular, United had insufficient internal accounting controls in place to prevent approval of the South Carolina Route in derogation of United’s Policies.” All the underlying facts, enforcement theories and remediation points towards the failure of internal controls when domestic bribery corruption occurs.   Three key takeaways: 1. It is very unusual for the FCPA to form the basis of a domestic bribery violation. 2. A Code of Conduct can be an internal control. 3. Even a CEO must follow internal controls. For more information on how to build out a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 16 Feb 2023 05:00:00 -0000 Code of Conduct as an Internal Control full 12 Thomas Fox Today we consider how your Code of Conduct can act as an internal control. In 2016, one of the most interesting non-international-focused FCPA enforcement actions was announced by the SEC. It involved a clear quid pro quo benefit paid out by United Airlines, Inc. to David Samson, the former chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity which has authority over, among other things, United’s operations at the company’s huge east coast hub at Newark, New Jersey. At the time, United’s Code of Conduct prohibited “United employees from directly or indirectly making bribes, kickbacks or other improper payments to government officials, civil servants or anyone else to influence their acts or decisions” and that “[n]o gift may be offered or accepted if it will create a feeling of obligation, compromise judgment or appear to improperly influence the recipient.” Only the United Board of Director’s could grant a waiver to the code and none was sought or obtained by Smisek. The Order concluded, “The [Chairman’s] Route was initiated in violation of United’s policies.” The company was also sanctioned for not having internal controls in place to prevent such actions as those taken by Smisek, with the SEC also finding this was a violation of Section 13. This was in the face of detailing the protocol for United instituting or reinstituting a route. The Order stated, “In particular, United had insufficient internal accounting controls in place to prevent approval of the South Carolina Route in derogation of United’s Policies.” All the underlying facts, enforcement theories and remediation points towards the failure of internal controls when domestic bribery corruption occurs.   Three key takeaways: 1. It is very unusual for the FCPA to form the basis of a domestic bribery violation. 2. A Code of Conduct can be an internal control. 3. Even a CEO must follow internal controls. For more information on how to build out a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition. Learn more about your ad choices. Visit megaphone.fm/adchoices In 2016, one of the most interesting non-international-focused FCPA enforcement actions was announced by the SEC. It involved a clear quid pro quo benefit paid out by United Airlines, Inc. to David Samson, the former chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity which has authority over, among other things, United’s operations at the company’s huge east coast hub at Newark, New Jersey.

At the time, United’s Code of Conduct prohibited “United employees from directly or indirectly making bribes, kickbacks or other improper payments to government officials, civil servants or anyone else to influence their acts or decisions” and that “[n]o gift may be offered or accepted if it will create a feeling of obligation, compromise judgment or appear to improperly influence the recipient.” Only the United Board of Director’s could grant a waiver to the code and none was sought or obtained by Smisek. The Order concluded, “The [Chairman’s] Route was initiated in violation of United’s policies.”

The company was also sanctioned for not having internal controls in place to prevent such actions as those taken by Smisek, with the SEC also finding this was a violation of Section 13. This was in the face of detailing the protocol for United instituting or reinstituting a route. The Order stated, “In particular, United had insufficient internal accounting controls in place to prevent approval of the South Carolina Route in derogation of United’s Policies.” All the underlying facts, enforcement theories and remediation points towards the failure of internal controls when domestic bribery corruption occurs. 

 Three key takeaways:

1. It is very unusual for the FCPA to form the basis of a domestic bribery violation.

2. A Code of Conduct can be an internal control.

3. Even a CEO must follow internal controls.

For more information on how to build out a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 691 no One Month to a More Effective Internal Controls - Board of Directors as an Internal Control Is a Board of Directors a compliance internal control? The clear answer is yes. In the 2020 FCPA Resource Guide, Hallmarks of an Effective Compliance Program, there are two specific references to the obligations of a Board in a best practices compliance program. One states, “Within a business organization, compliance begins with the Board of Directors and senior executives setting the proper tone for the rest of the company.” The second is found under the Hallmark entitled “Oversight, Autonomy and Resources,” which says the CCO should have “direct access to an organization’s governing authority, such as the Board of Directors and committees of the Board of Directors (e.g., the audit committee).”  Further, under the U.S. Sentencing Guidelines, the Board must exercise reasonable oversight of the effectiveness of a company’s compliance program. The DOJ Prosecution Standards posed the following queries: Do the directors exercise independent review of a company’s compliance program and are directors provided information sufficient to enable the exercise of independent judgment? The DOJ’s remarks drove home to me the absolute requirement for Board participation in any best practices or even effective anti-corruption compliance program. Three key takeaways: Board oversight over the compliance function is a separate internal control, so document it and use it. The board must perform oversight over your company’s internal controls. Does your Board use the five principles for involvement in compliance with internal controls? For more information on building a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 15 Feb 2023 11:45:49 -0000 Board of Directors as an Internal Control full Thomas Fox Today we consider how the Board of Directors can act as an Internal Control. Is a Board of Directors a compliance internal control? The clear answer is yes. In the 2020 FCPA Resource Guide, Hallmarks of an Effective Compliance Program, there are two specific references to the obligations of a Board in a best practices compliance program. One states, “Within a business organization, compliance begins with the Board of Directors and senior executives setting the proper tone for the rest of the company.” The second is found under the Hallmark entitled “Oversight, Autonomy and Resources,” which says the CCO should have “direct access to an organization’s governing authority, such as the Board of Directors and committees of the Board of Directors (e.g., the audit committee).”  Further, under the U.S. Sentencing Guidelines, the Board must exercise reasonable oversight of the effectiveness of a company’s compliance program. The DOJ Prosecution Standards posed the following queries: Do the directors exercise independent review of a company’s compliance program and are directors provided information sufficient to enable the exercise of independent judgment? The DOJ’s remarks drove home to me the absolute requirement for Board participation in any best practices or even effective anti-corruption compliance program. Three key takeaways: Board oversight over the compliance function is a separate internal control, so document it and use it. The board must perform oversight over your company’s internal controls. Does your Board use the five principles for involvement in compliance with internal controls? For more information on building a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition. Learn more about your ad choices. Visit megaphone.fm/adchoices Is a Board of Directors a compliance internal control? The clear answer is yes. In the 2020 FCPA Resource Guide, Hallmarks of an Effective Compliance Program, there are two specific references to the obligations of a Board in a best practices compliance program. One states, “Within a business organization, compliance begins with the Board of Directors and senior executives setting the proper tone for the rest of the company.” The second is found under the Hallmark entitled “Oversight, Autonomy and Resources,” which says the CCO should have “direct access to an organization’s governing authority, such as the Board of Directors and committees of the Board of Directors (e.g., the audit committee).” 

Further, under the U.S. Sentencing Guidelines, the Board must exercise reasonable oversight of the effectiveness of a company’s compliance program. The DOJ Prosecution Standards posed the following queries: Do the directors exercise independent review of a company’s compliance program and are directors provided information sufficient to enable the exercise of independent judgment? The DOJ’s remarks drove home to me the absolute requirement for Board participation in any best practices or even effective anti-corruption compliance program.

Three key takeaways:

  1. Board oversight over the compliance function is a separate internal control, so document it and use it.
  2. The board must perform oversight over your company’s internal controls.
  3. Does your Board use the five principles for involvement in compliance with internal controls?

For more information on building a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 528 no One Month to More Effective Internal Controls - Internal Controls for Gifts, Travel and Entertainment While many compliance practitioners believe that employee expense reports are a sufficient internal control of gifts because there are other ways in which a gift can be presented, other controls must be considered. Once your company policy on gifts has been finalized, the internal controls over expense reports fall into three primary areas: The expense report format, including what information it requires. Controls over the submitting employee and the preparation of the expense report. Controls to ensure the approvers do their review process properly.  Internal controls around gifts can be used in various ways in your best practices compliance program. They can certainly be used to detect an issue and perhaps even prevent an issue from becoming a full-blown FCPA violation; however, by using some of the techniques that Howell has suggested, you can move your compliance program to a proscriptive phase where you not only stop an issue from becoming a violation but through identification, you can move towards remediation as a part of your ongoing compliance efforts. The bottom line is that good internal controls make for good business processes; if you can move your compliance program’s internal controls forward, you can help make them a part of your financial controls and, thereby, have a better-run company.  Three Key Takeaways: GTE compliance internal controls are low-hanging fruit. Pick them. Compliance with internal controls can be both detected and prevented controls. Good compliance with internal controls is good for business. For more information on how to build out a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 14 Feb 2023 05:00:00 -0000 Internal Controls for Gifts, Travel and Entertainment full 10 Thomas Fox Today we look at Internal Controls for Gifts, Travel and Entertainment. While many compliance practitioners believe that employee expense reports are a sufficient internal control of gifts because there are other ways in which a gift can be presented, other controls must be considered. Once your company policy on gifts has been finalized, the internal controls over expense reports fall into three primary areas: The expense report format, including what information it requires. Controls over the submitting employee and the preparation of the expense report. Controls to ensure the approvers do their review process properly.  Internal controls around gifts can be used in various ways in your best practices compliance program. They can certainly be used to detect an issue and perhaps even prevent an issue from becoming a full-blown FCPA violation; however, by using some of the techniques that Howell has suggested, you can move your compliance program to a proscriptive phase where you not only stop an issue from becoming a violation but through identification, you can move towards remediation as a part of your ongoing compliance efforts. The bottom line is that good internal controls make for good business processes; if you can move your compliance program’s internal controls forward, you can help make them a part of your financial controls and, thereby, have a better-run company.  Three Key Takeaways: GTE compliance internal controls are low-hanging fruit. Pick them. Compliance with internal controls can be both detected and prevented controls. Good compliance with internal controls is good for business. For more information on how to build out a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition. Learn more about your ad choices. Visit megaphone.fm/adchoices While many compliance practitioners believe that employee expense reports are a sufficient internal control of gifts because there are other ways in which a gift can be presented, other controls must be considered. Once your company policy on gifts has been finalized, the internal controls over expense reports fall into three primary areas:

  1. The expense report format, including what information it requires.
  2. Controls over the submitting employee and the preparation of the expense report.
  3. Controls to ensure the approvers do their review process properly.

 Internal controls around gifts can be used in various ways in your best practices compliance program. They can certainly be used to detect an issue and perhaps even prevent an issue from becoming a full-blown FCPA violation; however, by using some of the techniques that Howell has suggested, you can move your compliance program to a proscriptive phase where you not only stop an issue from becoming a violation but through identification, you can move towards remediation as a part of your ongoing compliance efforts. The bottom line is that good internal controls make for good business processes; if you can move your compliance program’s internal controls forward, you can help make them a part of your financial controls and, thereby, have a better-run company. 

Three Key Takeaways:

  1. GTE compliance internal controls are low-hanging fruit. Pick them.
  2. Compliance with internal controls can be both detected and prevented controls.
  3. Good compliance with internal controls is good for business.

For more information on how to build out a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 478 no One Month to More Effective Internal Control - Internal Control for 3rd Parties Bribery built into the fabric of Chinese healthcare system”, reporters Jamil Anderlini and Tom Mitchell wrote about the ‘nuts and bolts of how bribery occurs in the healthcare industry in China. The authors quoted Shaun Rein, a Shanghai-based consultant and author of “The End of Cheap China,” for the following “This is a systemic problem and foreign pharmaceutical companies are in a conundrum. If they want to grow in China, they must give bribes. It’s not a choice because officials in the health ministry, hospital administrators, and doctors demand it.” It would be reasonable to expect that internal controls over gifts would be designed to ensure that all gifts satisfy the required criteria, as defined and interpreted in Company policies. It should fall to a Compliance Officer to finalize and approve a definition of permissible and non-permissible gifts, travel, and entertainment, and internal controls will follow from such definition or criteria set by the company. These criteria would include the amount of the spend, localized down into increased risk, such as the higher risk recognized in China. Within this context, there are four general internal controls to consider.  Three Key Takeaways: GSK in China continues to be an example of the lack of internal controls for an effective compliance program. General areas of review for internal compliance controls. Third parties are still at the highest risk of corruption-related issues. For more information on how to build out a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 13 Feb 2023 05:00:00 -0000 Internal Control for 3rd Parties full 9 Thomas Fox Today we consider internal controls for third-parties. Bribery built into the fabric of Chinese healthcare system”, reporters Jamil Anderlini and Tom Mitchell wrote about the ‘nuts and bolts of how bribery occurs in the healthcare industry in China. The authors quoted Shaun Rein, a Shanghai-based consultant and author of “The End of Cheap China,” for the following “This is a systemic problem and foreign pharmaceutical companies are in a conundrum. If they want to grow in China, they must give bribes. It’s not a choice because officials in the health ministry, hospital administrators, and doctors demand it.” It would be reasonable to expect that internal controls over gifts would be designed to ensure that all gifts satisfy the required criteria, as defined and interpreted in Company policies. It should fall to a Compliance Officer to finalize and approve a definition of permissible and non-permissible gifts, travel, and entertainment, and internal controls will follow from such definition or criteria set by the company. These criteria would include the amount of the spend, localized down into increased risk, such as the higher risk recognized in China. Within this context, there are four general internal controls to consider.  Three Key Takeaways: GSK in China continues to be an example of the lack of internal controls for an effective compliance program. General areas of review for internal compliance controls. Third parties are still at the highest risk of corruption-related issues. For more information on how to build out a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition. Learn more about your ad choices. Visit megaphone.fm/adchoices Bribery built into the fabric of Chinese healthcare system”, reporters Jamil Anderlini and Tom Mitchell wrote about the ‘nuts and bolts of how bribery occurs in the healthcare industry in China. The authors quoted Shaun Rein, a Shanghai-based consultant and author of “The End of Cheap China,” for the following “This is a systemic problem and foreign pharmaceutical companies are in a conundrum. If they want to grow in China, they must give bribes. It’s not a choice because officials in the health ministry, hospital administrators, and doctors demand it.”

It would be reasonable to expect that internal controls over gifts would be designed to ensure that all gifts satisfy the required criteria, as defined and interpreted in Company policies. It should fall to a Compliance Officer to finalize and approve a definition of permissible and non-permissible gifts, travel, and entertainment, and internal controls will follow from such definition or criteria set by the company. These criteria would include the amount of the spend, localized down into increased risk, such as the higher risk recognized in China. Within this context, there are four general internal controls to consider. 

Three Key Takeaways:

  1. GSK in China continues to be an example of the lack of internal controls for an effective compliance program.
  2. General areas of review for internal compliance controls.
  3. Third parties are still at the highest risk of corruption-related issues.


For more information on how to build out a best practices compliance program, including internal controls, check out The Compliance Handbook, 3rd edition.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 514 no One Month to More Effective Internal Controls - Mapping Internal Controls The SEC has continued to emphasize the accounting provisions of the FCPA, specifically the internal controls provisions. The reason is straightforward; a company with rigorous internal compliance controls is better able to prevent, detect and remedy any FCPA violations that may occur. What can you do around the FCPA’s requirements for internal controls and continued SEC enforcement emphasis? You should begin with an exercise where you map the internal controls your company has in place to the indicia of the Hallmarks of an Effective Compliance Program, as set out in the 2020 FCPA Resource Guide. While most compliance practitioners are familiar with the Hallmarks, you may not be as familiar with standards for internal controls. Here, begin with the COSO 2013 Internal Controls Framework as your starting point. As a CCO or compliance practitioner, this is an exercise that you can engage in at no cost. You simply investigate and note what internal controls you have in place and how they may be a part of your anti-corruption efforts going forward. Compliance is a straightforward exercise; this does not mean that it is easy, you do have to work at it so that you will simply not have a paper, “check the box” program. But using the excuse that you have limited resources is simply an excuse and a rather poor one at that. While the clear lesson from the BHP enforcement action is that you are required to have effective internal controls in place, by engaging in this mapping exercise you can then figure out what you have and, more importantly, what internal compliance controls that you do not have and need to institute. Three key takeaways: 1. Learn the internal controls your company currently has in place. 2. Map your compliance internal controls to the COSO 2013 Internal Controls Framework. 3. Use your gap analysis as a basis for remediation. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 10 Feb 2023 05:00:00 -0000 Mapping Internal Controls full Thomas Fox Today, we consider how to map out your internal controls. The SEC has continued to emphasize the accounting provisions of the FCPA, specifically the internal controls provisions. The reason is straightforward; a company with rigorous internal compliance controls is better able to prevent, detect and remedy any FCPA violations that may occur. What can you do around the FCPA’s requirements for internal controls and continued SEC enforcement emphasis? You should begin with an exercise where you map the internal controls your company has in place to the indicia of the Hallmarks of an Effective Compliance Program, as set out in the 2020 FCPA Resource Guide. While most compliance practitioners are familiar with the Hallmarks, you may not be as familiar with standards for internal controls. Here, begin with the COSO 2013 Internal Controls Framework as your starting point. As a CCO or compliance practitioner, this is an exercise that you can engage in at no cost. You simply investigate and note what internal controls you have in place and how they may be a part of your anti-corruption efforts going forward. Compliance is a straightforward exercise; this does not mean that it is easy, you do have to work at it so that you will simply not have a paper, “check the box” program. But using the excuse that you have limited resources is simply an excuse and a rather poor one at that. While the clear lesson from the BHP enforcement action is that you are required to have effective internal controls in place, by engaging in this mapping exercise you can then figure out what you have and, more importantly, what internal compliance controls that you do not have and need to institute. Three key takeaways: 1. Learn the internal controls your company currently has in place. 2. Map your compliance internal controls to the COSO 2013 Internal Controls Framework. 3. Use your gap analysis as a basis for remediation. Learn more about your ad choices. Visit megaphone.fm/adchoices The SEC has continued to emphasize the accounting provisions of the FCPA, specifically the internal controls provisions. The reason is straightforward; a company with rigorous internal compliance controls is better able to prevent, detect and remedy any FCPA violations that may occur. What can you do around the FCPA’s requirements for internal controls and continued SEC enforcement emphasis? You should begin with an exercise where you map the internal controls your company has in place to the indicia of the Hallmarks of an Effective Compliance Program, as set out in the 2020 FCPA Resource Guide. While most compliance practitioners are familiar with the Hallmarks, you may not be as familiar with standards for internal controls. Here, begin with the COSO 2013 Internal Controls Framework as your starting point.

As a CCO or compliance practitioner, this is an exercise that you can engage in at no cost. You simply investigate and note what internal controls you have in place and how they may be a part of your anti-corruption efforts going forward. Compliance is a straightforward exercise; this does not mean that it is easy, you do have to work at it so that you will simply not have a paper, “check the box” program. But using the excuse that you have limited resources is simply an excuse and a rather poor one at that. While the clear lesson from the BHP enforcement action is that you are required to have effective internal controls in place, by engaging in this mapping exercise you can then figure out what you have and, more importantly, what internal compliance controls that you do not have and need to institute.

Three key takeaways:

1. Learn the internal controls your company currently has in place.

2. Map your compliance internal controls to the COSO 2013 Internal Controls Framework.

3. Use your gap analysis as a basis for remediation.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 494 no One Month to More Effective Internal Controls - Implementing internal controls Today, I consider some ways in which a compliance professional can work to implement internal controls in a multi-national organization. The first step is to convert your company’s compliance risks into internal control objectives. The internal control objectives are then given to each business unit with instructions to develop controls, which meet the objectives. This process should allow more of a fine-tuning approach within existing systems than the development of specific controls by corporate which all business units must adopt and will give the business unit a sense of buy-in and participation in the process. Good compliance internal controls are not some standalone protective measure. They can help to make a company run more efficiently as the internal controls that prevent FCPA violations are the same ones that prevent fraud in the workplace. The presence of good internal controls saves money by preventing fraud. It is a business best practice to prevent fraud, which includes preventing corruption. One need only consider Ethisphere and its annual survey of the world’s most ethical companies because they exceed the Standard & Poor’s index of average profits and growth by a factor of 4X. A key reason such companies have better than average profitability is that they have better internal controls.  Three key takeaways: 1. Convert your compliance risks into internal control objectives. 2. As with many components of a best practices compliance program, tone at the top is critical. 3. If you receive pushback from the business folks, always remember that good internal controls make for a better, more efficient and more profitable business. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 09 Feb 2023 05:00:00 -0000 Implementing internal controls full Thomas Fox In this episode, we take up how to implement internal controls. Today, I consider some ways in which a compliance professional can work to implement internal controls in a multi-national organization. The first step is to convert your company’s compliance risks into internal control objectives. The internal control objectives are then given to each business unit with instructions to develop controls, which meet the objectives. This process should allow more of a fine-tuning approach within existing systems than the development of specific controls by corporate which all business units must adopt and will give the business unit a sense of buy-in and participation in the process. Good compliance internal controls are not some standalone protective measure. They can help to make a company run more efficiently as the internal controls that prevent FCPA violations are the same ones that prevent fraud in the workplace. The presence of good internal controls saves money by preventing fraud. It is a business best practice to prevent fraud, which includes preventing corruption. One need only consider Ethisphere and its annual survey of the world’s most ethical companies because they exceed the Standard & Poor’s index of average profits and growth by a factor of 4X. A key reason such companies have better than average profitability is that they have better internal controls.  Three key takeaways: 1. Convert your compliance risks into internal control objectives. 2. As with many components of a best practices compliance program, tone at the top is critical. 3. If you receive pushback from the business folks, always remember that good internal controls make for a better, more efficient and more profitable business. Learn more about your ad choices. Visit megaphone.fm/adchoices Today, I consider some ways in which a compliance professional can work to implement internal controls in a multi-national organization. The first step is to convert your company’s compliance risks into internal control objectives. The internal control objectives are then given to each business unit with instructions to develop controls, which meet the objectives. This process should allow more of a fine-tuning approach within existing systems than the development of specific controls by corporate which all business units must adopt and will give the business unit a sense of buy-in and participation in the process.

Good compliance internal controls are not some standalone protective measure. They can help to make a company run more efficiently as the internal controls that prevent FCPA violations are the same ones that prevent fraud in the workplace. The presence of good internal controls saves money by preventing fraud. It is a business best practice to prevent fraud, which includes preventing corruption. One need only consider Ethisphere and its annual survey of the world’s most ethical companies because they exceed the Standard & Poor’s index of average profits and growth by a factor of 4X. A key reason such companies have better than average profitability is that they have better internal controls.

 Three key takeaways:

1. Convert your compliance risks into internal control objectives.

2. As with many components of a best practices compliance program, tone at the top is critical.

3. If you receive pushback from the business folks, always remember that good internal controls make for a better, more efficient and more profitable business.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 684 no One Month to More Effective Internal Controls - Risk Assessments and Internal Controls Today, I will review how to use the risk assessment you have performed as a tool to provide a structured approach to establishing effective internal controls. After preparation of the risk assessment, the next step is to prioritize the listing of the risks and which locations they are common. This begins by mapping existing internal controls to risks and then assessing whether the internal controls are sufficient to mitigate the risks. To help with consistency in this evaluation process, it may be useful to assign a risk weight to each of the elements in the risk assessment. For example, a construction company might assign a higher weight to the presence of movable fixed assets while a company which sells exclusively through local distributors, might assign a higher weight to the sales function than one that exclusively uses company employees for sales activities. However, it is structured, the assessment should result in the assignment of individual risk scores and a composite risk score for each location. These scores can then be used to prioritize the locations in terms of dealing with control risks. Top Risks Include: Sales conducted through third parties.  ·       A U.S. based international sales manager who is responsible for growing the business?  ·       Sales channel uses a U.S. based sales force which only travels to locations outside the U.S. for temporary visits of generally short duration.  ·       Gifts, travel and entertainment. ·       High risk jurisdictions. ·       Business ventures. You can also utilize the COSO 2013 Internal Controls Framework, which created a more formal structure to design or assess the effectiveness of internal control within the five COSO components. A companion document, Internal Control over External Financial Reporting: A Compendium of Approaches and Examples, catalogued possible approaches and examples in the context of internal controls over financial reporting, and could be useful for companies complying with compliance internal controls under the FCPA. COSO has also published an additional companion document, Illustrative Tools for Assessing Effectiveness of a System of Internal Control, which provides templates that may be used to support an assessment of internal controls and includes various scenarios which illustrate several practical examples of how the templates may be used. Finally, consider a business unit in a geographic area such as the Far East where there is a significant amount of deference to supervisors in the local culture; such that even if an employee saw inappropriate behavior it would not be expected that the employee would make any report or comment.   Three key takeaways: 1. Third-party risks are still your highest risks under the FCPA so use your internal controls appropriately to help prevent this risk from becoming a violation. 2. Use mapping and a gap analysis to collate risks to existing controls. 3. Always consider the regional and geographic variances. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 08 Feb 2023 05:00:00 -0000 Risk assessments and internal controls full Thomas Fox Today we consider risk assessments and internal controls. Today, I will review how to use the risk assessment you have performed as a tool to provide a structured approach to establishing effective internal controls. After preparation of the risk assessment, the next step is to prioritize the listing of the risks and which locations they are common. This begins by mapping existing internal controls to risks and then assessing whether the internal controls are sufficient to mitigate the risks. To help with consistency in this evaluation process, it may be useful to assign a risk weight to each of the elements in the risk assessment. For example, a construction company might assign a higher weight to the presence of movable fixed assets while a company which sells exclusively through local distributors, might assign a higher weight to the sales function than one that exclusively uses company employees for sales activities. However, it is structured, the assessment should result in the assignment of individual risk scores and a composite risk score for each location. These scores can then be used to prioritize the locations in terms of dealing with control risks. Top Risks Include: Sales conducted through third parties.  ·       A U.S. based international sales manager who is responsible for growing the business?  ·       Sales channel uses a U.S. based sales force which only travels to locations outside the U.S. for temporary visits of generally short duration.  ·       Gifts, travel and entertainment. ·       High risk jurisdictions. ·       Business ventures. You can also utilize the COSO 2013 Internal Controls Framework, which created a more formal structure to design or assess the effectiveness of internal control within the five COSO components. A companion document, Internal Control over External Financial Reporting: A Compendium of Approaches and Examples, catalogued possible approaches and examples in the context of internal controls over financial reporting, and could be useful for companies complying with compliance internal controls under the FCPA. COSO has also published an additional companion document, Illustrative Tools for Assessing Effectiveness of a System of Internal Control, which provides templates that may be used to support an assessment of internal controls and includes various scenarios which illustrate several practical examples of how the templates may be used. Finally, consider a business unit in a geographic area such as the Far East where there is a significant amount of deference to supervisors in the local culture; such that even if an employee saw inappropriate behavior it would not be expected that the employee would make any report or comment.   Three key takeaways: 1. Third-party risks are still your highest risks under the FCPA so use your internal controls appropriately to help prevent this risk from becoming a violation. 2. Use mapping and a gap analysis to collate risks to existing controls. 3. Always consider the regional and geographic variances. Learn more about your ad choices. Visit megaphone.fm/adchoices Today, I will review how to use the risk assessment you have performed as a tool to provide a structured approach to establishing effective internal controls. After preparation of the risk assessment, the next step is to prioritize the listing of the risks and which locations they are common. This begins by mapping existing internal controls to risks and then assessing whether the internal controls are sufficient to mitigate the risks.

To help with consistency in this evaluation process, it may be useful to assign a risk weight to each of the elements in the risk assessment. For example, a construction company might assign a higher weight to the presence of movable fixed assets while a company which sells exclusively through local distributors, might assign a higher weight to the sales function than one that exclusively uses company employees for sales activities. However, it is structured, the assessment should result in the assignment of individual risk scores and a composite risk score for each location. These scores can then be used to prioritize the locations in terms of dealing with control risks.

Top Risks Include:

Sales conducted through third parties. 

·       A U.S. based international sales manager who is responsible for growing the business? 

·       Sales channel uses a U.S. based sales force which only travels to locations outside the U.S. for temporary visits of generally short duration. 

·       Gifts, travel and entertainment.

·       High risk jurisdictions.

·       Business ventures.

You can also utilize the COSO 2013 Internal Controls Framework, which created a more formal structure to design or assess the effectiveness of internal control within the five COSO components. A companion document, Internal Control over External Financial Reporting: A Compendium of Approaches and Examples, catalogued possible approaches and examples in the context of internal controls over financial reporting, and could be useful for companies complying with compliance internal controls under the FCPA. COSO has also published an additional companion document, Illustrative Tools for Assessing Effectiveness of a System of Internal Control, which provides templates that may be used to support an assessment of internal controls and includes various scenarios which illustrate several practical examples of how the templates may be used.

Finally, consider a business unit in a geographic area such as the Far East where there is a significant amount of deference to supervisors in the local culture; such that even if an employee saw inappropriate behavior it would not be expected that the employee would make any report or comment. 

 Three key takeaways:

1. Third-party risks are still your highest risks under the FCPA so use your internal controls appropriately to help prevent this risk from becoming a violation.

2. Use mapping and a gap analysis to collate risks to existing controls.

3. Always consider the regional and geographic variances.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 546 no One Month to More Effective Internal Controls-Assessing for Internal Controls in International Operations How should you assess your internal controls regime for international operations? It is incumbent that you need to review as much information as you can to understand the financial and operational structure of an entity and how it is integrated with the corporate headquarters, or the U.S. business unit’s financial and operation structure, if the foreign operation is part of a U.S. business unit. You could begin with the TI-CPI to garner a sense of the reputation of the country in which your business unit is located, as well as the CPI for all other countries in which the location either markets business or has current customers. Another area for inquiry or review is the scope of your foreign operations. Other areas of inquiry should include whether your company’s finance and accounting staff produce financial statements that are integrated into the parent’s financial statements; whether your international business locations utilize a local bank account for local sales receipts as well as funds transfers from the U.S. and whether the account has local check signers and whether dual signatures are required on the checks. You may also want to consider the extent to which disbursements are made in the local currency and, of course, is there a local petty cash fund. As with many other areas around internal controls, it is important to consider the local DOA and whether it is consistent with your corporate DOA. Some of the considerations regarding the local DOA should extend to which corporate or U.S. business unit approvals are required for transactions initiated locally, such as: 1) approval of vendor invoices; 2) disbursements of funds, including wire transfers; 3) execution of facilities leases; 4) execution of contracts with agents; and 5) approval of pricing and credit terms to customers and distributors. You should also review whether the local DOA provides appropriate SODs at the local business unit level. These reviews, questions, inquiries and analyses are designed to locate the pressure points involved in any company’s sales processes. This is because pressure is a key element of occupational fraud and the risk of fraud, including corruption, increases as the pressure increases. Since corruption is viewed as a subset of fraud, it might be a good time to review the “fraud triangle,” which lays out breeding ground for fraud in the corruption context.  Three key takeaways: 1. You must understand the financial and operational structure of your company and how that structure outside the U.S. is integrated with the corporate headquarters. 2. Are your financial statements and reporting systems integrated? 3. Always consider the fraud triangle. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 07 Feb 2023 05:00:00 -0000 Assessing for Internal Controls in International Operations full Thomas Fox How to assess your internal controls. How should you assess your internal controls regime for international operations? It is incumbent that you need to review as much information as you can to understand the financial and operational structure of an entity and how it is integrated with the corporate headquarters, or the U.S. business unit’s financial and operation structure, if the foreign operation is part of a U.S. business unit. You could begin with the TI-CPI to garner a sense of the reputation of the country in which your business unit is located, as well as the CPI for all other countries in which the location either markets business or has current customers. Another area for inquiry or review is the scope of your foreign operations. Other areas of inquiry should include whether your company’s finance and accounting staff produce financial statements that are integrated into the parent’s financial statements; whether your international business locations utilize a local bank account for local sales receipts as well as funds transfers from the U.S. and whether the account has local check signers and whether dual signatures are required on the checks. You may also want to consider the extent to which disbursements are made in the local currency and, of course, is there a local petty cash fund. As with many other areas around internal controls, it is important to consider the local DOA and whether it is consistent with your corporate DOA. Some of the considerations regarding the local DOA should extend to which corporate or U.S. business unit approvals are required for transactions initiated locally, such as: 1) approval of vendor invoices; 2) disbursements of funds, including wire transfers; 3) execution of facilities leases; 4) execution of contracts with agents; and 5) approval of pricing and credit terms to customers and distributors. You should also review whether the local DOA provides appropriate SODs at the local business unit level. These reviews, questions, inquiries and analyses are designed to locate the pressure points involved in any company’s sales processes. This is because pressure is a key element of occupational fraud and the risk of fraud, including corruption, increases as the pressure increases. Since corruption is viewed as a subset of fraud, it might be a good time to review the “fraud triangle,” which lays out breeding ground for fraud in the corruption context.  Three key takeaways: 1. You must understand the financial and operational structure of your company and how that structure outside the U.S. is integrated with the corporate headquarters. 2. Are your financial statements and reporting systems integrated? 3. Always consider the fraud triangle. Learn more about your ad choices. Visit megaphone.fm/adchoices How should you assess your internal controls regime for international operations? It is incumbent that you need to review as much information as you can to understand the financial and operational structure of an entity and how it is integrated with the corporate headquarters, or the U.S. business unit’s financial and operation structure, if the foreign operation is part of a U.S. business unit.

You could begin with the TI-CPI to garner a sense of the reputation of the country in which your business unit is located, as well as the CPI for all other countries in which the location either markets business or has current customers. Another area for inquiry or review is the scope of your foreign operations. Other areas of inquiry should include whether your company’s finance and accounting staff produce financial statements that are integrated into the parent’s financial statements; whether your international business locations utilize a local bank account for local sales receipts as well as funds transfers from the U.S. and whether the account has local check signers and whether dual signatures are required on the checks. You may also want to consider the extent to which disbursements are made in the local currency and, of course, is there a local petty cash fund.

As with many other areas around internal controls, it is important to consider the local DOA and whether it is consistent with your corporate DOA. Some of the considerations regarding the local DOA should extend to which corporate or U.S. business unit approvals are required for transactions initiated locally, such as: 1) approval of vendor invoices; 2) disbursements of funds, including wire transfers; 3) execution of facilities leases; 4) execution of contracts with agents; and 5) approval of pricing and credit terms to customers and distributors. You should also review whether the local DOA provides appropriate SODs at the local business unit level.

These reviews, questions, inquiries and analyses are designed to locate the pressure points involved in any company’s sales processes. This is because pressure is a key element of occupational fraud and the risk of fraud, including corruption, increases as the pressure increases. Since corruption is viewed as a subset of fraud, it might be a good time to review the “fraud triangle,” which lays out breeding ground for fraud in the corruption context.

 Three key takeaways:

1. You must understand the financial and operational structure of your company and how that structure outside the U.S. is integrated with the corporate headquarters.

2. Are your financial statements and reporting systems integrated?

3. Always consider the fraud triangle.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 693 One Month to More Effective Internal Controls-Internal Controls in International Locations While a CCO should expect (or at least hope) that internal controls at locations outside the U.S. are of the same effectiveness as internal controls within U.S. business units and at the U.S. corporate office; unfortunately, that might not always be the case. It is often the case that corporate level internal controls are stronger than those in foreign business units. There may well be several reasons for this. First, the CFO may be paying closer attention to the corporate level internal controls, with the idea that the corporate level internal controls are the final “filter” to detect issues. This follows partly from the focus in most companies on the controls over financial reporting, which does not include all controls needed for compliance. A second reason is that many companies were built through acquisitions, resulting in many business units (both in and outside the U.S.) having completely different accounting, ERP and internal control systems than the corporate office. There is often a tendency to leave acquired companies in the state in which they were acquired, rather than trying to integrate their controls and conform them to those of current business units. After all, the reason for the acquisition was the profitability of the acquired company and nobody wants to be accused of negatively impacting profitability. A third situation may exist at locations outside the U.S. with what began simply as a sales office and then expanded its scope of operations to become a business unit with its own accounting and data processing functions. Unfortunately, it is not often the situation where there was a master plan for internal controls as the location’s scope grew. Processes are usually added and designed by the local personnel which, in practice, means the country manager has total control over financial affairs and is not truly accountable to the corporate office. This can be particularly true as long as a country business unit’s profits continue. In such situations, there will rarely be any focus on effective preventive internal controls for compliance risk. Where should a CCO begin in any of the above scenarios? The first step is to determine the extent of centralization or decentralization of relevant processes or, put another way, to what extent are relevant processes performed at the corporate offices? The second step for the CCO is to determine the possible universe of risks and to assess the risks to result in a priority of how attention will be focused. One useful approach is to perform a location risk assessment, whose purpose is to capture in one place each location outside the U.S. where your company conducts business and to assess the compliance risks posed by the nature of operations at each location. Once the risks at each location have been properly categorized, you can then prioritize your approach to dealing with the risks.  Three key takeaways: 1. Modifying your internal controls can work to more fully operationalize your compliance program. 2. Check the effectiveness of your internal controls for your international locations. 3. Revisit your internal controls when a country or region experience large growth or other disruption. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 06 Feb 2023 05:00:00 -0000 One Month to More Effective Internal Controls-Internal Controls in International Locations full Thomas Fox Today we focus on internal controls in international locations. While a CCO should expect (or at least hope) that internal controls at locations outside the U.S. are of the same effectiveness as internal controls within U.S. business units and at the U.S. corporate office; unfortunately, that might not always be the case. It is often the case that corporate level internal controls are stronger than those in foreign business units. There may well be several reasons for this. First, the CFO may be paying closer attention to the corporate level internal controls, with the idea that the corporate level internal controls are the final “filter” to detect issues. This follows partly from the focus in most companies on the controls over financial reporting, which does not include all controls needed for compliance. A second reason is that many companies were built through acquisitions, resulting in many business units (both in and outside the U.S.) having completely different accounting, ERP and internal control systems than the corporate office. There is often a tendency to leave acquired companies in the state in which they were acquired, rather than trying to integrate their controls and conform them to those of current business units. After all, the reason for the acquisition was the profitability of the acquired company and nobody wants to be accused of negatively impacting profitability. A third situation may exist at locations outside the U.S. with what began simply as a sales office and then expanded its scope of operations to become a business unit with its own accounting and data processing functions. Unfortunately, it is not often the situation where there was a master plan for internal controls as the location’s scope grew. Processes are usually added and designed by the local personnel which, in practice, means the country manager has total control over financial affairs and is not truly accountable to the corporate office. This can be particularly true as long as a country business unit’s profits continue. In such situations, there will rarely be any focus on effective preventive internal controls for compliance risk. Where should a CCO begin in any of the above scenarios? The first step is to determine the extent of centralization or decentralization of relevant processes or, put another way, to what extent are relevant processes performed at the corporate offices? The second step for the CCO is to determine the possible universe of risks and to assess the risks to result in a priority of how attention will be focused. One useful approach is to perform a location risk assessment, whose purpose is to capture in one place each location outside the U.S. where your company conducts business and to assess the compliance risks posed by the nature of operations at each location. Once the risks at each location have been properly categorized, you can then prioritize your approach to dealing with the risks.  Three key takeaways: 1. Modifying your internal controls can work to more fully operationalize your compliance program. 2. Check the effectiveness of your internal controls for your international locations. 3. Revisit your internal controls when a country or region experience large growth or other disruption. Learn more about your ad choices. Visit megaphone.fm/adchoices While a CCO should expect (or at least hope) that internal controls at locations outside the U.S. are of the same effectiveness as internal controls within U.S. business units and at the U.S. corporate office; unfortunately, that might not always be the case. It is often the case that corporate level internal controls are stronger than those in foreign business units. There may well be several reasons for this. First, the CFO may be paying closer attention to the corporate level internal controls, with the idea that the corporate level internal controls are the final “filter” to detect issues. This follows partly from the focus in most companies on the controls over financial reporting, which does not include all controls needed for compliance. A second reason is that many companies were built through acquisitions, resulting in many business units (both in and outside the U.S.) having completely different accounting, ERP and internal control systems than the corporate office. There is often a tendency to leave acquired companies in the state in which they were acquired, rather than trying to integrate their controls and conform them to those of current business units. After all, the reason for the acquisition was the profitability of the acquired company and nobody wants to be accused of negatively impacting profitability.

A third situation may exist at locations outside the U.S. with what began simply as a sales office and then expanded its scope of operations to become a business unit with its own accounting and data processing functions. Unfortunately, it is not often the situation where there was a master plan for internal controls as the location’s scope grew. Processes are usually added and designed by the local personnel which, in practice, means the country manager has total control over financial affairs and is not truly accountable to the corporate office. This can be particularly true as long as a country business unit’s profits continue. In such situations, there will rarely be any focus on effective preventive internal controls for compliance risk.

Where should a CCO begin in any of the above scenarios? The first step is to determine the extent of centralization or decentralization of relevant processes or, put another way, to what extent are relevant processes performed at the corporate offices? The second step for the CCO is to determine the possible universe of risks and to assess the risks to result in a priority of how attention will be focused. One useful approach is to perform a location risk assessment, whose purpose is to capture in one place each location outside the U.S. where your company conducts business and to assess the compliance risks posed by the nature of operations at each location. Once the risks at each location have been properly categorized, you can then prioritize your approach to dealing with the risks.

 Three key takeaways:

1. Modifying your internal controls can work to more fully operationalize your compliance program.

2. Check the effectiveness of your internal controls for your international locations.

3. Revisit your internal controls when a country or region experience large growth or other disruption.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 572 no One Month to More Effective Internal Controls- Four Key Internal Controls for Compliance There are four significant controls that every compliance program should have in it. They are: 1) DOA; 2) maintenance of the vendor master file; 3) contracts with third parties; and 4) movement of cash/currency. Your DOA should reflect the impact of compliance risk including both transactions and geographic location so that a higher level of approval for matters involving third parties, for fund transfers and invoice payments to countries outside the U.S. would be required inside your company.  Your vendor master file can be one of the most powerful preventative control tools largely because payments to fictitious vendors are one of the most common occupational frauds.  Your contracts with third parties can be a very effective internal control which works to prevent nefarious conduct rather than simply as a detect control.  Your controls over the disbursements of funds and movement of should include such methods accounts payable computer checks, manual checks, wire transfers, replenishment of petty cash, loans or advances. The bottom line is that internal controls are just good financial controls. The internal controls that detail requirements for third-party representatives in the compliance context will help to detect fraud, which could well lead to bribery and corruption.  Three key takeaways: 1. Remember the top four internal controls for an effective compliance program. 2. Effective internal controls should do more than protect but also prevent internal program violations. 3. Effective internal compliance controls are good financial controls. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 03 Feb 2023 05:00:00 -0000 Four Key Internal Controls for Compliance full Thomas Fox Today the 4 key internal controls for compliance. There are four significant controls that every compliance program should have in it. They are: 1) DOA; 2) maintenance of the vendor master file; 3) contracts with third parties; and 4) movement of cash/currency. Your DOA should reflect the impact of compliance risk including both transactions and geographic location so that a higher level of approval for matters involving third parties, for fund transfers and invoice payments to countries outside the U.S. would be required inside your company.  Your vendor master file can be one of the most powerful preventative control tools largely because payments to fictitious vendors are one of the most common occupational frauds.  Your contracts with third parties can be a very effective internal control which works to prevent nefarious conduct rather than simply as a detect control.  Your controls over the disbursements of funds and movement of should include such methods accounts payable computer checks, manual checks, wire transfers, replenishment of petty cash, loans or advances. The bottom line is that internal controls are just good financial controls. The internal controls that detail requirements for third-party representatives in the compliance context will help to detect fraud, which could well lead to bribery and corruption.  Three key takeaways: 1. Remember the top four internal controls for an effective compliance program. 2. Effective internal controls should do more than protect but also prevent internal program violations. 3. Effective internal compliance controls are good financial controls. Learn more about your ad choices. Visit megaphone.fm/adchoices There are four significant controls that every compliance program should have in it. They are: 1) DOA; 2) maintenance of the vendor master file; 3) contracts with third parties; and 4) movement of cash/currency.

  1. Your DOA should reflect the impact of compliance risk including both transactions and geographic location so that a higher level of approval for matters involving third parties, for fund transfers and invoice payments to countries outside the U.S. would be required inside your company. 
  2. Your vendor master file can be one of the most powerful preventative control tools largely because payments to fictitious vendors are one of the most common occupational frauds. 
  3. Your contracts with third parties can be a very effective internal control which works to prevent nefarious conduct rather than simply as a detect control. 
  4. Your controls over the disbursements of funds and movement of should include such methods accounts payable computer checks, manual checks, wire transfers, replenishment of petty cash, loans or advances.

The bottom line is that internal controls are just good financial controls. The internal controls that detail requirements for third-party representatives in the compliance context will help to detect fraud, which could well lead to bribery and corruption.

 Three key takeaways:

1. Remember the top four internal controls for an effective compliance program.

2. Effective internal controls should do more than protect but also prevent internal program violations.

3. Effective internal compliance controls are good financial controls.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 572 no One Month to More Effective Internal Controls- Discipline and Rigor in Your Internal Controls New York Times columnist David Brooks’ thoughts on building and maintaining order inform the discussion on rigor in your internal controls. In internal controls, I believe it is incumbent to consider not only the most obvious risk areas for your internal controls but also the universe of potential transactions within the operations of a company. There is a clear need for rigor in your internal controls protocols and adherence to that rigor can increase operationalization around the internal controls a company should consider including gifts, travel and entertainment expenses. Brooks said, “Building and maintaining order … requires toughness of mind and rigid discipline to properly serve your own work.” By having the rigor to institute and enforce the types of internal controls identified, you can go a long way towards detecting and, more importantly, preventing a FCPA violation from occurring. Some of the key areas of Internal Control focus should be:  ·       The Delegation of Authority (DOA)  Petty cash disbursements  ·       Travel  ·       P-Cards ·       Employee Expense Reports  ·       Corporate checks and wire transfers, such as check requests, purchase orders, or vendor invoices. ·       Gifts and business entertainment  Three key takeaways: 1. You must maintain rigor around your internal controls. 2. Controls against fraud can also help to prevent corruption. 3. Building and maintaining good internal controls requires rigor. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 02 Feb 2023 05:00:00 -0000 Discipline and Rigor in Your Internal Controls full Thomas Fox How can you bring discipline and rigor to your internal controls. New York Times columnist David Brooks’ thoughts on building and maintaining order inform the discussion on rigor in your internal controls. In internal controls, I believe it is incumbent to consider not only the most obvious risk areas for your internal controls but also the universe of potential transactions within the operations of a company. There is a clear need for rigor in your internal controls protocols and adherence to that rigor can increase operationalization around the internal controls a company should consider including gifts, travel and entertainment expenses. Brooks said, “Building and maintaining order … requires toughness of mind and rigid discipline to properly serve your own work.” By having the rigor to institute and enforce the types of internal controls identified, you can go a long way towards detecting and, more importantly, preventing a FCPA violation from occurring. Some of the key areas of Internal Control focus should be:  ·       The Delegation of Authority (DOA)  Petty cash disbursements  ·       Travel  ·       P-Cards ·       Employee Expense Reports  ·       Corporate checks and wire transfers, such as check requests, purchase orders, or vendor invoices. ·       Gifts and business entertainment  Three key takeaways: 1. You must maintain rigor around your internal controls. 2. Controls against fraud can also help to prevent corruption. 3. Building and maintaining good internal controls requires rigor. Learn more about your ad choices. Visit megaphone.fm/adchoices New York Times columnist David Brooks’ thoughts on building and maintaining order inform the discussion on rigor in your internal controls. In internal controls, I believe it is incumbent to consider not only the most obvious risk areas for your internal controls but also the universe of potential transactions within the operations of a company. There is a clear need for rigor in your internal controls protocols and adherence to that rigor can increase operationalization around the internal controls a company should consider including gifts, travel and entertainment expenses. Brooks said, “Building and maintaining order … requires toughness of mind and rigid discipline to properly serve your own work.” By having the rigor to institute and enforce the types of internal controls identified, you can go a long way towards detecting and, more importantly, preventing a FCPA violation from occurring.

Some of the key areas of Internal Control focus should be: 

·       The Delegation of Authority (DOA) 

Petty cash disbursements 

·       Travel 

·       P-Cards

·       Employee Expense Reports 

·       Corporate checks and wire transfers, such as check requests, purchase orders, or vendor invoices.

·       Gifts and business entertainment

 Three key takeaways:

1. You must maintain rigor around your internal controls.

2. Controls against fraud can also help to prevent corruption.

3. Building and maintaining good internal controls requires rigor.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 539 no One Month to More Effective Internal Controls- What Are Internal Controls? What specifically are internal controls in a compliance program? Internal controls are not only the foundation of a company but are also the foundation of any effective anti-corruption compliance program. Internal controls expert Joe Howell, has said that internal controls are systematic measures, such as reviews, checks and balances, methods and procedures, instituted by an organization that performs several different functions. Howell also notes that for compliance purposes, controls are those measures specifically to provide reasonable assurance any assets or resources of a company cannot be used to pay a bribe. This definition includes diversion of company assets, such as by unauthorized sales discounts or receivables write-offs as well as the distribution of assets. Three key takeaways: Effective internal controls are required under the FCPA. Internal controls are a critical part of any best practices compliance program. There are multiple FCPA enforcement actions that demonstrate the enforcement spotlight on internal controls. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 01 Feb 2023 05:00:00 -0000 What Are Internal Controls? full Thomas Fox In February we consider internal controls in a best practices compliance program. In Day 1-what are internal controls? What specifically are internal controls in a compliance program? Internal controls are not only the foundation of a company but are also the foundation of any effective anti-corruption compliance program. Internal controls expert Joe Howell, has said that internal controls are systematic measures, such as reviews, checks and balances, methods and procedures, instituted by an organization that performs several different functions. Howell also notes that for compliance purposes, controls are those measures specifically to provide reasonable assurance any assets or resources of a company cannot be used to pay a bribe. This definition includes diversion of company assets, such as by unauthorized sales discounts or receivables write-offs as well as the distribution of assets. Three key takeaways: Effective internal controls are required under the FCPA. Internal controls are a critical part of any best practices compliance program. There are multiple FCPA enforcement actions that demonstrate the enforcement spotlight on internal controls. Learn more about your ad choices. Visit megaphone.fm/adchoices What specifically are internal controls in a compliance program? Internal controls are not only the foundation of a company but are also the foundation of any effective anti-corruption compliance program. Internal controls expert Joe Howell, has said that internal controls are systematic measures, such as reviews, checks and balances, methods and procedures, instituted by an organization that performs several different functions. Howell also notes that for compliance purposes, controls are those measures specifically to provide reasonable assurance any assets or resources of a company cannot be used to pay a bribe. This definition includes diversion of company assets, such as by unauthorized sales discounts or receivables write-offs as well as the distribution of assets.

Three key takeaways:

  1. Effective internal controls are required under the FCPA.
  2. Internal controls are a critical part of any best practices compliance program.
  3. There are multiple FCPA enforcement actions that demonstrate the enforcement spotlight on internal controls.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 663 no One Month to More Effective Compliance on Business Ventures: Introduction For the month of March, we will be considering how to create a more effective compliance program involving business ventures. This will include the role of compliance in M&A, JV agreements, distributorships, teaming agreements and franchises as well as other forms of business relationships. The FCPA Resource Guide, 2nd edition made clear that one of the Hallmarks of An Effective Compliance Program is around M&A, in both the pre- and post-acquisition context. A company that does not perform adequate due diligence prior to a merger or acquisition it may face both legal and business risks. Perhaps, most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. In contrast, companies that conduct effective due diligence on their acquisition targets can evaluate more accurately each target’s value and negotiate for the costs of the bribery to be borne by the target. Equally important is that if a company engages in the suggested actions, they will go a long way towards insulating, or at least lessening, the risk of FCPA liability going forward. The 2020 Update went on to say that to “The extent to which a company subjects its acquisition targets to appropriate scrutiny is indicative of whether its compliance program is, as implemented, able to effectively enforce its internal controls and remediate misconduct at all levels of the organization” and posed the following queries. One of the key themes in this chapter is the integrated nature of compliance and business ventures. Whether the compliance work is seen in the M&A context, JV context or one of the myriad of other business relationships of the current business world, there is an approach that a CCO or compliance professional should take to assess the risk, monitor the risk and then manage the risk with continued monitoring with a feedback of data and information into your risk management strategy. Three key takeaways:  Consider the role of compliance in a wide variety of business relationships, including M&A, JV agreements, distributorships and franchises as well as other forms of business relationships. Compliance for M&A should be seen as a unidimensional continuum. The Evaluationfocuses on what data did your risk monitoring system turn up and how did you utilize it going forward? Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 01 Feb 2023 05:00:00 -0000 Introduction to Business Ventures full Thomas Fox In this episode I introduce March's topic of better compliance on business ventures. For the month of March, we will be considering how to create a more effective compliance program involving business ventures. This will include the role of compliance in M&A, JV agreements, distributorships, teaming agreements and franchises as well as other forms of business relationships. The FCPA Resource Guide, 2nd edition made clear that one of the Hallmarks of An Effective Compliance Program is around M&A, in both the pre- and post-acquisition context. A company that does not perform adequate due diligence prior to a merger or acquisition it may face both legal and business risks. Perhaps, most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. In contrast, companies that conduct effective due diligence on their acquisition targets can evaluate more accurately each target’s value and negotiate for the costs of the bribery to be borne by the target. Equally important is that if a company engages in the suggested actions, they will go a long way towards insulating, or at least lessening, the risk of FCPA liability going forward. The 2020 Update went on to say that to “The extent to which a company subjects its acquisition targets to appropriate scrutiny is indicative of whether its compliance program is, as implemented, able to effectively enforce its internal controls and remediate misconduct at all levels of the organization” and posed the following queries. One of the key themes in this chapter is the integrated nature of compliance and business ventures. Whether the compliance work is seen in the M&A context, JV context or one of the myriad of other business relationships of the current business world, there is an approach that a CCO or compliance professional should take to assess the risk, monitor the risk and then manage the risk with continued monitoring with a feedback of data and information into your risk management strategy. Three key takeaways:  Consider the role of compliance in a wide variety of business relationships, including M&A, JV agreements, distributorships and franchises as well as other forms of business relationships. Compliance for M&A should be seen as a unidimensional continuum. The Evaluationfocuses on what data did your risk monitoring system turn up and how did you utilize it going forward? Learn more about your ad choices. Visit megaphone.fm/adchoices For the month of March, we will be considering how to create a more effective compliance program involving business ventures. This will include the role of compliance in M&A, JV agreements, distributorships, teaming agreements and franchises as well as other forms of business relationships.

The FCPA Resource Guide, 2nd edition made clear that one of the Hallmarks of An Effective Compliance Program is around M&A, in both the pre- and post-acquisition context. A company that does not perform adequate due diligence prior to a merger or acquisition it may face both legal and business risks. Perhaps, most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. In contrast, companies that conduct effective due diligence on their acquisition targets can evaluate more accurately each target’s value and negotiate for the costs of the bribery to be borne by the target. Equally important is that if a company engages in the suggested actions, they will go a long way towards insulating, or at least lessening, the risk of FCPA liability going forward.

The 2020 Update went on to say that to “The extent to which a company subjects its acquisition targets to appropriate scrutiny is indicative of whether its compliance program is, as implemented, able to effectively enforce its internal controls and remediate misconduct at all levels of the organization” and posed the following queries.

One of the key themes in this chapter is the integrated nature of compliance and business ventures. Whether the compliance work is seen in the M&A context, JV context or one of the myriad of other business relationships of the current business world, there is an approach that a CCO or compliance professional should take to assess the risk, monitor the risk and then manage the risk with continued monitoring with a feedback of data and information into your risk management strategy.

Three key takeaways: 

  1. Consider the role of compliance in a wide variety of business relationships, including M&A, JV agreements, distributorships and franchises as well as other forms of business relationships.
  2. Compliance for M&A should be seen as a unidimensional continuum.
  3. The Evaluationfocuses on what data did your risk monitoring system turn up and how did you utilize it going forward?


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 515 no Day 31 - Using a root cause analysis for remediation The 2020 Update re-emphasized the need for both performing a root cause analysis but equally importantly using it to remediate your compliance program. It stated, “a hallmark of a compliance program that is working effectively in practice is the extent to which a company is able to conduct a thoughtful root cause analysis of misconduct and timely and appropriately remediate to address the root causes.” It went on to state, what additional steps the company has taken “that demonstrate recognition of the seriousness of the misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risk”).” The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Identify current and future needs for organizational improvement. Your solution should be a repeatable, step-by-step processes, in which one process can confirm the results of another. Focusing on the corrective measures of root causes is more effective than simply treating the symptoms of a problem or event and you will have a much more robust solution in place. This is because the solution(s) are more effective when accomplished through a systematic process with conclusions backed up by evidence. When you step back and consider what the DOJ was trying to accomplish with its 2020 Update, it becomes clear what the DOJ expects from the compliance professional. Consider the structure of your compliance program and how it inter-relates to your company’s risk profile. When you have a compliance failure, use the root cause analysis to think about how each of the structural elements of your compliance program could impact how you manage and deal with that risk. Three key takeaways: The key is objectivity and independence. The critical element is how did you use the information you developed in the root cause analysis? The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 31 Jan 2023 00:00:00 -0000 Day 31 - Using a root cause analysis for remediation bonus 31 Thomas Fox Using a root cause analysis to lead remediation of your compliance program. The 2020 Update re-emphasized the need for both performing a root cause analysis but equally importantly using it to remediate your compliance program. It stated, “a hallmark of a compliance program that is working effectively in practice is the extent to which a company is able to conduct a thoughtful root cause analysis of misconduct and timely and appropriately remediate to address the root causes.” It went on to state, what additional steps the company has taken “that demonstrate recognition of the seriousness of the misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risk”).” The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Identify current and future needs for organizational improvement. Your solution should be a repeatable, step-by-step processes, in which one process can confirm the results of another. Focusing on the corrective measures of root causes is more effective than simply treating the symptoms of a problem or event and you will have a much more robust solution in place. This is because the solution(s) are more effective when accomplished through a systematic process with conclusions backed up by evidence. When you step back and consider what the DOJ was trying to accomplish with its 2020 Update, it becomes clear what the DOJ expects from the compliance professional. Consider the structure of your compliance program and how it inter-relates to your company’s risk profile. When you have a compliance failure, use the root cause analysis to think about how each of the structural elements of your compliance program could impact how you manage and deal with that risk. Three key takeaways: The key is objectivity and independence. The critical element is how did you use the information you developed in the root cause analysis? The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2020 Update re-emphasized the need for both performing a root cause analysis but equally importantly using it to remediate your compliance program. It stated, “a hallmark of a compliance program that is working effectively in practice is the extent to which a company is able to conduct a thoughtful root cause analysis of misconduct and timely and appropriately remediate to address the root causes.”

It went on to state, what additional steps the company has taken “that demonstrate recognition of the seriousness of the misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risk”).”

The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Identify current and future needs for organizational improvement. Your solution should be a repeatable, step-by-step processes, in which one process can confirm the results of another. Focusing on the corrective measures of root causes is more effective than simply treating the symptoms of a problem or event and you will have a much more robust solution in place. This is because the solution(s) are more effective when accomplished through a systematic process with conclusions backed up by evidence.

When you step back and consider what the DOJ was trying to accomplish with its 2020 Update, it becomes clear what the DOJ expects from the compliance professional. Consider the structure of your compliance program and how it inter-relates to your company’s risk profile. When you have a compliance failure, use the root cause analysis to think about how each of the structural elements of your compliance program could impact how you manage and deal with that risk.

Three key takeaways:

  1. The key is objectivity and independence.
  2. The critical element is how did you use the information you developed in the root cause analysis?
  3. The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 530 no Day 30 - What is a root cause analysis? One of the biggest changes in the 2020 FCPA Resource Guide, 2nd edition was the addition of a new Hallmark, entitled “Investigation, Analysis, and Remediation of Misconduct”, which reads in full: The truest measure of an effective compliance program is how it responds to misconduct. Accordingly, for a compliance program to be truly effective, it should have a well-functioning and appropriately funded mechanism for the timely and thorough investigations of any allegations or suspicions of misconduct by the company, its employees, or agents. An effective investigations structure will also have an established means of documenting the company’s response, including any disciplinary or remediation measures taken. In addition to having a mechanism for responding to the specific incident of misconduct, the company’s program should also integrate lessons learned from any misconduct into the company’s policies, training, and controls. To do so, a company will need to analyze the root causes of the misconduct to timely and appropriately remediate those causes to prevent future compliance breaches. Ultimately, performing a root cause analysis is not simply a matter of sitting down and asking a multitude of questions. You need to have an operational understanding of how a business operates and how they have developed their customer base. Overlay the need to understand what makes an effective compliance program, with the skepticism an auditor should bring so that you do not simply accept an answer that is provided to you, as you might in an internal investigation. As Marks noted, “a root cause analysis is not something where you can just go ask the five whys. You need these trained professionals who really understand what they’re doing.” Three key takeaways: A root cause analysis is now required if you have a reportable compliance failure. There is no one process for performing a root cause analysis. You should select the one which works for you and follow it. To properly perform a root cause analysis, you need trained professionals who really understand what they’re doing. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 30 Jan 2023 05:00:00 -0000 Day 30 - What is a root cause analysis? bonus 30 Thomas Fox Today, we consider what is a root cause analysis. One of the biggest changes in the 2020 FCPA Resource Guide, 2nd edition was the addition of a new Hallmark, entitled “Investigation, Analysis, and Remediation of Misconduct”, which reads in full: The truest measure of an effective compliance program is how it responds to misconduct. Accordingly, for a compliance program to be truly effective, it should have a well-functioning and appropriately funded mechanism for the timely and thorough investigations of any allegations or suspicions of misconduct by the company, its employees, or agents. An effective investigations structure will also have an established means of documenting the company’s response, including any disciplinary or remediation measures taken. In addition to having a mechanism for responding to the specific incident of misconduct, the company’s program should also integrate lessons learned from any misconduct into the company’s policies, training, and controls. To do so, a company will need to analyze the root causes of the misconduct to timely and appropriately remediate those causes to prevent future compliance breaches. Ultimately, performing a root cause analysis is not simply a matter of sitting down and asking a multitude of questions. You need to have an operational understanding of how a business operates and how they have developed their customer base. Overlay the need to understand what makes an effective compliance program, with the skepticism an auditor should bring so that you do not simply accept an answer that is provided to you, as you might in an internal investigation. As Marks noted, “a root cause analysis is not something where you can just go ask the five whys. You need these trained professionals who really understand what they’re doing.” Three key takeaways: A root cause analysis is now required if you have a reportable compliance failure. There is no one process for performing a root cause analysis. You should select the one which works for you and follow it. To properly perform a root cause analysis, you need trained professionals who really understand what they’re doing. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the biggest changes in the 2020 FCPA Resource Guide, 2nd edition was the addition of a new Hallmark, entitled “Investigation, Analysis, and Remediation of Misconduct”, which reads in full:

The truest measure of an effective compliance program is how it responds to misconduct. Accordingly, for a compliance program to be truly effective, it should have a well-functioning and appropriately funded mechanism for the timely and thorough investigations of any allegations or suspicions of misconduct by the company, its employees, or agents. An effective investigations structure will also have an established means of documenting the company’s response, including any disciplinary or remediation measures taken.

In addition to having a mechanism for responding to the specific incident of misconduct, the company’s program should also integrate lessons learned from any misconduct into the company’s policies, training, and controls. To do so, a company will need to analyze the root causes of the misconduct to timely and appropriately remediate those causes to prevent future compliance breaches.

Ultimately, performing a root cause analysis is not simply a matter of sitting down and asking a multitude of questions. You need to have an operational understanding of how a business operates and how they have developed their customer base. Overlay the need to understand what makes an effective compliance program, with the skepticism an auditor should bring so that you do not simply accept an answer that is provided to you, as you might in an internal investigation. As Marks noted, “a root cause analysis is not something where you can just go ask the five whys. You need these trained professionals who really understand what they’re doing.”

Three key takeaways:

  1. A root cause analysis is now required if you have a reportable compliance failure.
  2. There is no one process for performing a root cause analysis. You should select the one which works for you and follow it.
  3. To properly perform a root cause analysis, you need trained professionals who really understand what they’re doing.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 527 no Day 29 - Post-acquisition integration plan Your company has just made its largest acquisition ever and your CEO says they want you to have a compliance post-acquisition integration plan on their desk in one week. Where do you begin? A good place to start would be the 2020 FCPA Resource Guide, 2nd edition language: Pre-acquisition due diligence, however, is normally only a portion of the compliance process for mergers and acquisitions. DOJ and SEC evaluate whether the acquiring company promptly incorporated the acquired company into all of its internal controls, including its compliance program. Companies should consider training new employees, reevaluating third parties under company standards, and, where appropriate, conducting audits on new business units. The bottom line is that you must train the newly acquired employees, reevaluate third parties under your company standards, and conduct compliance audits on new business units. This process should be based your pre-acquisition due diligence and risk assessment. Moreover, the DOJ and SEC clearly view both the pre- and post-acquisition phases of M&A as tied together in a unidimensional continuum. If pre-acquisition due diligence is not possible, you should review the requirements and time frames laid out in Opinion Release 08-02 or the 2020 FCPA Resource Guide, which noted, “pursuant to which companies can nevertheless be rewarded if they choose to conduct thorough post-acquisition FCPA due diligence.” Whatever compendium of steps you utilize for post-acquisition integration, they should be taken as soon as is practicable. The earlier you can deploy these steps the better off your company will be at the end of the day. An acquisition that fails for compliance reasons is a preventable disaster of the first order. One need only consider the Latin Node Inc. FCPA enforcement actions where the acquiring company had to write off its entire investment because it had wholly failed to engage in appropriate pre-acquisition due diligence.  Three key takeaways: Planning is critical in the post-acquisition phase. Build upon what you learned in pre-acquisition due diligence. You literally need to be ready to hit the ground running when a transaction closes. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 29 Jan 2023 00:00:00 -0000 Day 29 - Post-acquisition integration plan bonus 29 Thomas Fox The role of your post-acquisition integration plan. Your company has just made its largest acquisition ever and your CEO says they want you to have a compliance post-acquisition integration plan on their desk in one week. Where do you begin? A good place to start would be the 2020 FCPA Resource Guide, 2nd edition language: Pre-acquisition due diligence, however, is normally only a portion of the compliance process for mergers and acquisitions. DOJ and SEC evaluate whether the acquiring company promptly incorporated the acquired company into all of its internal controls, including its compliance program. Companies should consider training new employees, reevaluating third parties under company standards, and, where appropriate, conducting audits on new business units. The bottom line is that you must train the newly acquired employees, reevaluate third parties under your company standards, and conduct compliance audits on new business units. This process should be based your pre-acquisition due diligence and risk assessment. Moreover, the DOJ and SEC clearly view both the pre- and post-acquisition phases of M&A as tied together in a unidimensional continuum. If pre-acquisition due diligence is not possible, you should review the requirements and time frames laid out in Opinion Release 08-02 or the 2020 FCPA Resource Guide, which noted, “pursuant to which companies can nevertheless be rewarded if they choose to conduct thorough post-acquisition FCPA due diligence.” Whatever compendium of steps you utilize for post-acquisition integration, they should be taken as soon as is practicable. The earlier you can deploy these steps the better off your company will be at the end of the day. An acquisition that fails for compliance reasons is a preventable disaster of the first order. One need only consider the Latin Node Inc. FCPA enforcement actions where the acquiring company had to write off its entire investment because it had wholly failed to engage in appropriate pre-acquisition due diligence.  Three key takeaways: Planning is critical in the post-acquisition phase. Build upon what you learned in pre-acquisition due diligence. You literally need to be ready to hit the ground running when a transaction closes. Learn more about your ad choices. Visit megaphone.fm/adchoices Your company has just made its largest acquisition ever and your CEO says they want you to have a compliance post-acquisition integration plan on their desk in one week. Where do you begin? A good place to start would be the 2020 FCPA Resource Guide, 2nd edition language:

Pre-acquisition due diligence, however, is normally only a portion of the compliance process for mergers and acquisitions. DOJ and SEC evaluate whether the acquiring company promptly incorporated the acquired company into all of its internal controls, including its compliance program. Companies should consider training new employees, reevaluating third parties under company standards, and, where appropriate, conducting audits on new business units.

The bottom line is that you must train the newly acquired employees, reevaluate third parties under your company standards, and conduct compliance audits on new business units. This process should be based your pre-acquisition due diligence and risk assessment. Moreover, the DOJ and SEC clearly view both the pre- and post-acquisition phases of M&A as tied together in a unidimensional continuum. If pre-acquisition due diligence is not possible, you should review the requirements and time frames laid out in Opinion Release 08-02 or the 2020 FCPA Resource Guide, which noted, “pursuant to which companies can nevertheless be rewarded if they choose to conduct thorough post-acquisition FCPA due diligence.” Whatever compendium of steps you utilize for post-acquisition integration, they should be taken as soon as is practicable.

The earlier you can deploy these steps the better off your company will be at the end of the day. An acquisition that fails for compliance reasons is a preventable disaster of the first order. One need only consider the Latin Node Inc. FCPA enforcement actions where the acquiring company had to write off its entire investment because it had wholly failed to engage in appropriate pre-acquisition due diligence.

 Three key takeaways:

  1. Planning is critical in the post-acquisition phase.
  2. Build upon what you learned in pre-acquisition due diligence.
  3. You literally need to be ready to hit the ground running when a transaction closes.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 528 no Day 28 - Pre-acquisition due diligence in mergers and acquisitions A company that does not perform adequate due diligence prior to a merger or acquisition may face both legal and business risks. Perhaps most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. While most compliance practitioners have been long aware of the requirement in the post-acquisition context, the the FCPA Resource Guide, 2nd edition, focused many compliance practitioners of the need to engage in robust pre-acquisition due diligence. The 2020 Update made even more clear the need for a robust compliance presence in the pre-acquisition phase. It stated, “A well-designed compliance program should include comprehensive due diligence of any acquisition targets, as well as a process for timely and orderly integration of the acquired entity into existing compliance program structures and internal controls. Pre-M&A due diligence, where possible, enables the acquiring company to evaluate more accurately each target’s value and negotiate for the costs of any corruption or misconduct to be borne by the target. Flawed or incomplete pre- or post-acquisition due diligence and integration can allow misconduct to continue at the target company, causing resulting harm to a business’s profitability and reputation and risking civil and criminal liability.” There are multiple red flags which could be raised in this process, which might well warrant further investigation. They include if the target has ineffective compliance program elements in their compliance program or if there were frequent breach of policies and procedures. Obviously, a target which is in financial difficulty would bear closer scrutiny. Structurally, if the company did not have a formal ethics and compliance committee at the senior management or Board of Directors’ level, this could present issues. From the CCO perspective, if the position did not have Board or CEO access or if there were not regular reports to the Board, it could present an issue for compliance. Conversely, if there were frequent requests to waive policies, management over-ride of compliance controls or no consistent consequence management for violations; it could present clear red flags for further investigation. Three key takeaways:  The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward. Periodically review your M&A due diligence protocol. If red flags appear in pre-acquisition due diligence, they should be cleared. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 28 Jan 2023 00:00:00 -0000 Day 28 - Pre-acquisition due diligence in mergers and acquisitions bonus 28 Thomas Fox The role of Pre-acquisition due diligence in mergers and acquisitions. A company that does not perform adequate due diligence prior to a merger or acquisition may face both legal and business risks. Perhaps most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. While most compliance practitioners have been long aware of the requirement in the post-acquisition context, the the FCPA Resource Guide, 2nd edition, focused many compliance practitioners of the need to engage in robust pre-acquisition due diligence. The 2020 Update made even more clear the need for a robust compliance presence in the pre-acquisition phase. It stated, “A well-designed compliance program should include comprehensive due diligence of any acquisition targets, as well as a process for timely and orderly integration of the acquired entity into existing compliance program structures and internal controls. Pre-M&A due diligence, where possible, enables the acquiring company to evaluate more accurately each target’s value and negotiate for the costs of any corruption or misconduct to be borne by the target. Flawed or incomplete pre- or post-acquisition due diligence and integration can allow misconduct to continue at the target company, causing resulting harm to a business’s profitability and reputation and risking civil and criminal liability.” There are multiple red flags which could be raised in this process, which might well warrant further investigation. They include if the target has ineffective compliance program elements in their compliance program or if there were frequent breach of policies and procedures. Obviously, a target which is in financial difficulty would bear closer scrutiny. Structurally, if the company did not have a formal ethics and compliance committee at the senior management or Board of Directors’ level, this could present issues. From the CCO perspective, if the position did not have Board or CEO access or if there were not regular reports to the Board, it could present an issue for compliance. Conversely, if there were frequent requests to waive policies, management over-ride of compliance controls or no consistent consequence management for violations; it could present clear red flags for further investigation. Three key takeaways:  The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward. Periodically review your M&A due diligence protocol. If red flags appear in pre-acquisition due diligence, they should be cleared. Learn more about your ad choices. Visit megaphone.fm/adchoices A company that does not perform adequate due diligence prior to a merger or acquisition may face both legal and business risks. Perhaps most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. While most compliance practitioners have been long aware of the requirement in the post-acquisition context, the the FCPA Resource Guide, 2nd edition, focused many compliance practitioners of the need to engage in robust pre-acquisition due diligence.

The 2020 Update made even more clear the need for a robust compliance presence in the pre-acquisition phase. It stated, “A well-designed compliance program should include comprehensive due diligence of any acquisition targets, as well as a process for timely and orderly integration of the acquired entity into existing compliance program structures and internal controls. Pre-M&A due diligence, where possible, enables the acquiring company to evaluate more accurately each target’s value and negotiate for the costs of any corruption or misconduct to be borne by the target. Flawed or incomplete pre- or post-acquisition due diligence and integration can allow misconduct to continue at the target company, causing resulting harm to a business’s profitability and reputation and risking civil and criminal liability.”

There are multiple red flags which could be raised in this process, which might well warrant further investigation. They include if the target has ineffective compliance program elements in their compliance program or if there were frequent breach of policies and procedures. Obviously, a target which is in financial difficulty would bear closer scrutiny. Structurally, if the company did not have a formal ethics and compliance committee at the senior management or Board of Directors’ level, this could present issues. From the CCO perspective, if the position did not have Board or CEO access or if there were not regular reports to the Board, it could present an issue for compliance. Conversely, if there were frequent requests to waive policies, management over-ride of compliance controls or no consistent consequence management for violations; it could present clear red flags for further investigation.

Three key takeaways: 

  1. The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward.
  2. Periodically review your M&A due diligence protocol.
  3. If red flags appear in pre-acquisition due diligence, they should be cleared.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 528 no Day 27- Operationalizing Compliance Through Payroll One of the areas articulated in the 2020 Update was around payments and payroll. For the both the compliance professional and the corporate payroll function, there is a significant role to play in the operationalization of a corporate compliance program. The 2020 Update was replete with references to payment and its critical nature to any best practices compliance program. This includes references to payments to foreign officials, payments to third parties and hiding bribes in payments to distributors. The 2020 Update begins with an admonition to stop wasting time on low hanging fruit when there are much higher risks in your business operations. The role of payroll in compliance is not often considered in operationalizing your compliance program, yet the monies to fund bribes must come from somewhere. Unfortunately, one of those places is out of payroll. All CCOs need to sit down with his or her head of payroll, have them explain the role of payroll, then review the internal controls in place to see how they facilitate the goals of compliance. From that review, you can then determine how to use payroll to help to operationalize your compliance program. The DOJ has now provided its clearest statement on how it expects a company to actually do compliance going forward. Long gone are the days where the DOJ simply considered the inputs of a written program as sufficient to protect companies from compliance violations. Yet the mandate to operationalize a corporate compliance program drives home the concept that compliance is a business process, which should be administered by the appropriate business unit with the requisite SME. When it comes to following the money, payroll is the most well-suited corporate discipline to provide this first level of oversight and controls. Three key takeaways: Payroll can be a key prevent and detect control. The 2020 Update specified the tying of the corporate compliance function to the corporate payroll function. Offshore payments remain a key indicator for a red flag. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 27 Jan 2023 00:00:00 -0000 Day 27- Operationalizing Compliance Through Payroll bonus 27 Thomas Fox How to operationalize you compliance program through your payroll function. One of the areas articulated in the 2020 Update was around payments and payroll. For the both the compliance professional and the corporate payroll function, there is a significant role to play in the operationalization of a corporate compliance program. The 2020 Update was replete with references to payment and its critical nature to any best practices compliance program. This includes references to payments to foreign officials, payments to third parties and hiding bribes in payments to distributors. The 2020 Update begins with an admonition to stop wasting time on low hanging fruit when there are much higher risks in your business operations. The role of payroll in compliance is not often considered in operationalizing your compliance program, yet the monies to fund bribes must come from somewhere. Unfortunately, one of those places is out of payroll. All CCOs need to sit down with his or her head of payroll, have them explain the role of payroll, then review the internal controls in place to see how they facilitate the goals of compliance. From that review, you can then determine how to use payroll to help to operationalize your compliance program. The DOJ has now provided its clearest statement on how it expects a company to actually do compliance going forward. Long gone are the days where the DOJ simply considered the inputs of a written program as sufficient to protect companies from compliance violations. Yet the mandate to operationalize a corporate compliance program drives home the concept that compliance is a business process, which should be administered by the appropriate business unit with the requisite SME. When it comes to following the money, payroll is the most well-suited corporate discipline to provide this first level of oversight and controls. Three key takeaways: Payroll can be a key prevent and detect control. The 2020 Update specified the tying of the corporate compliance function to the corporate payroll function. Offshore payments remain a key indicator for a red flag. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the areas articulated in the 2020 Update was around payments and payroll. For the both the compliance professional and the corporate payroll function, there is a significant role to play in the operationalization of a corporate compliance program. The 2020 Update was replete with references to payment and its critical nature to any best practices compliance program. This includes references to payments to foreign officials, payments to third parties and hiding bribes in payments to distributors. The 2020 Update begins with an admonition to stop wasting time on low hanging fruit when there are much higher risks in your business operations.

The role of payroll in compliance is not often considered in operationalizing your compliance program, yet the monies to fund bribes must come from somewhere. Unfortunately, one of those places is out of payroll. All CCOs need to sit down with his or her head of payroll, have them explain the role of payroll, then review the internal controls in place to see how they facilitate the goals of compliance. From that review, you can then determine how to use payroll to help to operationalize your compliance program.

The DOJ has now provided its clearest statement on how it expects a company to actually do compliance going forward. Long gone are the days where the DOJ simply considered the inputs of a written program as sufficient to protect companies from compliance violations. Yet the mandate to operationalize a corporate compliance program drives home the concept that compliance is a business process, which should be administered by the appropriate business unit with the requisite SME. When it comes to following the money, payroll is the most well-suited corporate discipline to provide this first level of oversight and controls.

Three key takeaways:

  1. Payroll can be a key prevent and detect control.
  2. The 2020 Update specified the tying of the corporate compliance function to the corporate payroll function.
  3. Offshore payments remain a key indicator for a red flag.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 528 no Day 26 - Compliance function in an organization The role of the compliance professional and the compliance function in a corporation has steadily grown in stature and prestige over the years. When it came to the corporate compliance function, 2020 FCPA Resource Guide, under the Hallmarks of an Effective Compliance Program, simply noted the government would “consider whether the company devoted adequate staffing and resources to the compliance program given the size, structure, and risk profile of the business.” The Monaco Memo and 2023 changes to the Corporate Enforcement Policy has made this all the more critical going forward. This Hallmark was significantly expanded in both the FCPA Corporate Enforcement Policy and 2020 Update. In the FCPA Corporate Enforcement Policy, the DOJ listed the following as factors relating to a corporate compliance function, that it would consider as indicia of an effective compliance and ethics program: 1) the resources the company has dedicated to compliance; 2) the quality and experience of the personnel involved in compliance, such that they can understand and identify the transactions and activities that pose a potential risk; 3) the authority and independence of the compliance function and the availability of compliance expertise to the board; 4) the compensation and promotion of the personnel involved in compliance, in view of their role, responsibilities, performance, and other appropriate factors; and 5) the reporting structure of any compliance personnel employed or contracted by the company. The 2020 Update, Monaco Memo and 2023 update to the Corporate Enforcement Policy all demonstrate the continued evolution in the thinking of the DOJ around the corporate compliance function Their articulated inquiries can only strengthen a corporate compliance function specifically; and the compliance profession more generally. The more the DOJ talks about the independence of the compliance function, coupled with resources being made available and authority concomitant with the corporate compliance function, the more corporations will see it is directly in their interest to provide the resources, authority and gravitas to compliance position in their organizations. Three key takeaways: How is compliance treated in the budget process? Has your compliance function had any decisions over-ridden by senior management? Beware outsourcing of compliance as any such contractor must have access to company documents and personnel. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 26 Jan 2023 00:00:00 -0000 Day 26 - Compliance function in an organization bonus 26 Thomas Fox What is the role of your compliance function in your company? The role of the compliance professional and the compliance function in a corporation has steadily grown in stature and prestige over the years. When it came to the corporate compliance function, 2020 FCPA Resource Guide, under the Hallmarks of an Effective Compliance Program, simply noted the government would “consider whether the company devoted adequate staffing and resources to the compliance program given the size, structure, and risk profile of the business.” The Monaco Memo and 2023 changes to the Corporate Enforcement Policy has made this all the more critical going forward. This Hallmark was significantly expanded in both the FCPA Corporate Enforcement Policy and 2020 Update. In the FCPA Corporate Enforcement Policy, the DOJ listed the following as factors relating to a corporate compliance function, that it would consider as indicia of an effective compliance and ethics program: 1) the resources the company has dedicated to compliance; 2) the quality and experience of the personnel involved in compliance, such that they can understand and identify the transactions and activities that pose a potential risk; 3) the authority and independence of the compliance function and the availability of compliance expertise to the board; 4) the compensation and promotion of the personnel involved in compliance, in view of their role, responsibilities, performance, and other appropriate factors; and 5) the reporting structure of any compliance personnel employed or contracted by the company. The 2020 Update, Monaco Memo and 2023 update to the Corporate Enforcement Policy all demonstrate the continued evolution in the thinking of the DOJ around the corporate compliance function Their articulated inquiries can only strengthen a corporate compliance function specifically; and the compliance profession more generally. The more the DOJ talks about the independence of the compliance function, coupled with resources being made available and authority concomitant with the corporate compliance function, the more corporations will see it is directly in their interest to provide the resources, authority and gravitas to compliance position in their organizations. Three key takeaways: How is compliance treated in the budget process? Has your compliance function had any decisions over-ridden by senior management? Beware outsourcing of compliance as any such contractor must have access to company documents and personnel. Learn more about your ad choices. Visit megaphone.fm/adchoices The role of the compliance professional and the compliance function in a corporation has steadily grown in stature and prestige over the years. When it came to the corporate compliance function, 2020 FCPA Resource Guide, under the Hallmarks of an Effective Compliance Program, simply noted the government would “consider whether the company devoted adequate staffing and resources to the compliance program given the size, structure, and risk profile of the business.” The Monaco Memo and 2023 changes to the Corporate Enforcement Policy has made this all the more critical going forward.

This Hallmark was significantly expanded in both the FCPA Corporate Enforcement Policy and 2020 Update. In the FCPA Corporate Enforcement Policy, the DOJ listed the following as factors relating to a corporate compliance function, that it would consider as indicia of an effective compliance and ethics program: 1) the resources the company has dedicated to compliance; 2) the quality and experience of the personnel involved in compliance, such that they can understand and identify the transactions and activities that pose a potential risk; 3) the authority and independence of the compliance function and the availability of compliance expertise to the board; 4) the compensation and promotion of the personnel involved in compliance, in view of their role, responsibilities, performance, and other appropriate factors; and 5) the reporting structure of any compliance personnel employed or contracted by the company.

The 2020 Update, Monaco Memo and 2023 update to the Corporate Enforcement Policy all demonstrate the continued evolution in the thinking of the DOJ around the corporate compliance function Their articulated inquiries can only strengthen a corporate compliance function specifically; and the compliance profession more generally. The more the DOJ talks about the independence of the compliance function, coupled with resources being made available and authority concomitant with the corporate compliance function, the more corporations will see it is directly in their interest to provide the resources, authority and gravitas to compliance position in their organizations.

Three key takeaways:

  1. How is compliance treated in the budget process?
  2. Has your compliance function had any decisions over-ridden by senior management?
  3. Beware outsourcing of compliance as any such contractor must have access to company documents and personnel.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 471 no Day 25 - CCO authority and independence The role of the CCO has steadily grown in stature and prestige over the years. In the 2020 FCPA Resource Guide, under the Hallmarks of an Effective Compliance Program, it focused on the whether the CCO held senior management status and had a direct reporting line to the Board. The new requirement for CCO certification has only emphasized this reality. This Hallmark was significantly expanded in both the 2020 Update and the FCPA Corporate Enforcement Policy. And in so doing, the DOJ has increased the prestige, authority and role of both the CCO and corporate compliance function. The 2020 Update has five general areas of inquiry around the CCO and corporate compliance function. (1) How does the CCO salary and stature within the organization compare to other senior executives within the company. (2) What are the experience and stature of the CCO with an organization? Does the CCO have appropriate training for the role? (3) How much autonomy does the CCO have to report to the Board of Directors? How often do the CCO meet with directors? Are members of the senior management present for these meetings with the Board of Directors or of the Audit Committee? (4) What is your structure? Is the compliance function run by a designated chief compliance officer, or another executive within the company, and does that person have other roles within the company? (5) Is data in your organization so siloed that the CCO does not have access to it? If so, what are you doing about it? Once again for the compliance professional, the FCPA Corporate Enforcement Policy and 2020 Update make the importance of a best practices compliance program even more critical. The DOJ is focusing more on the role, expertise and how the compliance function is treated within an organization. Pay your CCO considerably less than your GC? You may now better be able to justify that discrepancy. If you have a legal department budget of $3 million and a compliance department budget of $500,000; you may be starting behind the eight-ball. Three key takeaways: How can you show the CCO really has a seat at the senior executive table? What are the professional qualifications of your CCO? Does your CCO have true independence to report directly to the Board of Directors? Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 25 Jan 2023 00:00:00 -0000 Day 25 - CCO authority and independence bonus 25 Thomas Fox In this episode we consider CCO authority and independence. The role of the CCO has steadily grown in stature and prestige over the years. In the 2020 FCPA Resource Guide, under the Hallmarks of an Effective Compliance Program, it focused on the whether the CCO held senior management status and had a direct reporting line to the Board. The new requirement for CCO certification has only emphasized this reality. This Hallmark was significantly expanded in both the 2020 Update and the FCPA Corporate Enforcement Policy. And in so doing, the DOJ has increased the prestige, authority and role of both the CCO and corporate compliance function. The 2020 Update has five general areas of inquiry around the CCO and corporate compliance function. (1) How does the CCO salary and stature within the organization compare to other senior executives within the company. (2) What are the experience and stature of the CCO with an organization? Does the CCO have appropriate training for the role? (3) How much autonomy does the CCO have to report to the Board of Directors? How often do the CCO meet with directors? Are members of the senior management present for these meetings with the Board of Directors or of the Audit Committee? (4) What is your structure? Is the compliance function run by a designated chief compliance officer, or another executive within the company, and does that person have other roles within the company? (5) Is data in your organization so siloed that the CCO does not have access to it? If so, what are you doing about it? Once again for the compliance professional, the FCPA Corporate Enforcement Policy and 2020 Update make the importance of a best practices compliance program even more critical. The DOJ is focusing more on the role, expertise and how the compliance function is treated within an organization. Pay your CCO considerably less than your GC? You may now better be able to justify that discrepancy. If you have a legal department budget of $3 million and a compliance department budget of $500,000; you may be starting behind the eight-ball. Three key takeaways: How can you show the CCO really has a seat at the senior executive table? What are the professional qualifications of your CCO? Does your CCO have true independence to report directly to the Board of Directors? Learn more about your ad choices. Visit megaphone.fm/adchoices The role of the CCO has steadily grown in stature and prestige over the years. In the 2020 FCPA Resource Guide, under the Hallmarks of an Effective Compliance Program, it focused on the whether the CCO held senior management status and had a direct reporting line to the Board. The new requirement for CCO certification has only emphasized this reality.

This Hallmark was significantly expanded in both the 2020 Update and the FCPA Corporate Enforcement Policy. And in so doing, the DOJ has increased the prestige, authority and role of both the CCO and corporate compliance function. The 2020 Update has five general areas of inquiry around the CCO and corporate compliance function. (1) How does the CCO salary and stature within the organization compare to other senior executives within the company. (2) What are the experience and stature of the CCO with an organization? Does the CCO have appropriate training for the role? (3) How much autonomy does the CCO have to report to the Board of Directors? How often do the CCO meet with directors? Are members of the senior management present for these meetings with the Board of Directors or of the Audit Committee? (4) What is your structure? Is the compliance function run by a designated chief compliance officer, or another executive within the company, and does that person have other roles within the company? (5) Is data in your organization so siloed that the CCO does not have access to it? If so, what are you doing about it?

Once again for the compliance professional, the FCPA Corporate Enforcement Policy and 2020 Update make the importance of a best practices compliance program even more critical. The DOJ is focusing more on the role, expertise and how the compliance function is treated within an organization. Pay your CCO considerably less than your GC? You may now better be able to justify that discrepancy. If you have a legal department budget of $3 million and a compliance department budget of $500,000; you may be starting behind the eight-ball.

Three key takeaways:

  1. How can you show the CCO really has a seat at the senior executive table?
  2. What are the professional qualifications of your CCO?
  3. Does your CCO have true independence to report directly to the Board of Directors?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 531 no Day 24 - Updates and feedback One of the critical elements found in the 2020 Update is the need to use the information you obtain, whether through risk assessment, root cause analysis, investigation, hotline report or any other manner to remediate the situation which allowed it to arise. Your company should establish a regular monitoring system to spot issues and address them. Effective monitoring means applying a consistent set of protocols, checks, and controls tailored to your company’s risks to detect and remediate compliance problems on an ongoing basis. To address this, your compliance team should be checking in routinely with local finance departments in your foreign offices to ask if they have noticed recent accounting irregularities. Regional directors should be required to keep tabs on potential improper activity in the countries in which they manage. These ongoing efforts demonstrate that your company is serious about compliance. It is a function of the CCO to reinforce the vision and goals of the compliance function, where assessment and updating are critical to an ongoing best practices compliance program. If you follow this protocol, you will put a mechanism in place to demonstrate your company’s commitment to compliance by following through on intentions as set forth in your strategic plan. What should you do with this information? Put a strategic plan in place ready to implement your findings of continuous improvement, by using the following: Review the goals of the strategic plan. This requires that you arrange a time for the CCO and team to review the goals of the Strategic Plan, which the CCO should lead to determine how this goal in the Plan measures up to its implementation in your company. Design an execution plan. The KISS method (Keep it Simple Sir) is the best to move forward. This would suggest that for each compliance goal, there should be a simple and straight forward plan to ensure that the goal in question is being addressed. Put accountabilities in place. In any plan of execution, there must be accountabilities attached to them. This requires the CCO or other senior compliance department representatives to put these in place and then mandate a report requirement on how the task assigned is being achieved. Schedule the next review of the plan. There should be a regular review of the process. It allows any problems which may arise to be detected and corrected more quickly than if meetings are held at a less frequent basis. Continuous monitoring is a key step but it is only the first step. It is not simply that you tested your compliance program but that you did something with the information you obtained to improve your program. Three key takeaways: Innovation can come through a new way to think about and use data going forward. Have a plan in place to use the information garnered in your monitoring incorporated back into your compliance program. Always remember that Document Document Document is critical if the regulators come knocking. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 24 Jan 2023 00:00:00 -0000 Day 24 - Updates and feedback bonus 24 Thomas Fox Today we consider getting updates and feedback to improve you compliance program One of the critical elements found in the 2020 Update is the need to use the information you obtain, whether through risk assessment, root cause analysis, investigation, hotline report or any other manner to remediate the situation which allowed it to arise. Your company should establish a regular monitoring system to spot issues and address them. Effective monitoring means applying a consistent set of protocols, checks, and controls tailored to your company’s risks to detect and remediate compliance problems on an ongoing basis. To address this, your compliance team should be checking in routinely with local finance departments in your foreign offices to ask if they have noticed recent accounting irregularities. Regional directors should be required to keep tabs on potential improper activity in the countries in which they manage. These ongoing efforts demonstrate that your company is serious about compliance. It is a function of the CCO to reinforce the vision and goals of the compliance function, where assessment and updating are critical to an ongoing best practices compliance program. If you follow this protocol, you will put a mechanism in place to demonstrate your company’s commitment to compliance by following through on intentions as set forth in your strategic plan. What should you do with this information? Put a strategic plan in place ready to implement your findings of continuous improvement, by using the following: Review the goals of the strategic plan. This requires that you arrange a time for the CCO and team to review the goals of the Strategic Plan, which the CCO should lead to determine how this goal in the Plan measures up to its implementation in your company. Design an execution plan. The KISS method (Keep it Simple Sir) is the best to move forward. This would suggest that for each compliance goal, there should be a simple and straight forward plan to ensure that the goal in question is being addressed. Put accountabilities in place. In any plan of execution, there must be accountabilities attached to them. This requires the CCO or other senior compliance department representatives to put these in place and then mandate a report requirement on how the task assigned is being achieved. Schedule the next review of the plan. There should be a regular review of the process. It allows any problems which may arise to be detected and corrected more quickly than if meetings are held at a less frequent basis. Continuous monitoring is a key step but it is only the first step. It is not simply that you tested your compliance program but that you did something with the information you obtained to improve your program. Three key takeaways: Innovation can come through a new way to think about and use data going forward. Have a plan in place to use the information garnered in your monitoring incorporated back into your compliance program. Always remember that Document Document Document is critical if the regulators come knocking. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the critical elements found in the 2020 Update is the need to use the information you obtain, whether through risk assessment, root cause analysis, investigation, hotline report or any other manner to remediate the situation which allowed it to arise. Your company should establish a regular monitoring system to spot issues and address them. Effective monitoring means applying a consistent set of protocols, checks, and controls tailored to your company’s risks to detect and remediate compliance problems on an ongoing basis. To address this, your compliance team should be checking in routinely with local finance departments in your foreign offices to ask if they have noticed recent accounting irregularities. Regional directors should be required to keep tabs on potential improper activity in the countries in which they manage. These ongoing efforts demonstrate that your company is serious about compliance.

It is a function of the CCO to reinforce the vision and goals of the compliance function, where assessment and updating are critical to an ongoing best practices compliance program. If you follow this protocol, you will put a mechanism in place to demonstrate your company’s commitment to compliance by following through on intentions as set forth in your strategic plan. What should you do with this information? Put a strategic plan in place ready to implement your findings of continuous improvement, by using the following:

  • Review the goals of the strategic plan. This requires that you arrange a time for the CCO and team to review the goals of the Strategic Plan, which the CCO should lead to determine how this goal in the Plan measures up to its implementation in your company.
  • Design an execution plan. The KISS method (Keep it Simple Sir) is the best to move forward. This would suggest that for each compliance goal, there should be a simple and straight forward plan to ensure that the goal in question is being addressed.
  • Put accountabilities in place. In any plan of execution, there must be accountabilities attached to them. This requires the CCO or other senior compliance department representatives to put these in place and then mandate a report requirement on how the task assigned is being achieved.
  • Schedule the next review of the plan. There should be a regular review of the process. It allows any problems which may arise to be detected and corrected more quickly than if meetings are held at a less frequent basis.

Continuous monitoring is a key step but it is only the first step. It is not simply that you tested your compliance program but that you did something with the information you obtained to improve your program.

Three key takeaways:

  1. Innovation can come through a new way to think about and use data going forward.
  2. Have a plan in place to use the information garnered in your monitoring incorporated back into your compliance program.
  3. Always remember that Document Document Document is critical if the regulators come knocking.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 470 no Day 23 - Assessing Compliance Internal Controls What happens when controls are continually overridden? Does that necessarily mean that companies are engaging in activities which violate the FCPA or some other law such as Sarbanes-Oxley (SOX). Cristina Revelo said she would start out with some basic questions such as “How often would something be manually approved? How often are controls skipped, what are the level of approvals that you have and what is your documentation? What are the reasons, and are you documenting how often a certain department is requiring those overrides?” While it could indicate a company lacks a culture of compliance or everything is an emergency, it might mean something else. It might mean that your internal controls need to be evaluated and then recalibrated. In the FCPA Resource Guide and the Update to the Evaluation of Corporate Compliance Programs, the Department of Justice calls this continuous monitoring leading to continuous improvement. Joe Oringel, co-founder of Visual Risk IQ, calls it continuous controls monitoring. However, many compliance professionals, and particularly lawyers think once a control is in place, it’s set in stone, and it’s there forever. This derives from the unfortunate fact that once again many compliance professionals and most lawyers do not understand internal controls. Yet, internal controls, much like the rest of a compliance program can and should be continually monitored and continually improved based upon the information about such things as the number of overrides. Such a review can be evidence of a management problem or a culture of non-compliance at the organization. However, it could be that perhaps the controls need to be adjusted. Three Key Takeaways 1. An internal control override is not necessarily a bad thing if proper procedure is followed. 2. Internal controls are not set in stone. 3. The key is to have a process for monitoring the controls, taking input, literally from each line of defense. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 23 Jan 2023 00:00:00 -0000 Day 23 - Assessing Compliance Internal Controls bonus 23 Thomas Fox In this episode we consider how to assess your internal controls. What happens when controls are continually overridden? Does that necessarily mean that companies are engaging in activities which violate the FCPA or some other law such as Sarbanes-Oxley (SOX). Cristina Revelo said she would start out with some basic questions such as “How often would something be manually approved? How often are controls skipped, what are the level of approvals that you have and what is your documentation? What are the reasons, and are you documenting how often a certain department is requiring those overrides?” While it could indicate a company lacks a culture of compliance or everything is an emergency, it might mean something else. It might mean that your internal controls need to be evaluated and then recalibrated. In the FCPA Resource Guide and the Update to the Evaluation of Corporate Compliance Programs, the Department of Justice calls this continuous monitoring leading to continuous improvement. Joe Oringel, co-founder of Visual Risk IQ, calls it continuous controls monitoring. However, many compliance professionals, and particularly lawyers think once a control is in place, it’s set in stone, and it’s there forever. This derives from the unfortunate fact that once again many compliance professionals and most lawyers do not understand internal controls. Yet, internal controls, much like the rest of a compliance program can and should be continually monitored and continually improved based upon the information about such things as the number of overrides. Such a review can be evidence of a management problem or a culture of non-compliance at the organization. However, it could be that perhaps the controls need to be adjusted. Three Key Takeaways 1. An internal control override is not necessarily a bad thing if proper procedure is followed. 2. Internal controls are not set in stone. 3. The key is to have a process for monitoring the controls, taking input, literally from each line of defense. Learn more about your ad choices. Visit megaphone.fm/adchoices What happens when controls are continually overridden? Does that necessarily mean that companies are engaging in activities which violate the FCPA or some other law such as Sarbanes-Oxley (SOX). Cristina Revelo said she would start out with some basic questions such as “How often would something be manually approved? How often are controls skipped, what are the level of approvals that you have and what is your documentation? What are the reasons, and are you documenting how often a certain department is requiring those overrides?” While it could indicate a company lacks a culture of compliance or everything is an emergency, it might mean something else. It might mean that your internal controls need to be evaluated and then recalibrated. In the FCPA Resource Guide and the Update to the Evaluation of Corporate Compliance Programs, the Department of Justice calls this continuous monitoring leading to continuous improvement. Joe Oringel, co-founder of Visual Risk IQ, calls it continuous controls monitoring.

However, many compliance professionals, and particularly lawyers think once a control is in place, it’s set in stone, and it’s there forever. This derives from the unfortunate fact that once again many compliance professionals and most lawyers do not understand internal controls. Yet, internal controls, much like the rest of a compliance program can and should be continually monitored and continually improved based upon the information about such things as the number of overrides. Such a review can be evidence of a management problem or a culture of non-compliance at the organization. However, it could be that perhaps the controls need to be adjusted.

Three Key Takeaways

1. An internal control override is not necessarily a bad thing if proper procedure is followed.

2. Internal controls are not set in stone.

3. The key is to have a process for monitoring the controls, taking input, literally from each line of defense.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 485 no Day 22 - Internal Reporting and Triaging Claims The call, email, or tip comes into your office; an employee reports suspicious activity across the globe. That activity might well turn into an FCPA issue for your company. As the CCO, it will be up to you to begin the process, which will determine, in many instances, how the company will respond going forward. This is more than simply maintaining hotlines. Companies have to make real efforts to listen to employees. You need to have managers trained on handling employee concerns; they must be incentivized to take on this compliance responsibility, and you must devote communications resources to reinforcing the company’s culture and values to create an environment and expectation that managers will raise employee concerns. The Monaco Memo's emphasis on internally detecting such actions and self-reporting makes this more important. The reason is that a business’s employees are the company’s best source of information about what is going on in the company. It is certainly a best practice for a company to listen to its employees, particularly to help improve its processes and procedures. But more than listening to its employees, a company should provide a safe and secure route for employees to escalate their concerns. This is the underlying rationale behind an anonymous reporting system within any organization. Both the U.S. Sentencing Guidelines and the Organization of Economic Cooperation and Development (OECD) Good Practices list as one of their components an anonymous reporting mechanism by which employees can report compliance and ethics violations. Of course, the Dodd-Frank Whistleblower provisions also heed the implementation of a hotline. Given the number of ways that information about violations or potential violations can be communicated to government regulators, a robust triage system is an important way for a company to determine what resources to bring to bear on a compliance problem. Jonathan Marks has articulated a five-stage triage process that allows for an early assessment of any allegations and a manner to think through your investigative approach. Marks cautions you must have an experienced investigator or other seasoned professional making these determinations, if not a more well-rounded group or committee. Next, consider the types of evidence to review going forward. Finally, before selecting a triage solution, understand what tools are available, including forensic and human, to complete the investigation.  Three key takeaways: 1. The DOJ and SEC put special emphasis on internal reporting lines. 2. Test your hotline regularly to make sure it is working. 3. Every claim should be triaged before starting an investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 22 Jan 2023 14:52:26 -0000 Day 22 - Internal Reporting and Triaging Claims bonus 22 Thomas Fox Today, Internal Reporting and Triaging Claims. The call, email, or tip comes into your office; an employee reports suspicious activity across the globe. That activity might well turn into an FCPA issue for your company. As the CCO, it will be up to you to begin the process, which will determine, in many instances, how the company will respond going forward. This is more than simply maintaining hotlines. Companies have to make real efforts to listen to employees. You need to have managers trained on handling employee concerns; they must be incentivized to take on this compliance responsibility, and you must devote communications resources to reinforcing the company’s culture and values to create an environment and expectation that managers will raise employee concerns. The Monaco Memo's emphasis on internally detecting such actions and self-reporting makes this more important. The reason is that a business’s employees are the company’s best source of information about what is going on in the company. It is certainly a best practice for a company to listen to its employees, particularly to help improve its processes and procedures. But more than listening to its employees, a company should provide a safe and secure route for employees to escalate their concerns. This is the underlying rationale behind an anonymous reporting system within any organization. Both the U.S. Sentencing Guidelines and the Organization of Economic Cooperation and Development (OECD) Good Practices list as one of their components an anonymous reporting mechanism by which employees can report compliance and ethics violations. Of course, the Dodd-Frank Whistleblower provisions also heed the implementation of a hotline. Given the number of ways that information about violations or potential violations can be communicated to government regulators, a robust triage system is an important way for a company to determine what resources to bring to bear on a compliance problem. Jonathan Marks has articulated a five-stage triage process that allows for an early assessment of any allegations and a manner to think through your investigative approach. Marks cautions you must have an experienced investigator or other seasoned professional making these determinations, if not a more well-rounded group or committee. Next, consider the types of evidence to review going forward. Finally, before selecting a triage solution, understand what tools are available, including forensic and human, to complete the investigation.  Three key takeaways: 1. The DOJ and SEC put special emphasis on internal reporting lines. 2. Test your hotline regularly to make sure it is working. 3. Every claim should be triaged before starting an investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices The call, email, or tip comes into your office; an employee reports suspicious activity across the globe. That activity might well turn into an FCPA issue for your company. As the CCO, it will be up to you to begin the process, which will determine, in many instances, how the company will respond going forward. This is more than simply maintaining hotlines. Companies have to make real efforts to listen to employees. You need to have managers trained on handling employee concerns; they must be incentivized to take on this compliance responsibility, and you must devote communications resources to reinforcing the company’s culture and values to create an environment and expectation that managers will raise employee concerns. The Monaco Memo's emphasis on internally detecting such actions and self-reporting makes this more important.

The reason is that a business’s employees are the company’s best source of information about what is going on in the company. It is certainly a best practice for a company to listen to its employees, particularly to help improve its processes and procedures. But more than listening to its employees, a company should provide a safe and secure route for employees to escalate their concerns. This is the underlying rationale behind an anonymous reporting system within any organization. Both the U.S. Sentencing Guidelines and the Organization of Economic Cooperation and Development (OECD) Good Practices list as one of their components an anonymous reporting mechanism by which employees can report compliance and ethics violations. Of course, the Dodd-Frank Whistleblower provisions also heed the implementation of a hotline.

Given the number of ways that information about violations or potential violations can be communicated to government regulators, a robust triage system is an important way for a company to determine what resources to bring to bear on a compliance problem.

Jonathan Marks has articulated a five-stage triage process that allows for an early assessment of any allegations and a manner to think through your investigative approach. Marks cautions you must have an experienced investigator or other seasoned professional making these determinations, if not a more well-rounded group or committee. Next, consider the types of evidence to review going forward. Finally, before selecting a triage solution, understand what tools are available, including forensic and human, to complete the investigation.

 Three key takeaways:

1. The DOJ and SEC put special emphasis on internal reporting lines.

2. Test your hotline regularly to make sure it is working.

3. Every claim should be triaged before starting an investigation.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 571 no Day 21 - Continuous improvement in a compliance program The 2020 Update was very clear about the need for continuous improvement in any compliance program. It stated quite succinctly, “One hallmark of an effective compliance program is its capacity to improve and evolve. The actual implementation of controls in practice will necessarily reveal areas of risk and potential adjustment. A company’s business changes over time, as do the environments in which it operates, the nature of its customers, the laws that govern its actions, and the applicable industry standards. Accordingly, prosecutors should consider whether the company has engaged in meaningful efforts to review its compliance program and ensure that it is not stale.” Continuous improvement through continuous monitoring or other similar techniques will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is in many ways a continuously evolving organism, just as your company is. You need to build in a way to keep pace with both market and regulatory changes to have a truly effective anti-corruption compliance program.  Three key takeaways: Your compliance program should be continually evolving. Monitoring and auditing are different, yet complimentary tools for continuous improvement. Culture assessment and monitoring are also now required as well. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 21 Jan 2023 05:00:00 -0000 Day 21 - Continuous improvement in a compliance program bonus 21 Thomas Fox Why is continuous improvement critical? The 2020 Update was very clear about the need for continuous improvement in any compliance program. It stated quite succinctly, “One hallmark of an effective compliance program is its capacity to improve and evolve. The actual implementation of controls in practice will necessarily reveal areas of risk and potential adjustment. A company’s business changes over time, as do the environments in which it operates, the nature of its customers, the laws that govern its actions, and the applicable industry standards. Accordingly, prosecutors should consider whether the company has engaged in meaningful efforts to review its compliance program and ensure that it is not stale.” Continuous improvement through continuous monitoring or other similar techniques will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is in many ways a continuously evolving organism, just as your company is. You need to build in a way to keep pace with both market and regulatory changes to have a truly effective anti-corruption compliance program.  Three key takeaways: Your compliance program should be continually evolving. Monitoring and auditing are different, yet complimentary tools for continuous improvement. Culture assessment and monitoring are also now required as well. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2020 Update was very clear about the need for continuous improvement in any compliance program. It stated quite succinctly, “One hallmark of an effective compliance program is its capacity to improve and evolve. The actual implementation of controls in practice will necessarily reveal areas of risk and potential adjustment. A company’s business changes over time, as do the environments in which it operates, the nature of its customers, the laws that govern its actions, and the applicable industry standards. Accordingly, prosecutors should consider whether the company has engaged in meaningful efforts to review its compliance program and ensure that it is not stale.”

Continuous improvement through continuous monitoring or other similar techniques will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is in many ways a continuously evolving organism, just as your company is. You need to build in a way to keep pace with both market and regulatory changes to have a truly effective anti-corruption compliance program.

 Three key takeaways:

  1. Your compliance program should be continually evolving.
  2. Monitoring and auditing are different, yet complimentary tools for continuous improvement.
  3. Culture assessment and monitoring are also now required as well.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 519 no Day 20 - Responding to investigative findings There is nothing like an internal whistleblower report about a compliance violation, the finding of such an issue, or (even worse) a subpoena from the DOJ or notice letter from the SEC to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check.  You may find yourself in the position that you will have to have some very frank discussions about what to expect in terms of costs and time outlays. While much of these discussions will focus on the investigative process and those costs, these discussions will allow you to initiate the talk about remediation going forward and begin to explain why money must be budgeted for the remediation process. One of the things rarely considered is how the investigation triggers the remediation process and what the relationship is between the two. When issues arise warranting an investigation that would rise to the Board of Directors level and potentially require disclosure to the government, there is usually a flurry of attention and activity. Everyone wants to know what is going on. In an interview with Russ Berland, he noted, “for that short moment in time, you have everyone’s full attention.” Yet it can still be “a tricky place, because you get your fifteen minutes to really get everyone’s full attention, and from then on, you’re fighting with everybody else for their attention, like the normal things in business life.” Three key takeaways: A serious FCPA allegation gets the attention of the Board and senior management. Use this time to move the compliance program forward. Be aware of how your investigation can impact and even inform your remediation efforts. Be prepared to deal with the dreaded “where else” question. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 20 Jan 2023 05:00:00 -0000 Day 20 - Responding to investigative findings bonus 20 Thomas Fox Today, how should you respond to investigative findings. There is nothing like an internal whistleblower report about a compliance violation, the finding of such an issue, or (even worse) a subpoena from the DOJ or notice letter from the SEC to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check.  You may find yourself in the position that you will have to have some very frank discussions about what to expect in terms of costs and time outlays. While much of these discussions will focus on the investigative process and those costs, these discussions will allow you to initiate the talk about remediation going forward and begin to explain why money must be budgeted for the remediation process. One of the things rarely considered is how the investigation triggers the remediation process and what the relationship is between the two. When issues arise warranting an investigation that would rise to the Board of Directors level and potentially require disclosure to the government, there is usually a flurry of attention and activity. Everyone wants to know what is going on. In an interview with Russ Berland, he noted, “for that short moment in time, you have everyone’s full attention.” Yet it can still be “a tricky place, because you get your fifteen minutes to really get everyone’s full attention, and from then on, you’re fighting with everybody else for their attention, like the normal things in business life.” Three key takeaways: A serious FCPA allegation gets the attention of the Board and senior management. Use this time to move the compliance program forward. Be aware of how your investigation can impact and even inform your remediation efforts. Be prepared to deal with the dreaded “where else” question. Learn more about your ad choices. Visit megaphone.fm/adchoices There is nothing like an internal whistleblower report about a compliance violation, the finding of such an issue, or (even worse) a subpoena from the DOJ or notice letter from the SEC to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check.

 You may find yourself in the position that you will have to have some very frank discussions about what to expect in terms of costs and time outlays. While much of these discussions will focus on the investigative process and those costs, these discussions will allow you to initiate the talk about remediation going forward and begin to explain why money must be budgeted for the remediation process.

One of the things rarely considered is how the investigation triggers the remediation process and what the relationship is between the two. When issues arise warranting an investigation that would rise to the Board of Directors level and potentially require disclosure to the government, there is usually a flurry of attention and activity. Everyone wants to know what is going on. In an interview with Russ Berland, he noted, “for that short moment in time, you have everyone’s full attention.” Yet it can still be “a tricky place, because you get your fifteen minutes to really get everyone’s full attention, and from then on, you’re fighting with everybody else for their attention, like the normal things in business life.”

Three key takeaways:

  1. A serious FCPA allegation gets the attention of the Board and senior management. Use this time to move the compliance program forward.
  2. Be aware of how your investigation can impact and even inform your remediation efforts.
  3. Be prepared to deal with the dreaded “where else” question.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 524 no Day 19 - Your investigation protocol After the internal report comes in and you have properly triaged the matter, you need to scope out and investigate it, promptly, thoroughly and with competent personnel. In the 2020 Update, provided these series of questions about your internal investigations: Properly Scoped Investigations by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation? How does the company ensure that investigations are properly scoped? What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct an investigation, and who makes that determination?  Investigation Response – Does the company apply timing metrics to ensure responsiveness? Does the company have a process for monitoring the outcome of investigations and ensuring accountability for the response to any findings or recommendations?  Resources and Tracking of Results – Are the reporting and investigating mechanisms sufficiently funded? How has the company collected, tracked, analyzed, and used information from its reporting mechanisms? Does the company periodically analyze the reports or investigation findings for patterns of misconduct or other red flags for compliance weaknesses? Does the company periodically test the effectiveness of the hotline, for example by tracking a report from start to finish? In a presentation Jay Martin, retired Chief Compliance Officer at Baker Hughes and Jacki Trevino, Senior Director, Advisory Services Group at SAI Global Limited, discussed the specifics of an investigation protocol. It consisted of 1) opening and categorizing the case; 2) planning the investigation; 3) executing the investigation plan; 4) determining appropriate follow-up; and 5) closing the case. If you follow this basic protocol, you should be able to work through most investigations, in a clear, concise and cost-effective manner. Furthermore, you should have a report at the end of the day which should stand up to later scrutiny if a regulator comes looking. Finally, you will be able to “Document, Document, and Document”, not only the steps you took but why and the outcome obtained. Three key takeaways: A written protocol, created before an investigation, is a key starting point. Create specific steps to follow so there will be full transparency and documentation going forward. Consistency in approach is critical. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 19 Jan 2023 05:00:00 -0000 Day 19 - Your investigation protocol bonus 19 Thomas Fox What is your investigative protocol? After the internal report comes in and you have properly triaged the matter, you need to scope out and investigate it, promptly, thoroughly and with competent personnel. In the 2020 Update, provided these series of questions about your internal investigations: Properly Scoped Investigations by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation? How does the company ensure that investigations are properly scoped? What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct an investigation, and who makes that determination?  Investigation Response – Does the company apply timing metrics to ensure responsiveness? Does the company have a process for monitoring the outcome of investigations and ensuring accountability for the response to any findings or recommendations?  Resources and Tracking of Results – Are the reporting and investigating mechanisms sufficiently funded? How has the company collected, tracked, analyzed, and used information from its reporting mechanisms? Does the company periodically analyze the reports or investigation findings for patterns of misconduct or other red flags for compliance weaknesses? Does the company periodically test the effectiveness of the hotline, for example by tracking a report from start to finish? In a presentation Jay Martin, retired Chief Compliance Officer at Baker Hughes and Jacki Trevino, Senior Director, Advisory Services Group at SAI Global Limited, discussed the specifics of an investigation protocol. It consisted of 1) opening and categorizing the case; 2) planning the investigation; 3) executing the investigation plan; 4) determining appropriate follow-up; and 5) closing the case. If you follow this basic protocol, you should be able to work through most investigations, in a clear, concise and cost-effective manner. Furthermore, you should have a report at the end of the day which should stand up to later scrutiny if a regulator comes looking. Finally, you will be able to “Document, Document, and Document”, not only the steps you took but why and the outcome obtained. Three key takeaways: A written protocol, created before an investigation, is a key starting point. Create specific steps to follow so there will be full transparency and documentation going forward. Consistency in approach is critical. Learn more about your ad choices. Visit megaphone.fm/adchoices After the internal report comes in and you have properly triaged the matter, you need to scope out and investigate it, promptly, thoroughly and with competent personnel. In the 2020 Update, provided these series of questions about your internal investigations:

Properly Scoped Investigations by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation? How does the company ensure that investigations are properly scoped? What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct an investigation, and who makes that determination?

 Investigation Response – Does the company apply timing metrics to ensure responsiveness? Does the company have a process for monitoring the outcome of investigations and ensuring accountability for the response to any findings or recommendations?

 Resources and Tracking of Results – Are the reporting and investigating mechanisms sufficiently funded? How has the company collected, tracked, analyzed, and used information from its reporting mechanisms? Does the company periodically analyze the reports or investigation findings for patterns of misconduct or other red flags for compliance weaknesses? Does the company periodically test the effectiveness of the hotline, for example by tracking a report from start to finish?

In a presentation Jay Martin, retired Chief Compliance Officer at Baker Hughes and Jacki Trevino, Senior Director, Advisory Services Group at SAI Global Limited, discussed the specifics of an investigation protocol. It consisted of 1) opening and categorizing the case; 2) planning the investigation; 3) executing the investigation plan; 4) determining appropriate follow-up; and 5) closing the case. If you follow this basic protocol, you should be able to work through most investigations, in a clear, concise and cost-effective manner. Furthermore, you should have a report at the end of the day which should stand up to later scrutiny if a regulator comes looking. Finally, you will be able to “Document, Document, and Document”, not only the steps you took but why and the outcome obtained.

Three key takeaways:

  1. A written protocol, created before an investigation, is a key starting point.
  2. Create specific steps to follow so there will be full transparency and documentation going forward.
  3. Consistency in approach is critical.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 459 no Day 18 - Levels of due diligence Due diligence is generally recognized in three levels: Level I, Level II and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward. The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward. There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions into your program. The Level I, II and III trichotomy appears to have the greatest favor and one that you should be able to implement in a straightforward manner. But the key is that you must assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence. Three key takeaways: A Level I due diligence should only be used where there is a low risk of corruption. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared. Level III due diligence is deep dive, boots on the ground investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 18 Jan 2023 05:00:00 -0000 Day 18 - Levels of due diligence bonus 18 Thomas Fox In this episode, we look at levels of due diligence. Due diligence is generally recognized in three levels: Level I, Level II and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward. The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward. There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions into your program. The Level I, II and III trichotomy appears to have the greatest favor and one that you should be able to implement in a straightforward manner. But the key is that you must assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence. Three key takeaways: A Level I due diligence should only be used where there is a low risk of corruption. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared. Level III due diligence is deep dive, boots on the ground investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Due diligence is generally recognized in three levels: Level I, Level II and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward.

The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward.

There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions into your program. The Level I, II and III trichotomy appears to have the greatest favor and one that you should be able to implement in a straightforward manner. But the key is that you must assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence.

Three key takeaways:

  1. A Level I due diligence should only be used where there is a low risk of corruption.
  2. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared.
  3. Level III due diligence is deep dive, boots on the ground investigation.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 514 no Day 17- Managing your third parties The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the life cycle management of third parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation and compliance terms and conditions in contracts. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also the one where the rubber meets the road of operationalizingcompliance. It is also an area the DOJ specifically articulated in the 2020 Update that companies need to consider. Managing your third-parties is where the rubber meets the road in your overall third-party risk manage program. You must execute on this task. Even if you successfully navigate the first four steps in your third-party risk management program, those are in reality the easy steps. Managing the relationship is where the real work begins. Three key takeaways: Have a strategic approach to third-party risk management. Rank third parties based upon a variety of factors including compliance and business performance, length of relationship, benchmarking metrics and KPIs for ongoing monitoring and auditing. Managing the relationship is where the real work begins. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 17 Jan 2023 16:46:00 -0000 Day 17- Managing your third parties bonus 17 Thomas Fox Today, we consider managing your 3rd parties. The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the life cycle management of third parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation and compliance terms and conditions in contracts. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also the one where the rubber meets the road of operationalizingcompliance. It is also an area the DOJ specifically articulated in the 2020 Update that companies need to consider. Managing your third-parties is where the rubber meets the road in your overall third-party risk manage program. You must execute on this task. Even if you successfully navigate the first four steps in your third-party risk management program, those are in reality the easy steps. Managing the relationship is where the real work begins. Three key takeaways: Have a strategic approach to third-party risk management. Rank third parties based upon a variety of factors including compliance and business performance, length of relationship, benchmarking metrics and KPIs for ongoing monitoring and auditing. Managing the relationship is where the real work begins. Learn more about your ad choices. Visit megaphone.fm/adchoices The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the life cycle management of third parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation and compliance terms and conditions in contracts. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also the one where the rubber meets the road of operationalizingcompliance. It is also an area the DOJ specifically articulated in the 2020 Update that companies need to consider.

Managing your third-parties is where the rubber meets the road in your overall third-party risk manage program. You must execute on this task. Even if you successfully navigate the first four steps in your third-party risk management program, those are in reality the easy steps. Managing the relationship is where the real work begins.

Three key takeaways:

  1. Have a strategic approach to third-party risk management.
  2. Rank third parties based upon a variety of factors including compliance and business performance, length of relationship, benchmarking metrics and KPIs for ongoing monitoring and auditing.
  3. Managing the relationship is where the real work begins.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 512 no Day 16 - The third-party risk management process As every compliance practitioner is well aware, third parties still present the highest risk under the FCPA even in 2023. The 2020 Update devotes an entire prong to third-party management. It begins with the following:  Prosecutors should also assess whether the company knows the business rationale for needing the third party in the transaction, and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials. For example, a prosecutor should analyze whether the company has ensured that contract terms with third parties specifically describe the services to be performed, that the third party is actually performing the work, and that its compensation is commensurate with the work being provided in that industry and geographical region.   Prosecutors should further assess whether the company engaged in ongoing monitoring of the third-party relationships, be it through updated due diligence, training, audits, and/or annual compliance certifications by the third party. This clearly specifies that the DOJ expects an integrated approach that is operationalized throughout the company. This means you must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party risk management, which will fulfill the DOJ requirements as laid out in the 2020 FCPA Resource Guide and in the Hallmarks of an Effective Compliance Program. They five steps in the lifecycle of third-party management are: Business Justification by the Business Sponsor; Questionnaire to Third-party; Due Diligence on Third-party, including triage of results; Compliance Terms and Conditions, including payment terms; and Management and Oversight of Third Parties After Contract Signing. Three key takeaways: Use the full 5-step process for third party management. Make sure you have business development involvement and buy-in. Operationalize all steps going forward by including business unit representatives. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 16 Jan 2023 05:00:00 -0000 Day 16 - The third-party risk management process full 16 Thomas Fox Today we consider your 3rd party risk management process. As every compliance practitioner is well aware, third parties still present the highest risk under the FCPA even in 2023. The 2020 Update devotes an entire prong to third-party management. It begins with the following:  Prosecutors should also assess whether the company knows the business rationale for needing the third party in the transaction, and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials. For example, a prosecutor should analyze whether the company has ensured that contract terms with third parties specifically describe the services to be performed, that the third party is actually performing the work, and that its compensation is commensurate with the work being provided in that industry and geographical region.   Prosecutors should further assess whether the company engaged in ongoing monitoring of the third-party relationships, be it through updated due diligence, training, audits, and/or annual compliance certifications by the third party. This clearly specifies that the DOJ expects an integrated approach that is operationalized throughout the company. This means you must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party risk management, which will fulfill the DOJ requirements as laid out in the 2020 FCPA Resource Guide and in the Hallmarks of an Effective Compliance Program. They five steps in the lifecycle of third-party management are: Business Justification by the Business Sponsor; Questionnaire to Third-party; Due Diligence on Third-party, including triage of results; Compliance Terms and Conditions, including payment terms; and Management and Oversight of Third Parties After Contract Signing. Three key takeaways: Use the full 5-step process for third party management. Make sure you have business development involvement and buy-in. Operationalize all steps going forward by including business unit representatives. Learn more about your ad choices. Visit megaphone.fm/adchoices As every compliance practitioner is well aware, third parties still present the highest risk under the FCPA even in 2023. The 2020 Update devotes an entire prong to third-party management. It begins with the following:

 Prosecutors should also assess whether the company knows the business rationale for needing the third party in the transaction, and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials. For example, a prosecutor should analyze whether the company has ensured that contract terms with third parties specifically describe the services to be performed, that the third party is actually performing the work, and that its compensation is commensurate with the work being provided in that industry and geographical region.   Prosecutors should further assess whether the company engaged in ongoing monitoring of the third-party relationships, be it through updated due diligence, training, audits, and/or annual compliance certifications by the third party.

This clearly specifies that the DOJ expects an integrated approach that is operationalized throughout the company. This means you must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party risk management, which will fulfill the DOJ requirements as laid out in the 2020 FCPA Resource Guide and in the Hallmarks of an Effective Compliance Program. They five steps in the lifecycle of third-party management are:

  1. Business Justification by the Business Sponsor;
  2. Questionnaire to Third-party;
  3. Due Diligence on Third-party, including triage of results;
  4. Compliance Terms and Conditions, including payment terms; and
  5. Management and Oversight of Third Parties After Contract Signing.

Three key takeaways:

  1. Use the full 5-step process for third party management.
  2. Make sure you have business development involvement and buy-in.
  3. Operationalize all steps going forward by including business unit representatives.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 524 no Day 15 - How do you evaluate a risk assessment? After you complete your risk assessment, you must then translate it into a risk profile. If your estimate of where your bribery risk is greatest is wrong, it will be an effort to address it. As Ben Locwin explained in his  BioProcess International article, entitled “Quality Risk Assessment and Management Strategies for Biopharmaceutical Companies”: Once we have assessed risks and determined a process that includes options to resolve and manage those risks whenever appropriate, then we can decide the level of resources with which to prioritize them. There always will be latent risks: those that we understand are there but that we cannot chase forever. But we need to make sure we have classified them correctly. With a good understanding of each of these, we are in a better position to speak about the quality of our businesses. William C. Athanas, in his Industry Week article, “Rethinking FCPA Compliance Strategies in a New Era of Enforcement”, posited that companies assume that FCPA violations follow a bell curve in which most employees are responsible for most of the violations. However, Athanas believed that the distribution pattern more closely follows a hockey-stick distribution, where virtually all violations are committed by just a few people. Athanas concluded by noting that is this limited group of employees, or what he terms the “shaft of the hockey-stick,” to which a company should devote the majority of its compliance resources. With a proper risk assessment, a company can then focus its compliance efforts such as intensive training sessions or detailed analysis of key financial transactions involving those employees with the greatest means and motive to commit a violation. The most significant risks with the greatest likelihood of occurring are deemed to be the priority risks. These become the focus of your most significant risk management efforts, couple with audit and monitoring going forward. A variety of tools can be used to continuously monitoring risk going forward. Consider providing employees with substantive training to guard against the most significant risks coming to pass and to keep the key messages fresh and top of mind. It is important to create a risk control summary that succinctly documents the nature of the risk and the actions taken to mitigate it. Finally, let this risk assessment and evaluation inform your compliance program, rather than letting the compliance program inform the risk assessment. Three key takeaways: Even after you complete your risk assessment, you must evaluate those risks for your company. The DOJ and SEC are looking for a well-reasoned approach on how you evaluate your risk. Create a risk matrix and rank your risks; then remediate and monitor as appropriate. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 15 Jan 2023 05:00:00 -0000 How do you evaluate a risk assessment? bonus 15 Thomas Fox In this episode, we consider how to evaluate a risk assessment. After you complete your risk assessment, you must then translate it into a risk profile. If your estimate of where your bribery risk is greatest is wrong, it will be an effort to address it. As Ben Locwin explained in his  BioProcess International article, entitled “Quality Risk Assessment and Management Strategies for Biopharmaceutical Companies”: Once we have assessed risks and determined a process that includes options to resolve and manage those risks whenever appropriate, then we can decide the level of resources with which to prioritize them. There always will be latent risks: those that we understand are there but that we cannot chase forever. But we need to make sure we have classified them correctly. With a good understanding of each of these, we are in a better position to speak about the quality of our businesses. William C. Athanas, in his Industry Week article, “Rethinking FCPA Compliance Strategies in a New Era of Enforcement”, posited that companies assume that FCPA violations follow a bell curve in which most employees are responsible for most of the violations. However, Athanas believed that the distribution pattern more closely follows a hockey-stick distribution, where virtually all violations are committed by just a few people. Athanas concluded by noting that is this limited group of employees, or what he terms the “shaft of the hockey-stick,” to which a company should devote the majority of its compliance resources. With a proper risk assessment, a company can then focus its compliance efforts such as intensive training sessions or detailed analysis of key financial transactions involving those employees with the greatest means and motive to commit a violation. The most significant risks with the greatest likelihood of occurring are deemed to be the priority risks. These become the focus of your most significant risk management efforts, couple with audit and monitoring going forward. A variety of tools can be used to continuously monitoring risk going forward. Consider providing employees with substantive training to guard against the most significant risks coming to pass and to keep the key messages fresh and top of mind. It is important to create a risk control summary that succinctly documents the nature of the risk and the actions taken to mitigate it. Finally, let this risk assessment and evaluation inform your compliance program, rather than letting the compliance program inform the risk assessment. Three key takeaways: Even after you complete your risk assessment, you must evaluate those risks for your company. The DOJ and SEC are looking for a well-reasoned approach on how you evaluate your risk. Create a risk matrix and rank your risks; then remediate and monitor as appropriate. Learn more about your ad choices. Visit megaphone.fm/adchoices After you complete your risk assessment, you must then translate it into a risk profile. If your estimate of where your bribery risk is greatest is wrong, it will be an effort to address it. As Ben Locwin explained in his  BioProcess International article, entitled “Quality Risk Assessment and Management Strategies for Biopharmaceutical Companies”:

Once we have assessed risks and determined a process that includes options to resolve and manage those risks whenever appropriate, then we can decide the level of resources with which to prioritize them. There always will be latent risks: those that we understand are there but that we cannot chase forever. But we need to make sure we have classified them correctly. With a good understanding of each of these, we are in a better position to speak about the quality of our businesses.

William C. Athanas, in his Industry Week article, “Rethinking FCPA Compliance Strategies in a New Era of Enforcement”, posited that companies assume that FCPA violations follow a bell curve in which most employees are responsible for most of the violations. However, Athanas believed that the distribution pattern more closely follows a hockey-stick distribution, where virtually all violations are committed by just a few people. Athanas concluded by noting that is this limited group of employees, or what he terms the “shaft of the hockey-stick,” to which a company should devote the majority of its compliance resources. With a proper risk assessment, a company can then focus its compliance efforts such as intensive training sessions or detailed analysis of key financial transactions involving those employees with the greatest means and motive to commit a violation.

The most significant risks with the greatest likelihood of occurring are deemed to be the priority risks. These become the focus of your most significant risk management efforts, couple with audit and monitoring going forward. A variety of tools can be used to continuously monitoring risk going forward. Consider providing employees with substantive training to guard against the most significant risks coming to pass and to keep the key messages fresh and top of mind. It is important to create a risk control summary that succinctly documents the nature of the risk and the actions taken to mitigate it. Finally, let this risk assessment and evaluation inform your compliance program, rather than letting the compliance program inform the risk assessment.

Three key takeaways:

  1. Even after you complete your risk assessment, you must evaluate those risks for your company.
  2. The DOJ and SEC are looking for a well-reasoned approach on how you evaluate your risk.
  3. Create a risk matrix and rank your risks; then remediate and monitor as appropriate.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 511 no Day 14 - Risk Assessments One cannot really say enough about risk assessments in the context of anti-corruption programs. This is because every corporate compliance program should be based upon a risk assessment, to understand your organization’s business from the commercial perspective, how your organization has identified, assessed, and defined its risk profile and, finally, the degree to which the program devotes appropriate scrutiny and resources to this range of risks. Yet the 2020 Update added a new emphasis that Risk Assessments should not be done not less than annually but in reality it should be done each time your risk change. Over the past couple of years, every company's risks changed in going from Work From Home to Return to the Office to Hybrid Work environments. Have you assessed each of these new paradigms for risks from the compliance perspective? As far back as 1999, in the Metcalf & Eddy enforcement action, the DOJ has said that risk assessments that measure the likelihood and severity of possible FCPA violations should direct your resources to manage these risks. The 2012 FCPA Guidance stated it succinctly when it said, “Assessment of risk is fundamental to developing a strong compliance program and is another factor DOJ and SEC evaluate when assessing a company’s compliance program.” There are a number of ways you can slice and dice your basic inquiry. As with almost all FCPA compliance, it is important that your protocol be well thought out. If you use one, some or all of the above as your basic inquiries for your risk analysis, it should be acceptable for your starting point.  Three key takeaways: Since at least 1999, the DOJ has pointed to the risk assessment as the start of an effective compliance program. The DOJ will now consider both your risk assessment methodology for identifying risks and gathered evidence. You should base your compliance program on your risk assessment. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 14 Jan 2023 05:00:00 -0000 Day 14 - Risk Assessments full 14 Thomas Fox One cannot really say enough about risk assessments in the context of anti-corruption programs. This is because every corporate compliance program should be based upon a risk assessment, to understand your organization’s business from the commercial perspective, how your organization has identified, assessed, and defined its risk profile and, finally, the degree to which the program devotes appropriate scrutiny and resources to this range of risks. Yet the 2020 Update added a new emphasis that Risk Assessments should not be done not less than annually but in reality it should be done each time your risk change. Over the past couple of years, every company's risks changed in going from Work From Home to Return to the Office to Hybrid Work environments. Have you assessed each of these new paradigms for risks from the compliance perspective? As far back as 1999, in the Metcalf & Eddy enforcement action, the DOJ has said that risk assessments that measure the likelihood and severity of possible FCPA violations should direct your resources to manage these risks. The 2012 FCPA Guidance stated it succinctly when it said, “Assessment of risk is fundamental to developing a strong compliance program and is another factor DOJ and SEC evaluate when assessing a company’s compliance program.” There are a number of ways you can slice and dice your basic inquiry. As with almost all FCPA compliance, it is important that your protocol be well thought out. If you use one, some or all of the above as your basic inquiries for your risk analysis, it should be acceptable for your starting point.  Three key takeaways: Since at least 1999, the DOJ has pointed to the risk assessment as the start of an effective compliance program. The DOJ will now consider both your risk assessment methodology for identifying risks and gathered evidence. You should base your compliance program on your risk assessment. Learn more about your ad choices. Visit megaphone.fm/adchoices One cannot really say enough about risk assessments in the context of anti-corruption programs. This is because every corporate compliance program should be based upon a risk assessment, to understand your organization’s business from the commercial perspective, how your organization has identified, assessed, and defined its risk profile and, finally, the degree to which the program devotes appropriate scrutiny and resources to this range of risks. Yet the 2020 Update added a new emphasis that Risk Assessments should not be done not less than annually but in reality it should be done each time your risk change. Over the past couple of years, every company's risks changed in going from Work From Home to Return to the Office to Hybrid Work environments. Have you assessed each of these new paradigms for risks from the compliance perspective?

As far back as 1999, in the Metcalf & Eddy enforcement action, the DOJ has said that risk assessments that measure the likelihood and severity of possible FCPA violations should direct your resources to manage these risks. The 2012 FCPA Guidance stated it succinctly when it said, “Assessment of risk is fundamental to developing a strong compliance program and is another factor DOJ and SEC evaluate when assessing a company’s compliance program.”

There are a number of ways you can slice and dice your basic inquiry. As with almost all FCPA compliance, it is important that your protocol be well thought out. If you use one, some or all of the above as your basic inquiries for your risk analysis, it should be acceptable for your starting point. 

Three key takeaways:

  1. Since at least 1999, the DOJ has pointed to the risk assessment as the start of an effective compliance program.
  2. The DOJ will now consider both your risk assessment methodology for identifying risks and gathered evidence.
  3. You should base your compliance program on your risk assessment.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 591 no Day 13: Podcasting for Compliance Training and Communication If there is one truism from the practice of law which translates to the practice of compliance it is that you are only limited by your own imagination. This holds true in the 360-degree realm of communication in compliance, as communications obviously comes in many forms. Many compliance practitioners will well remember the 2012 Morgan Stanley declination. In this first declination made public, the Department of Justice (DOJ) recognized Morgan Stanley for emailing out 35 compliance reminders to Garth Peterson over seven years. Think about the power of 360-degrees of communications in the context of compliance reminders. Now imagine the power of short ethics and compliance video training clips going out over the same period of time and the effect it would have both on your employees and the regulators. 1.Podcast Storytelling-Why not tell the story of compliance through a podcast? I call it podcast storytelling and it can be a powerful tool. Each podcast series is 5-part series and constitutes one story arc. The podcasts are about 10-15 minutes in length. The podcast storytellingseries can be a variety of interviews led by a noted podcast host such as the Voice of Compliance, yourself as the Chief Compliance Officer (CCO) or by anyone from your organization. It can be an interview with one or more people, or it can be a solo podcast.  2. Compliance Department Branded Podcasts-Want another option? How about a fully produced branded podcast series for your internal compliance function. It could be two 25–30-minute episodes per month, with the guest selected by your compliance team. This format allows your corporate compliance function to tell the story of its greatest asset, its people, through interviews. Cannot get out of the country to travel? Still working remotely? 3. Compliance News of the Day-Want to make some short and snappy compliance communications? How about ‘Compliance News of the Day’? Have a daily curated news show of 3-4 compliance stories with a short summary of each story and how they relates to a compliance perspective to your organization. Make it fun so your employees want to check in daily. When the DOJ comes knocking and asks how often you send out compliance communications, you can point to your Compliance News of the Day as a great starting point.  Since you are only limited by your imagination in compliance, why not use some of that to be creative in your compliance training and communications.   Three key takeaways: 1. Using podcast storytelling to tell longer, more involved stories about compliance. 2. You can use compliance department branded podcasts to have ongoing communications about compliance. 3. A Daily Compliance News show will drive engagement. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 13 Jan 2023 05:00:00 -0000 Day 13: Podcasting for Compliance Training and Communication full 13 Thomas Fox In this episode, we look at how podcasting can facilitate your compliance training and communication. If there is one truism from the practice of law which translates to the practice of compliance it is that you are only limited by your own imagination. This holds true in the 360-degree realm of communication in compliance, as communications obviously comes in many forms. Many compliance practitioners will well remember the 2012 Morgan Stanley declination. In this first declination made public, the Department of Justice (DOJ) recognized Morgan Stanley for emailing out 35 compliance reminders to Garth Peterson over seven years. Think about the power of 360-degrees of communications in the context of compliance reminders. Now imagine the power of short ethics and compliance video training clips going out over the same period of time and the effect it would have both on your employees and the regulators. 1.Podcast Storytelling-Why not tell the story of compliance through a podcast? I call it podcast storytelling and it can be a powerful tool. Each podcast series is 5-part series and constitutes one story arc. The podcasts are about 10-15 minutes in length. The podcast storytellingseries can be a variety of interviews led by a noted podcast host such as the Voice of Compliance, yourself as the Chief Compliance Officer (CCO) or by anyone from your organization. It can be an interview with one or more people, or it can be a solo podcast.  2. Compliance Department Branded Podcasts-Want another option? How about a fully produced branded podcast series for your internal compliance function. It could be two 25–30-minute episodes per month, with the guest selected by your compliance team. This format allows your corporate compliance function to tell the story of its greatest asset, its people, through interviews. Cannot get out of the country to travel? Still working remotely? 3. Compliance News of the Day-Want to make some short and snappy compliance communications? How about ‘Compliance News of the Day’? Have a daily curated news show of 3-4 compliance stories with a short summary of each story and how they relates to a compliance perspective to your organization. Make it fun so your employees want to check in daily. When the DOJ comes knocking and asks how often you send out compliance communications, you can point to your Compliance News of the Day as a great starting point.  Since you are only limited by your imagination in compliance, why not use some of that to be creative in your compliance training and communications.   Three key takeaways: 1. Using podcast storytelling to tell longer, more involved stories about compliance. 2. You can use compliance department branded podcasts to have ongoing communications about compliance. 3. A Daily Compliance News show will drive engagement. Learn more about your ad choices. Visit megaphone.fm/adchoices If there is one truism from the practice of law which translates to the practice of compliance it is that you are only limited by your own imagination. This holds true in the 360-degree realm of communication in compliance, as communications obviously comes in many forms. Many compliance practitioners will well remember the 2012 Morgan Stanley declination. In this first declination made public, the Department of Justice (DOJ) recognized Morgan Stanley for emailing out 35 compliance reminders to Garth Peterson over seven years. Think about the power of 360-degrees of communications in the context of compliance reminders. Now imagine the power of short ethics and compliance video training clips going out over the same period of time and the effect it would have both on your employees and the regulators.

1.Podcast Storytelling-Why not tell the story of compliance through a podcast? I call it podcast storytelling and it can be a powerful tool. Each podcast series is 5-part series and constitutes one story arc. The podcasts are about 10-15 minutes in length. The podcast storytellingseries can be a variety of interviews led by a noted podcast host such as the Voice of Compliance, yourself as the Chief Compliance Officer (CCO) or by anyone from your organization. It can be an interview with one or more people, or it can be a solo podcast. 

2. Compliance Department Branded Podcasts-Want another option? How about a fully produced branded podcast series for your internal compliance function. It could be two 25–30-minute episodes per month, with the guest selected by your compliance team. This format allows your corporate compliance function to tell the story of its greatest asset, its people, through interviews. Cannot get out of the country to travel? Still working remotely?

3. Compliance News of the Day-Want to make some short and snappy compliance communications? How about ‘Compliance News of the Day’? Have a daily curated news show of 3-4 compliance stories with a short summary of each story and how they relates to a compliance perspective to your organization. Make it fun so your employees want to check in daily. When the DOJ comes knocking and asks how often you send out compliance communications, you can point to your Compliance News of the Day as a great starting point. 

Since you are only limited by your imagination in compliance, why not use some of that to be creative in your compliance training and communications. 

 Three key takeaways:

1. Using podcast storytelling to tell longer, more involved stories about compliance.

2. You can use compliance department branded podcasts to have ongoing communications about compliance.

3. A Daily Compliance News show will drive engagement.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 569 Day 12 - Financial Incentives for Compliance One of the areas that many companies have not paid as much attention to in their compliance programs is compensation and incentives. However, the DOJ and SEC have long made clear that they view monetary structure for compensation, rewarding those employees who do business in compliance with their employer’s compliance program, as one of the ways to reinforce the compliance program and the message of compliance.  This was made clear once again in the Monaco Memo which stated, “Corporations can help to deter criminal activity if they reward compliant behavior and penalize individuals who engage in misconduct. Compensation systems that clearly and effectively impose financial penalties for misconduct can incentivize compliant conduct, deter risky behavior, and instill a corporate culture in which employees follow the law and avoid legal “gray areas.””  Moreover, the Monaco Memo tied compensation to a company’s culture of compliance. It stated, “Similarly, corporations can promote an ethical corporate culture by rewarding those executives and employees who promote compliance within the organization. Prosecutors should therefore also consider whether a corporation’s compensation systems provide affirmative incentives for compliance-promoting behavior. Affirmative incentives include, for example, the use of compliance metrics and benchmarks in compensation calculations and the use of performance reviews that measure and reward compliance-promoting behavior, both as to the employee and any subordinates whom they supervise. When effectively implemented, such provisions incentivize executives and employees to engage in and promote compliant behavior and emphasize the corporation's commitment to its compliance programs and its culture.”  Yet compensation incentives have long been seen as a key element of any best practices compliance program. As far back as 2004, then SEC Director of Enforcement Stephen M. Cutler noted that integrity, ethics and compliance needed to be part of promotion, compensation and evaluation processes: “At the end of the day, the most effective way to communicate that “doing the right thing” is a priority, is to reward it.” The 2020 FCPA Guidance, 2nd edition, stated the “DOJ and SEC recognize that positive incentives can also drive compliant behavior. These incentives can take many forms such as personnel evaluations and promotions, rewards for improving and developing a company’s compliance program, and rewards for ethics and compliance leadership.” The Monaco Memo takes it a step further by asking more broadly has your company, “incentivized employee behavior as part of its efforts to create a culture of ethics and compliance within its organization.” Three key takeaways: The DOJ and SEC have long advocated compensation as a way to motivate employees into ethical and compliant behaviors Keep the compliance aspects of your compensation structure simple and easy for your employees to understand Have full transparency in the framework of your compensation structure Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 12 Jan 2023 05:00:00 -0000 Day 12 - Financial Incentives for Compliance full 12 Thomas Fox In this episode, we consider financial incentives in your compliance program. One of the areas that many companies have not paid as much attention to in their compliance programs is compensation and incentives. However, the DOJ and SEC have long made clear that they view monetary structure for compensation, rewarding those employees who do business in compliance with their employer’s compliance program, as one of the ways to reinforce the compliance program and the message of compliance.  This was made clear once again in the Monaco Memo which stated, “Corporations can help to deter criminal activity if they reward compliant behavior and penalize individuals who engage in misconduct. Compensation systems that clearly and effectively impose financial penalties for misconduct can incentivize compliant conduct, deter risky behavior, and instill a corporate culture in which employees follow the law and avoid legal “gray areas.””  Moreover, the Monaco Memo tied compensation to a company’s culture of compliance. It stated, “Similarly, corporations can promote an ethical corporate culture by rewarding those executives and employees who promote compliance within the organization. Prosecutors should therefore also consider whether a corporation’s compensation systems provide affirmative incentives for compliance-promoting behavior. Affirmative incentives include, for example, the use of compliance metrics and benchmarks in compensation calculations and the use of performance reviews that measure and reward compliance-promoting behavior, both as to the employee and any subordinates whom they supervise. When effectively implemented, such provisions incentivize executives and employees to engage in and promote compliant behavior and emphasize the corporation's commitment to its compliance programs and its culture.”  Yet compensation incentives have long been seen as a key element of any best practices compliance program. As far back as 2004, then SEC Director of Enforcement Stephen M. Cutler noted that integrity, ethics and compliance needed to be part of promotion, compensation and evaluation processes: “At the end of the day, the most effective way to communicate that “doing the right thing” is a priority, is to reward it.” The 2020 FCPA Guidance, 2nd edition, stated the “DOJ and SEC recognize that positive incentives can also drive compliant behavior. These incentives can take many forms such as personnel evaluations and promotions, rewards for improving and developing a company’s compliance program, and rewards for ethics and compliance leadership.” The Monaco Memo takes it a step further by asking more broadly has your company, “incentivized employee behavior as part of its efforts to create a culture of ethics and compliance within its organization.” Three key takeaways: The DOJ and SEC have long advocated compensation as a way to motivate employees into ethical and compliant behaviors Keep the compliance aspects of your compensation structure simple and easy for your employees to understand Have full transparency in the framework of your compensation structure Learn more about your ad choices. Visit megaphone.fm/adchoices One of the areas that many companies have not paid as much attention to in their compliance programs is compensation and incentives. However, the DOJ and SEC have long made clear that they view monetary structure for compensation, rewarding those employees who do business in compliance with their employer’s compliance program, as one of the ways to reinforce the compliance program and the message of compliance.

 This was made clear once again in the Monaco Memo which stated, “Corporations can help to deter criminal activity if they reward compliant behavior and penalize individuals who engage in misconduct. Compensation systems that clearly and effectively impose financial penalties for misconduct can incentivize compliant conduct, deter risky behavior, and instill a corporate culture in which employees follow the law and avoid legal “gray areas.””

 Moreover, the Monaco Memo tied compensation to a company’s culture of compliance. It stated, “Similarly, corporations can promote an ethical corporate culture by rewarding those executives and employees who promote compliance within the organization. Prosecutors should therefore also consider whether a corporation’s compensation systems provide affirmative incentives for compliance-promoting behavior. Affirmative incentives include, for example, the use of compliance metrics and benchmarks in compensation calculations and the use of performance reviews that measure and reward compliance-promoting behavior, both as to the employee and any subordinates whom they supervise. When effectively implemented, such provisions incentivize executives and employees to engage in and promote compliant behavior and emphasize the corporation's commitment to its compliance programs and its culture.”

 Yet compensation incentives have long been seen as a key element of any best practices compliance program. As far back as 2004, then SEC Director of Enforcement Stephen M. Cutler noted that integrity, ethics and compliance needed to be part of promotion, compensation and evaluation processes: “At the end of the day, the most effective way to communicate that “doing the right thing” is a priority, is to reward it.”

The 2020 FCPA Guidance, 2nd edition, stated the “DOJ and SEC recognize that positive incentives can also drive compliant behavior. These incentives can take many forms such as personnel evaluations and promotions, rewards for improving and developing a company’s compliance program, and rewards for ethics and compliance leadership.” The Monaco Memo takes it a step further by asking more broadly has your company, “incentivized employee behavior as part of its efforts to create a culture of ethics and compliance within its organization.”

Three key takeaways:

  1. The DOJ and SEC have long advocated compensation as a way to motivate employees into ethical and compliant behaviors
  2. Keep the compliance aspects of your compensation structure simple and easy for your employees to understand
  3. Have full transparency in the framework of your compensation structure

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no Day 11 - Tailored and Effective Compliance Training One of the key goals of any compliance program is to train employees in awareness and understanding of the FCPA; your specific company compliance program; and to create and foster a culture of compliance. While it seems axiomatic that compliance training is a mainstay of any best practices compliance program, the conversation around training has evolved over the years. Beginning in the fall of 2016, through the announcement of the FCPA Enforcement Pilot Program, the DOJ began to talk about whether you have determined the effectiveness of your training. This conversation continued with the 2017 Evaluation where it asked, “How has the company measured the effectiveness of the training?” This point has bedeviled many compliance professionals yet is now a key metric for the government in evaluating compliance training. This is not simply measuring training attendance and completion rates. This testing true effectiveness. It evolved further in the 2020 Update with the mandate that training must be “truly effective”. Finally, the training must be presented in a language in which the employees understand, which means in a local language, if the training is outside the US or other non-English-speaking countries. The 2017 Evaluation focused into whether your training was “tailored” for the audience. This added two requirements. The first was to assess your employees for risk to determine the type of training you might need to deliver by risk ranking your employees. Obviously, the sales force would be the highest risk but there may be others who are deserving of high-risk training as well. From this risk ranking, you were required to develop tailored training for the risks those employees will face. What are ‘espresso shots’ of training to help facilitate effective training? Tina Rampino, Associate Managing Director, at K2 Integrity suggests keeping your compliance training segments concise as “shorter, bite-size learning is a trend in training programs.” This means that instead of offering half-day and full-day sessions, break programs into shorter segments of 20 minutes or less, which are easier for participants to absorb - and schedule. Another example is that short cartoons or animated videos can be excellent quarterly reminders. Done properly, they do not feel like an assessment or certainly not a ‘check-the-box’ exercise. The bottom line is that with all training most employees must undergo now and even more so in the continued time of the Covid-19 Omicron Variant, espresso shots give people back a lot of time. Three key takeaways: How and why have you tailored your compliance training and how do you determine its effectiveness? Try an espresso shot of training. How is your training presented: both in languages and media? Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 11 Jan 2023 05:00:00 -0000 Day 11 - Tailored and Effective Compliance Training bonus 11 Thomas Fox In Day 11 of 31 Days to a More Effective Compliance Program, we consider tailored and effective training. One of the key goals of any compliance program is to train employees in awareness and understanding of the FCPA; your specific company compliance program; and to create and foster a culture of compliance. While it seems axiomatic that compliance training is a mainstay of any best practices compliance program, the conversation around training has evolved over the years. Beginning in the fall of 2016, through the announcement of the FCPA Enforcement Pilot Program, the DOJ began to talk about whether you have determined the effectiveness of your training. This conversation continued with the 2017 Evaluation where it asked, “How has the company measured the effectiveness of the training?” This point has bedeviled many compliance professionals yet is now a key metric for the government in evaluating compliance training. This is not simply measuring training attendance and completion rates. This testing true effectiveness. It evolved further in the 2020 Update with the mandate that training must be “truly effective”. Finally, the training must be presented in a language in which the employees understand, which means in a local language, if the training is outside the US or other non-English-speaking countries. The 2017 Evaluation focused into whether your training was “tailored” for the audience. This added two requirements. The first was to assess your employees for risk to determine the type of training you might need to deliver by risk ranking your employees. Obviously, the sales force would be the highest risk but there may be others who are deserving of high-risk training as well. From this risk ranking, you were required to develop tailored training for the risks those employees will face. What are ‘espresso shots’ of training to help facilitate effective training? Tina Rampino, Associate Managing Director, at K2 Integrity suggests keeping your compliance training segments concise as “shorter, bite-size learning is a trend in training programs.” This means that instead of offering half-day and full-day sessions, break programs into shorter segments of 20 minutes or less, which are easier for participants to absorb - and schedule. Another example is that short cartoons or animated videos can be excellent quarterly reminders. Done properly, they do not feel like an assessment or certainly not a ‘check-the-box’ exercise. The bottom line is that with all training most employees must undergo now and even more so in the continued time of the Covid-19 Omicron Variant, espresso shots give people back a lot of time. Three key takeaways: How and why have you tailored your compliance training and how do you determine its effectiveness? Try an espresso shot of training. How is your training presented: both in languages and media? Learn more about your ad choices. Visit megaphone.fm/adchoices One of the key goals of any compliance program is to train employees in awareness and understanding of the FCPA; your specific company compliance program; and to create and foster a culture of compliance. While it seems axiomatic that compliance training is a mainstay of any best practices compliance program, the conversation around training has evolved over the years. Beginning in the fall of 2016, through the announcement of the FCPA Enforcement Pilot Program, the DOJ began to talk about whether you have determined the effectiveness of your training. This conversation continued with the 2017 Evaluation where it asked, “How has the company measured the effectiveness of the training?” This point has bedeviled many compliance professionals yet is now a key metric for the government in evaluating compliance training. This is not simply measuring training attendance and completion rates. This testing true effectiveness.

It evolved further in the 2020 Update with the mandate that training must be “truly effective”. Finally, the training must be presented in a language in which the employees understand, which means in a local language, if the training is outside the US or other non-English-speaking countries. The 2017 Evaluation focused into whether your training was “tailored” for the audience. This added two requirements. The first was to assess your employees for risk to determine the type of training you might need to deliver by risk ranking your employees. Obviously, the sales force would be the highest risk but there may be others who are deserving of high-risk training as well. From this risk ranking, you were required to develop tailored training for the risks those employees will face.

What are ‘espresso shots’ of training to help facilitate effective training? Tina Rampino, Associate Managing Director, at K2 Integrity suggests keeping your compliance training segments concise as “shorter, bite-size learning is a trend in training programs.” This means that instead of offering half-day and full-day sessions, break programs into shorter segments of 20 minutes or less, which are easier for participants to absorb - and schedule. Another example is that short cartoons or animated videos can be excellent quarterly reminders. Done properly, they do not feel like an assessment or certainly not a ‘check-the-box’ exercise. The bottom line is that with all training most employees must undergo now and even more so in the continued time of the Covid-19 Omicron Variant, espresso shots give people back a lot of time.

Three key takeaways:

  1. How and why have you tailored your compliance training and how do you determine its effectiveness?
  2. Try an espresso shot of training.
  3. How is your training presented: both in languages and media?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 no Day 10 - The Use of Social Media in Compliance What is the message of compliance inside of a corporation and how it is distributed? In a compliance program, the largest portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communications are free or available at very low cost. Why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward? Louis Sapirman, Vice President and Chief Ethics & Compliance Officer for Panasonic Corporation of North America – Panasonic USA, often talks about the integration of social media into compliance. You should start with the tech-savvy nature of the today’s workforce. It is not simply about having a younger workforce but a workforce whose primary tool for communication is social media. If your company is in the services business, it probably means your employee base is using technological tools to deliver business solutions. Finally, consider the data-driven nature of business today so using technological tools to deliver products and solutions is something your company most probably does now. Facebook, LinkedIn, Twitter and even TikTok can all be utilized.  Finally, never forget the social part of social media. Social media is a more holistic, multiple-sided communication. Not only are you setting out expectations but also these tools allow you to receive back communications from your employees. The D&B experience around the name change for its Code of Conduct is but one example. You can also see that if you have several concerns expressed it could alert you earlier to begin some detection and move towards prevention in your compliance program. Another approach is to use audio as a part of your compliance communications. Podcasts are a great way to tell a long form story about your compliance successes and challenges. Ronnie Feldman, founder of L&E Entertainment continually reminds us that the engagement of your compliance audience is through the entertainment of your compliance communications. But the key is the audio format can be a powerful tool for you and a way to reach your employee base that you are not taking advantage. It can be as simple as interviewing employees on the importance of culture and how they use culture to guide their decision-making process in their daily work. You are only limited by your imagination.  Three key takeaways: 1. Incorporation of social media into your compliance communications can pay big dividends. 2. Focus on the ‘social’ part of social media. 3. Consider incorporating podcasts and other audio clips into your compliance communications and training. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 10 Jan 2023 05:00:00 -0000 Day 10 - The Use of Social Media in Compliance bonus 10 Thomas Fox In this episode of 31 days to a more effective compliance program, we consider the use of social media in compliance. What is the message of compliance inside of a corporation and how it is distributed? In a compliance program, the largest portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communications are free or available at very low cost. Why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward? Louis Sapirman, Vice President and Chief Ethics & Compliance Officer for Panasonic Corporation of North America – Panasonic USA, often talks about the integration of social media into compliance. You should start with the tech-savvy nature of the today’s workforce. It is not simply about having a younger workforce but a workforce whose primary tool for communication is social media. If your company is in the services business, it probably means your employee base is using technological tools to deliver business solutions. Finally, consider the data-driven nature of business today so using technological tools to deliver products and solutions is something your company most probably does now. Facebook, LinkedIn, Twitter and even TikTok can all be utilized.  Finally, never forget the social part of social media. Social media is a more holistic, multiple-sided communication. Not only are you setting out expectations but also these tools allow you to receive back communications from your employees. The D&B experience around the name change for its Code of Conduct is but one example. You can also see that if you have several concerns expressed it could alert you earlier to begin some detection and move towards prevention in your compliance program. Another approach is to use audio as a part of your compliance communications. Podcasts are a great way to tell a long form story about your compliance successes and challenges. Ronnie Feldman, founder of L&E Entertainment continually reminds us that the engagement of your compliance audience is through the entertainment of your compliance communications. But the key is the audio format can be a powerful tool for you and a way to reach your employee base that you are not taking advantage. It can be as simple as interviewing employees on the importance of culture and how they use culture to guide their decision-making process in their daily work. You are only limited by your imagination.  Three key takeaways: 1. Incorporation of social media into your compliance communications can pay big dividends. 2. Focus on the ‘social’ part of social media. 3. Consider incorporating podcasts and other audio clips into your compliance communications and training. Learn more about your ad choices. Visit megaphone.fm/adchoices What is the message of compliance inside of a corporation and how it is distributed? In a compliance program, the largest portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communications are free or available at very low cost. Why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward?

Louis Sapirman, Vice President and Chief Ethics & Compliance Officer for Panasonic Corporation of North America – Panasonic USA, often talks about the integration of social media into compliance. You should start with the tech-savvy nature of the today’s workforce. It is not simply about having a younger workforce but a workforce whose primary tool for communication is social media. If your company is in the services business, it probably means your employee base is using technological tools to deliver business solutions. Finally, consider the data-driven nature of business today so using technological tools to deliver products and solutions is something your company most probably does now. Facebook, LinkedIn, Twitter and even TikTok can all be utilized. 

Finally, never forget the social part of social media. Social media is a more holistic, multiple-sided communication. Not only are you setting out expectations but also these tools allow you to receive back communications from your employees. The D&B experience around the name change for its Code of Conduct is but one example. You can also see that if you have several concerns expressed it could alert you earlier to begin some detection and move towards prevention in your compliance program.

Another approach is to use audio as a part of your compliance communications. Podcasts are a great way to tell a long form story about your compliance successes and challenges. Ronnie Feldman, founder of L&E Entertainment continually reminds us that the engagement of your compliance audience is through the entertainment of your compliance communications. But the key is the audio format can be a powerful tool for you and a way to reach your employee base that you are not taking advantage. It can be as simple as interviewing employees on the importance of culture and how they use culture to guide their decision-making process in their daily work. You are only limited by your imagination.

 Three key takeaways:

1. Incorporation of social media into your compliance communications can pay big dividends.

2. Focus on the ‘social’ part of social media.

3. Consider incorporating podcasts and other audio clips into your compliance communications and training.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 580 no Day 9 - 360 Degrees of Compliance Communications A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is in touch with and visible to your employees at all times. It is about creating a distinctive brand philosophy of compliance which is centered on your consumers. In other words, it helps a compliance practitioner to anticipate all the aspects of your employees needs around compliance. This is especially true when compliance is either perceived as something that comes out of the home office or is perceived as the “Land of No.” A 360-degree view of compliance gives you the opportunity to build a new brand image for your compliance program. This is important as the 2020 Update mandates that for a compliance program to be effective, it must be understood by a wide variety of stakeholders. Communications is often thought of as a two-way street, upward and downward, inbound and outbound, or side-to-side. However, it is better to think of it as a 360-degree effort. You simply can no longer effectively communicate in just two ways. You now communicate in a more holistic manner, and in multiple ways. If you are just thinking about communications in the classic form, you are missing something that is happening around you. 360-degrees of compliance communication is not just a classic form of communication but rather it is a communication in the concept of every interaction, whether they be planned or accidental. It is all a form of communication. This is particularly true if you are a compliance professional, practitioner or CCO. The things you do, the way you act, and the way people see you, you are always communicating. It is not simply communicating one to one as often you may be communicating to a group across siloed boundaries, to the constituencies you had not even planned to initially communicate with. It also allows you to see and hear new ideas, concepts or simply ways to create a more effective compliance regime for your front line BD folks and your first line of defense. Three key takeaways: 1. Remember the definition of 360-degrees of communication. It is an effort that moves the compliance identity into a holistic approach so compliance is in touch and visible to your employees at all times 2. What is your objective? What are you trying to do with your 360-degrees of communications and how are you using that mechanism to deliver the objectives of your compliance program? 3. Evaluate. You need to evaluate three factors: 1) has the message been delivered; 2) has it been heard; and 3) is it being implemented? Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 09 Jan 2023 05:00:00 -0000 Day 9 - 360 Degrees of Compliance Communications bonus 9 Thomas Fox In Day 9 of 31 days to a more effective compliance program, I look at 360 degrees of compliance communications. A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is in touch with and visible to your employees at all times. It is about creating a distinctive brand philosophy of compliance which is centered on your consumers. In other words, it helps a compliance practitioner to anticipate all the aspects of your employees needs around compliance. This is especially true when compliance is either perceived as something that comes out of the home office or is perceived as the “Land of No.” A 360-degree view of compliance gives you the opportunity to build a new brand image for your compliance program. This is important as the 2020 Update mandates that for a compliance program to be effective, it must be understood by a wide variety of stakeholders. Communications is often thought of as a two-way street, upward and downward, inbound and outbound, or side-to-side. However, it is better to think of it as a 360-degree effort. You simply can no longer effectively communicate in just two ways. You now communicate in a more holistic manner, and in multiple ways. If you are just thinking about communications in the classic form, you are missing something that is happening around you. 360-degrees of compliance communication is not just a classic form of communication but rather it is a communication in the concept of every interaction, whether they be planned or accidental. It is all a form of communication. This is particularly true if you are a compliance professional, practitioner or CCO. The things you do, the way you act, and the way people see you, you are always communicating. It is not simply communicating one to one as often you may be communicating to a group across siloed boundaries, to the constituencies you had not even planned to initially communicate with. It also allows you to see and hear new ideas, concepts or simply ways to create a more effective compliance regime for your front line BD folks and your first line of defense. Three key takeaways: 1. Remember the definition of 360-degrees of communication. It is an effort that moves the compliance identity into a holistic approach so compliance is in touch and visible to your employees at all times 2. What is your objective? What are you trying to do with your 360-degrees of communications and how are you using that mechanism to deliver the objectives of your compliance program? 3. Evaluate. You need to evaluate three factors: 1) has the message been delivered; 2) has it been heard; and 3) is it being implemented? Learn more about your ad choices. Visit megaphone.fm/adchoices A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is in touch with and visible to your employees at all times. It is about creating a distinctive brand philosophy of compliance which is centered on your consumers. In other words, it helps a compliance practitioner to anticipate all the aspects of your employees needs around compliance. This is especially true when compliance is either perceived as something that comes out of the home office or is perceived as the “Land of No.” A 360-degree view of compliance gives you the opportunity to build a new brand image for your compliance program. This is important as the 2020 Update mandates that for a compliance program to be effective, it must be understood by a wide variety of stakeholders.

Communications is often thought of as a two-way street, upward and downward, inbound and outbound, or side-to-side. However, it is better to think of it as a 360-degree effort. You simply can no longer effectively communicate in just two ways. You now communicate in a more holistic manner, and in multiple ways. If you are just thinking about communications in the classic form, you are missing something that is happening around you.

360-degrees of compliance communication is not just a classic form of communication but rather it is a communication in the concept of every interaction, whether they be planned or accidental. It is all a form of communication. This is particularly true if you are a compliance professional, practitioner or CCO. The things you do, the way you act, and the way people see you, you are always communicating. It is not simply communicating one to one as often you may be communicating to a group across siloed boundaries, to the constituencies you had not even planned to initially communicate with. It also allows you to see and hear new ideas, concepts or simply ways to create a more effective compliance regime for your front line BD folks and your first line of defense.

Three key takeaways:

1. Remember the definition of 360-degrees of communication. It is an effort that moves the compliance identity into a holistic approach so compliance is in touch and visible to your employees at all times

2. What is your objective? What are you trying to do with your 360-degrees of communications and how are you using that mechanism to deliver the objectives of your compliance program?

3. Evaluate. You need to evaluate three factors: 1) has the message been delivered; 2) has it been heard; and 3) is it being implemented?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 570 no Day 8 - Internal Controls and Compliance What are internal controls? The best definition I have come across is from Jonathan Marks who defined internal controls as: An internal control is an action or process of interlocking activities designed to support the policies and procedures detailing the specific preventative, detective, corrective, directive and corroborative actions required to achieve the desired process outcomes or the objectives(s). This, along with continuous auditing, continuous monitoring and training reasonably assures:  The achievement of the process objectives linked to the organization’s objectives; Operational effectiveness and efficiency; Reliable (complete and accurate) books and records (financial reporting); Compliance with laws, regulations and policies; and  The reduction of risk-fraud, waste and abuse, which, Aids in the decline of process and policy variation, leading to more predictive outcomes. The DOJ and SEC, in the 2020 FCPA Resource Guide, stated: Internal controls over financial reporting are the processes used by compa­nies to provide reasonable assurances regarding the reliabil­ity of financial reporting and the preparation of financial statements. They include various components, such as: a control environment that covers the tone set by the organi­zation regarding integrity and ethics; risk assessments; con­trol activities that cover policies and procedures designed to ensure that management directives are carried out (e.g., approvals, authorizations, reconciliations, and segregation of duties); information and communication; and monitoring. … The design of a company’s internal controls must take into account the operational realities and risks attendant to the company’s business, such as: the nature of its products or services; how the products or services get to market; the nature of its work force; the degree of regulation; the extent of its government interaction; and the degree to which it has operations in countries with a high risk of corruption. This was supplemented in the 2020 Update, with a pair of pointed questions: whether a company has made significant investigation into its internal controls and have they been tested, then remediated based upon the testing? The bottom line is that internal controls are just good financial controls. The internal controls that detail requirements for third-party representatives in the compliance context will help to detect fraud, which could well lead to bribery and corruption. As an exercise, map your existing internal controls to the Ten Hallmarks of an Effective Compliance Program or some other well-known anti-corruption regime to see where gaps may exist. This will help you to determine whether adequate compliance internal controls are present in your company. From there you can move to see if they are working in practice. Three key takeaways: Effective internal controls are required under the FCPA Internal controls are a critical part of any best practices compliance program There are four significant controls for the compliance practitioner to implement initially. (a) Delegation of authority (DOA); (b) Maintenance of the vendor master file; (c) Contracts with third parties; and (d) Movement of cash/currency. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 08 Jan 2023 05:00:00 -0000 Day 8 - Internal Controls and Compliance full 8 Thomas Fox Today, we consider the role or internal controls in a compliance program. What are internal controls? The best definition I have come across is from Jonathan Marks who defined internal controls as: An internal control is an action or process of interlocking activities designed to support the policies and procedures detailing the specific preventative, detective, corrective, directive and corroborative actions required to achieve the desired process outcomes or the objectives(s). This, along with continuous auditing, continuous monitoring and training reasonably assures:  The achievement of the process objectives linked to the organization’s objectives; Operational effectiveness and efficiency; Reliable (complete and accurate) books and records (financial reporting); Compliance with laws, regulations and policies; and  The reduction of risk-fraud, waste and abuse, which, Aids in the decline of process and policy variation, leading to more predictive outcomes. The DOJ and SEC, in the 2020 FCPA Resource Guide, stated: Internal controls over financial reporting are the processes used by compa­nies to provide reasonable assurances regarding the reliabil­ity of financial reporting and the preparation of financial statements. They include various components, such as: a control environment that covers the tone set by the organi­zation regarding integrity and ethics; risk assessments; con­trol activities that cover policies and procedures designed to ensure that management directives are carried out (e.g., approvals, authorizations, reconciliations, and segregation of duties); information and communication; and monitoring. … The design of a company’s internal controls must take into account the operational realities and risks attendant to the company’s business, such as: the nature of its products or services; how the products or services get to market; the nature of its work force; the degree of regulation; the extent of its government interaction; and the degree to which it has operations in countries with a high risk of corruption. This was supplemented in the 2020 Update, with a pair of pointed questions: whether a company has made significant investigation into its internal controls and have they been tested, then remediated based upon the testing? The bottom line is that internal controls are just good financial controls. The internal controls that detail requirements for third-party representatives in the compliance context will help to detect fraud, which could well lead to bribery and corruption. As an exercise, map your existing internal controls to the Ten Hallmarks of an Effective Compliance Program or some other well-known anti-corruption regime to see where gaps may exist. This will help you to determine whether adequate compliance internal controls are present in your company. From there you can move to see if they are working in practice. Three key takeaways: Effective internal controls are required under the FCPA Internal controls are a critical part of any best practices compliance program There are four significant controls for the compliance practitioner to implement initially. (a) Delegation of authority (DOA); (b) Maintenance of the vendor master file; (c) Contracts with third parties; and (d) Movement of cash/currency. Learn more about your ad choices. Visit megaphone.fm/adchoices What are internal controls? The best definition I have come across is from Jonathan Marks who defined internal controls as:

An internal control is an action or process of interlocking activities designed to support the policies and procedures detailing the specific preventative, detective, corrective, directive and corroborative actions required to achieve the desired process outcomes or the objectives(s). This, along with continuous auditing, continuous monitoring and training reasonably assures: 

  • The achievement of the process objectives linked to the organization’s objectives;
  • Operational effectiveness and efficiency;
  • Reliable (complete and accurate) books and records (financial reporting);
  • Compliance with laws, regulations and policies; and 
  • The reduction of risk-fraud, waste and abuse, which,
  • Aids in the decline of process and policy variation, leading to more predictive outcomes.


The DOJ and SEC, in the 2020 FCPA Resource Guide, stated:

Internal controls over financial reporting are the processes used by compa­nies to provide reasonable assurances regarding the reliabil­ity of financial reporting and the preparation of financial statements. They include various components, such as: a control environment that covers the tone set by the organi­zation regarding integrity and ethics; risk assessments; con­trol activities that cover policies and procedures designed to ensure that management directives are carried out (e.g., approvals, authorizations, reconciliations, and segregation of duties); information and communication; and monitoring. … The design of a company’s internal controls must take into account the operational realities and risks attendant to the company’s business, such as: the nature of its products or services; how the products or services get to market; the nature of its work force; the degree of regulation; the extent of its government interaction; and the degree to which it has operations in countries with a high risk of corruption.

This was supplemented in the 2020 Update, with a pair of pointed questions: whether a company has made significant investigation into its internal controls and have they been tested, then remediated based upon the testing?

The bottom line is that internal controls are just good financial controls. The internal controls that detail requirements for third-party representatives in the compliance context will help to detect fraud, which could well lead to bribery and corruption. As an exercise, map your existing internal controls to the Ten Hallmarks of an Effective Compliance Program or some other well-known anti-corruption regime to see where gaps may exist. This will help you to determine whether adequate compliance internal controls are present in your company. From there you can move to see if they are working in practice.

Three key takeaways:

  1. Effective internal controls are required under the FCPA
  2. Internal controls are a critical part of any best practices compliance program
  3. There are four significant controls for the compliance practitioner to implement initially. (a) Delegation of authority (DOA); (b) Maintenance of the vendor master file; (c) Contracts with third parties; and (d) Movement of cash/currency.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 557 no Day 7 - Policies and Procedures There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2020 Update made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as part of its risk assessment process.” This statement made clear that the regulators will take a strong view against a company that does not have well thought out and articulated policies and procedures against bribery and corruption; all of which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital layer of communication and acts as an internal control. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to policies and procedures in anti-corruption compliance. The specific written policies and procedures required for a best practices compliance program are well known and long established. According to the 2020 FCPA Resources Guide 2nd edition, some of the risks companies should keep in mind include the nature and extent of transactions with foreign governments (including payments to foreign officials); use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments. Policies help form the basis of expectations for standards of conduct in your company. Procedures are the documents that implement these standards of conduct. Three key takeaways: 1. Written compliance policies and procedures, together the Code of Conduct, with form the backbone of your compliance program. 2. The DOJ and SEC expect a well-thought out and articulated set of compliance policies and procedures and that they be adequately communicated throughout your organization. 3. Institutional fairness for the application of policies and procedures demands consistent application of your policies and procedures across the globe. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 07 Jan 2023 05:00:00 -0000 Policies and Procedures bonus 7 Thomas Fox In Day 7, we consider compliance Policies and Procedures. There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2020 Update made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as part of its risk assessment process.” This statement made clear that the regulators will take a strong view against a company that does not have well thought out and articulated policies and procedures against bribery and corruption; all of which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital layer of communication and acts as an internal control. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to policies and procedures in anti-corruption compliance. The specific written policies and procedures required for a best practices compliance program are well known and long established. According to the 2020 FCPA Resources Guide 2nd edition, some of the risks companies should keep in mind include the nature and extent of transactions with foreign governments (including payments to foreign officials); use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments. Policies help form the basis of expectations for standards of conduct in your company. Procedures are the documents that implement these standards of conduct. Three key takeaways: 1. Written compliance policies and procedures, together the Code of Conduct, with form the backbone of your compliance program. 2. The DOJ and SEC expect a well-thought out and articulated set of compliance policies and procedures and that they be adequately communicated throughout your organization. 3. Institutional fairness for the application of policies and procedures demands consistent application of your policies and procedures across the globe. Learn more about your ad choices. Visit megaphone.fm/adchoices There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2020 Update made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as part of its risk assessment process.” This statement made clear that the regulators will take a strong view against a company that does not have well thought out and articulated policies and procedures against bribery and corruption; all of which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital layer of communication and acts as an internal control. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to policies and procedures in anti-corruption compliance.

The specific written policies and procedures required for a best practices compliance program are well known and long established. According to the 2020 FCPA Resources Guide 2nd edition, some of the risks companies should keep in mind include the nature and extent of transactions with foreign governments (including payments to foreign officials); use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments. Policies help form the basis of expectations for standards of conduct in your company. Procedures are the documents that implement these standards of conduct.

Three key takeaways:

1. Written compliance policies and procedures, together the Code of Conduct, with form the backbone of your compliance program.

2. The DOJ and SEC expect a well-thought out and articulated set of compliance policies and procedures and that they be adequately communicated throughout your organization.

3. Institutional fairness for the application of policies and procedures demands consistent application of your policies and procedures across the globe.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 580 no Day 6 - The Code of Conduct What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in regulator’s face during an enforcement action as proof of ethical overall behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal in the creation of your company’s Code of Conduct? Indeed violation of your Code of Conduct can form the basis of a domestic FCPA enforcement action. In an enforcement action involving United Airlines, Inc., a breach of the Code of Conduct by the Company CEO was determined to be a FCPA internal controls violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity which has authority over, among other things, United’s operations at the company’s huge east coast hub at Newark, NJ. The substance of your Code of Conduct should be tailored to your company’s culture, and to its industry and corporate identity. It should provide a mechanism by which employees who are trying to do the right thing in the compliance and business ethics arena can do so. The Code of Conduct can be used as a basis for employee review and evaluation. It should certainly be invoked if there is a violation. Your company’s disciplinary procedures must be stated in the Code. These would include all forms of disciplines, up to and including dismissal, for serious violations of the Code. Further, your company’s Code should emphasize it will comply with all applicable laws and regulations, wherever it does business. The code needs to be written in plain English and translated into other languages as necessary so that all applicable persons can understand it. Three key takeaways: 1. A Code of Conduct is a foundational document in any compliance regime. 2. The substance of your Code of Conduct should be tailored to the company’s culture, to its industry and corporate identity. 3. “Document, Document, and Document” your training and communication efforts regarding you Code of Conduct. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 06 Jan 2023 05:00:00 -0000 The Code of Conduct bonus 6 Thomas Fox In Day 6 we consider the role of your Code of Conduct. What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in regulator’s face during an enforcement action as proof of ethical overall behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal in the creation of your company’s Code of Conduct? Indeed violation of your Code of Conduct can form the basis of a domestic FCPA enforcement action. In an enforcement action involving United Airlines, Inc., a breach of the Code of Conduct by the Company CEO was determined to be a FCPA internal controls violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity which has authority over, among other things, United’s operations at the company’s huge east coast hub at Newark, NJ. The substance of your Code of Conduct should be tailored to your company’s culture, and to its industry and corporate identity. It should provide a mechanism by which employees who are trying to do the right thing in the compliance and business ethics arena can do so. The Code of Conduct can be used as a basis for employee review and evaluation. It should certainly be invoked if there is a violation. Your company’s disciplinary procedures must be stated in the Code. These would include all forms of disciplines, up to and including dismissal, for serious violations of the Code. Further, your company’s Code should emphasize it will comply with all applicable laws and regulations, wherever it does business. The code needs to be written in plain English and translated into other languages as necessary so that all applicable persons can understand it. Three key takeaways: 1. A Code of Conduct is a foundational document in any compliance regime. 2. The substance of your Code of Conduct should be tailored to the company’s culture, to its industry and corporate identity. 3. “Document, Document, and Document” your training and communication efforts regarding you Code of Conduct. Learn more about your ad choices. Visit megaphone.fm/adchoices What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in regulator’s face during an enforcement action as proof of ethical overall behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal in the creation of your company’s Code of Conduct?

Indeed violation of your Code of Conduct can form the basis of a domestic FCPA enforcement action. In an enforcement action involving United Airlines, Inc., a breach of the Code of Conduct by the Company CEO was determined to be a FCPA internal controls violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity which has authority over, among other things, United’s operations at the company’s huge east coast hub at Newark, NJ.

The substance of your Code of Conduct should be tailored to your company’s culture, and to its industry and corporate identity. It should provide a mechanism by which employees who are trying to do the right thing in the compliance and business ethics arena can do so. The Code of Conduct can be used as a basis for employee review and evaluation. It should certainly be invoked if there is a violation. Your company’s disciplinary procedures must be stated in the Code. These would include all forms of disciplines, up to and including dismissal, for serious violations of the Code. Further, your company’s Code should emphasize it will comply with all applicable laws and regulations, wherever it does business. The code needs to be written in plain English and translated into other languages as necessary so that all applicable persons can understand it.

Three key takeaways:

1. A Code of Conduct is a foundational document in any compliance regime.

2. The substance of your Code of Conduct should be tailored to the company’s culture, to its industry and corporate identity.

3. “Document, Document, and Document” your training and communication efforts regarding you Code of Conduct.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 597 no Day 5 - The Board of Directors and Operationalizing Compliance The most significant development for Boards and compliance in continues to come from the Delaware courts, which have been expanding the civil law obligations of Boards through a series of court decisions involving the expansion of the Caremark Doctrine for the past several years. These developments began with the Marchand (Blue Bell Ice Cream) and reached a peak with the Boeing case which stands for the continuing proposition that a Board cannot simply have the trappings of oversight, it must do the serious work required and have evidence of that work (Document, Document, and Document). The decision in Boeing is yet a further expansion of the Caremark Doctrine, once again beginning with Marchand. Boeing also stands for the proposition that a company must assess its risks and then manage those risks right up through the Board level. Finally a Board must be aggressive in their approach and not simply passively taking in what management has presented to them. The DOJ has also made clear its thoughts on the role of the Board of Directors. The role of the Board is different than that of senior management. Both the 2020 Update  and DOJ Antitrust Division’s 2019 Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations was even more explicit in announcing their expectation for robust Board oversight of a corporate compliance function. I would also add the DOJ may soon expect there be a Compliance Committee separate and apart from the Audit Committee. The DOJ continually speaks about the need for companies to operationalize their compliance programs. Businesses must work to integrate compliance into the DNA of their organization. Having a Board member with specific compliance expertise or heading a Compliance Committee can provide a level of oversight and commitment to achieving this goal. The DOJ enshrined this requirement in the FCPA Corporate Enforcement Policy. This means that when your company is evaluated by the DOJ, under the factors set out in the 2020 Update and FCPA Corporate Enforcement Policy, to retrospectively determine if your company had a best practices compliance program in place at the time of any violation, you need to have not only the structure of the Board-level Compliance Committee but also the specific subject matter expertise on the Board and on that committee. All of this means that every Board of Directors needs a true compliance expert. Almost every Board has a former Chief Financial Officer, former head of Internal Audit or persons with a similar background, and often times these are also the Audit Committee members of the Board. Such a background brings a level of sophistication, training and SME that can help all companies with their financial reporting and other finance-based issues. So why is there not such SME at the Board level from the compliance profession?  Three key takeaways: 1. The 2020 Update required active Board of Director engagement and oversight around compliance. 2. Board communication on compliance is a two-way street; both inbound and outbound. 3. The Delaware courts have been expanding Boards roles through expansion of the Caremark Doctrine. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 05 Jan 2023 05:00:00 -0000 Day 5 - The Board of Directors and Operationalizing Compliance full 5 Thomas Fox In Day 5, the role of the Board in operationalizing compliance. The most significant development for Boards and compliance in continues to come from the Delaware courts, which have been expanding the civil law obligations of Boards through a series of court decisions involving the expansion of the Caremark Doctrine for the past several years. These developments began with the Marchand (Blue Bell Ice Cream) and reached a peak with the Boeing case which stands for the continuing proposition that a Board cannot simply have the trappings of oversight, it must do the serious work required and have evidence of that work (Document, Document, and Document). The decision in Boeing is yet a further expansion of the Caremark Doctrine, once again beginning with Marchand. Boeing also stands for the proposition that a company must assess its risks and then manage those risks right up through the Board level. Finally a Board must be aggressive in their approach and not simply passively taking in what management has presented to them. The DOJ has also made clear its thoughts on the role of the Board of Directors. The role of the Board is different than that of senior management. Both the 2020 Update  and DOJ Antitrust Division’s 2019 Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations was even more explicit in announcing their expectation for robust Board oversight of a corporate compliance function. I would also add the DOJ may soon expect there be a Compliance Committee separate and apart from the Audit Committee. The DOJ continually speaks about the need for companies to operationalize their compliance programs. Businesses must work to integrate compliance into the DNA of their organization. Having a Board member with specific compliance expertise or heading a Compliance Committee can provide a level of oversight and commitment to achieving this goal. The DOJ enshrined this requirement in the FCPA Corporate Enforcement Policy. This means that when your company is evaluated by the DOJ, under the factors set out in the 2020 Update and FCPA Corporate Enforcement Policy, to retrospectively determine if your company had a best practices compliance program in place at the time of any violation, you need to have not only the structure of the Board-level Compliance Committee but also the specific subject matter expertise on the Board and on that committee. All of this means that every Board of Directors needs a true compliance expert. Almost every Board has a former Chief Financial Officer, former head of Internal Audit or persons with a similar background, and often times these are also the Audit Committee members of the Board. Such a background brings a level of sophistication, training and SME that can help all companies with their financial reporting and other finance-based issues. So why is there not such SME at the Board level from the compliance profession?  Three key takeaways: 1. The 2020 Update required active Board of Director engagement and oversight around compliance. 2. Board communication on compliance is a two-way street; both inbound and outbound. 3. The Delaware courts have been expanding Boards roles through expansion of the Caremark Doctrine. Learn more about your ad choices. Visit megaphone.fm/adchoices The most significant development for Boards and compliance in continues to come from the Delaware courts, which have been expanding the civil law obligations of Boards through a series of court decisions involving the expansion of the Caremark Doctrine for the past several years. These developments began with the Marchand (Blue Bell Ice Cream) and reached a peak with the Boeing case which stands for the continuing proposition that a Board cannot simply have the trappings of oversight, it must do the serious work required and have evidence of that work (Document, Document, and Document). The decision in Boeing is yet a further expansion of the Caremark Doctrine, once again beginning with Marchand. Boeing also stands for the proposition that a company must assess its risks and then manage those risks right up through the Board level. Finally a Board must be aggressive in their approach and not simply passively taking in what management has presented to them.

The DOJ has also made clear its thoughts on the role of the Board of Directors. The role of the Board is different than that of senior management. Both the 2020 Update  and DOJ Antitrust Division’s 2019 Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations was even more explicit in announcing their expectation for robust Board oversight of a corporate compliance function. I would also add the DOJ may soon expect there be a Compliance Committee separate and apart from the Audit Committee.

The DOJ continually speaks about the need for companies to operationalize their compliance programs. Businesses must work to integrate compliance into the DNA of their organization. Having a Board member with specific compliance expertise or heading a Compliance Committee can provide a level of oversight and commitment to achieving this goal. The DOJ enshrined this requirement in the FCPA Corporate Enforcement Policy. This means that when your company is evaluated by the DOJ, under the factors set out in the 2020 Update and FCPA Corporate Enforcement Policy, to retrospectively determine if your company had a best practices compliance program in place at the time of any violation, you need to have not only the structure of the Board-level Compliance Committee but also the specific subject matter expertise on the Board and on that committee.

All of this means that every Board of Directors needs a true compliance expert. Almost every Board has a former Chief Financial Officer, former head of Internal Audit or persons with a similar background, and often times these are also the Audit Committee members of the Board. Such a background brings a level of sophistication, training and SME that can help all companies with their financial reporting and other finance-based issues. So why is there not such SME at the Board level from the compliance profession?

 Three key takeaways:

1. The 2020 Update required active Board of Director engagement and oversight around compliance.

2. Board communication on compliance is a two-way street; both inbound and outbound.

3. The Delaware courts have been expanding Boards roles through expansion of the Caremark Doctrine.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 616 no Day 4 - Moving Compliance Tone Down Through an Organization What should the tone in the middle be? What should middle management’s role be in the company’s compliance program? This role is critical because the majority of company employees work most directly with middle, rather than top management and, consequently, they will take their cues from how middle management responds to a situation. Perhaps most importantly, middle management must listen to the concerns of employees. Even if middle management cannot affect a direct change, it is important that employees have an outlet to express their concerns. Your organization should train middle managers to enhance listening skills in the overall context of providing training for their “Manager’s Toolkit.” This can be particularly true if there is a compliance violation or other incident which requires some form of employee discipline. Most employees think it important that there be organizational justice so that people believe they will be treated fairly. For if there is organizational justice, it engenders perceived procedural fairness which makes it more likely an employee will be willing accept a decision that they may not like or disagree with the end result. Even with great “tone at the top” and positive “mood in the middle”, you cannot stop. One of the greatest challenges of a compliance practitioner is how to impact the most front-line employees or the “tone at the bottom”. One of the things you can do is assemble a compliance focus group to find out how business is done in the field and if it differs from what your company expects from an ethical and compliance perspective. Begin by assembling a group of employees who are familiar with the challenges of doing business in a compliant manner in certain geographic regions to discuss the challenges of doing business ethically and in compliance. Ask them questions about their understanding of your compliance regime. Then categorize the answers into the theory and practice of compliance in your company. More than ever in 2022, employees came to look to their direct supervisor to determine what the tone of an organization is and will be going forward. Many employees of large, multi-national organizations may never have direct contact with the CEO or even senior management. By moving the values of compliance through an organization into the middle, you will be in a much better position to inculcate these values and operationalizing compliance with them. Three key takeaways: 1. Tone at the top—direct supervisors become the most important influence on people in the company 2. Give your middle managers a Tool Kit around compliance so they can fully operationalize compliance 3. Organizational justice is an additional way to help operationalize compliance Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 04 Jan 2023 05:00:00 -0000 Moving Compliance Tone Down Through an Organization bonus 4 Thomas Fox In Day 4, we consider how to move compliance down through your organization. What should the tone in the middle be? What should middle management’s role be in the company’s compliance program? This role is critical because the majority of company employees work most directly with middle, rather than top management and, consequently, they will take their cues from how middle management responds to a situation. Perhaps most importantly, middle management must listen to the concerns of employees. Even if middle management cannot affect a direct change, it is important that employees have an outlet to express their concerns. Your organization should train middle managers to enhance listening skills in the overall context of providing training for their “Manager’s Toolkit.” This can be particularly true if there is a compliance violation or other incident which requires some form of employee discipline. Most employees think it important that there be organizational justice so that people believe they will be treated fairly. For if there is organizational justice, it engenders perceived procedural fairness which makes it more likely an employee will be willing accept a decision that they may not like or disagree with the end result. Even with great “tone at the top” and positive “mood in the middle”, you cannot stop. One of the greatest challenges of a compliance practitioner is how to impact the most front-line employees or the “tone at the bottom”. One of the things you can do is assemble a compliance focus group to find out how business is done in the field and if it differs from what your company expects from an ethical and compliance perspective. Begin by assembling a group of employees who are familiar with the challenges of doing business in a compliant manner in certain geographic regions to discuss the challenges of doing business ethically and in compliance. Ask them questions about their understanding of your compliance regime. Then categorize the answers into the theory and practice of compliance in your company. More than ever in 2022, employees came to look to their direct supervisor to determine what the tone of an organization is and will be going forward. Many employees of large, multi-national organizations may never have direct contact with the CEO or even senior management. By moving the values of compliance through an organization into the middle, you will be in a much better position to inculcate these values and operationalizing compliance with them. Three key takeaways: 1. Tone at the top—direct supervisors become the most important influence on people in the company 2. Give your middle managers a Tool Kit around compliance so they can fully operationalize compliance 3. Organizational justice is an additional way to help operationalize compliance Learn more about your ad choices. Visit megaphone.fm/adchoices What should the tone in the middle be? What should middle management’s role be in the company’s compliance program? This role is critical because the majority of company employees work most directly with middle, rather than top management and, consequently, they will take their cues from how middle management responds to a situation. Perhaps most importantly, middle management must listen to the concerns of employees. Even if middle management cannot affect a direct change, it is important that employees have an outlet to express their concerns. Your organization should train middle managers to enhance listening skills in the overall context of providing training for their “Manager’s Toolkit.” This can be particularly true if there is a compliance violation or other incident which requires some form of employee discipline. Most employees think it important that there be organizational justice so that people believe they will be treated fairly. For if there is organizational justice, it engenders perceived procedural fairness which makes it more likely an employee will be willing accept a decision that they may not like or disagree with the end result.

Even with great “tone at the top” and positive “mood in the middle”, you cannot stop. One of the greatest challenges of a compliance practitioner is how to impact the most front-line employees or the “tone at the bottom”. One of the things you can do is assemble a compliance focus group to find out how business is done in the field and if it differs from what your company expects from an ethical and compliance perspective. Begin by assembling a group of employees who are familiar with the challenges of doing business in a compliant manner in certain geographic regions to discuss the challenges of doing business ethically and in compliance. Ask them questions about their understanding of your compliance regime. Then categorize the answers into the theory and practice of compliance in your company.

More than ever in 2022, employees came to look to their direct supervisor to determine what the tone of an organization is and will be going forward. Many employees of large, multi-national organizations may never have direct contact with the CEO or even senior management. By moving the values of compliance through an organization into the middle, you will be in a much better position to inculcate these values and operationalizing compliance with them.

Three key takeaways:

1. Tone at the top—direct supervisors become the most important influence on people in the company

2. Give your middle managers a Tool Kit around compliance so they can fully operationalize compliance

3. Organizational justice is an additional way to help operationalize compliance

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 616 no Day 3 - Leadership’s Conduct at the Top DAG Lisa Monaco’s speech in September 2022 announcing the Monaco Memo as articulated in the Monaco Doctrine laid out the very basics of compliance; that the key to every company is culture. She stated, “corporate culture matters. A corporate culture that fails to hold individuals accountable, or fails to invest in compliance — or worse, that thumbs its nose at compliance — leads to bad results.” From the enforcement perspective, the DOJ will be assessing companies for the ethical cultures. From the compliance perspective, the ethical tone of a company and accountability all starts at the top and, most specifically, senior management. This requirement is more than simply the ubiquitous “tone-at-the-top,” as it focuses on the conduct of senior management. The DOJ wants to see a company’s senior leadership actually doing compliance. The DOJ asks if company leadership has, through their words and concrete actions, brought the right message of doing business ethically and in compliance to the organization. How does senior management model its behavior on a company’s values and finally, how is such conduct monitored in an organization? I once had a Chief Executive Officer (CEO), observe the following, “You want me to be the ambassador for compliance.” I immediately said yes, that is exactly what I need you to do. A CEO, as an “Ambassador of Compliance”, can fully model the conduct that senior management engage in going forward. Another area a CEO can forcefully engage an entire company is through a powerful video message about doing business the right way and in compliance. A great example was a CenterPoint Energy video put out in 2015 after the Volkswagen (VW) emissions-testing scandal became public. The video featured Scott Prochazka, CenterPoint Energy President and CEO. He used the VW scandal to proactively address culture and values at the company and used the entire scenario as an opportunity to promote integrity in the workplace. But more than simply a one-time video, the company followed up with an additional resource, entitled, Manager’s Toolkit—What does Integrity mean to you? that managers used to facilitate discussions and ongoing communications with employees around the company’s ethics and compliance programs. Finally, the cost for the video was quite reasonable as it was produced internally. Three key takeaways: 1. Senior management must actually do compliance; not simply talk-the-talk of compliance but also walk-the-walk. 2. Use your CEO to talk about current events and how those ethical failures are lessons to be learned for your organization. 3. Your CEO as Compliance Ambassador. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 03 Jan 2023 05:00:00 -0000 Day 3 - Leadership’s Conduct at the Top bonus 3 Thomas Fox In Day 3, the role of leadership in a compliance program. DAG Lisa Monaco’s speech in September 2022 announcing the Monaco Memo as articulated in the Monaco Doctrine laid out the very basics of compliance; that the key to every company is culture. She stated, “corporate culture matters. A corporate culture that fails to hold individuals accountable, or fails to invest in compliance — or worse, that thumbs its nose at compliance — leads to bad results.” From the enforcement perspective, the DOJ will be assessing companies for the ethical cultures. From the compliance perspective, the ethical tone of a company and accountability all starts at the top and, most specifically, senior management. This requirement is more than simply the ubiquitous “tone-at-the-top,” as it focuses on the conduct of senior management. The DOJ wants to see a company’s senior leadership actually doing compliance. The DOJ asks if company leadership has, through their words and concrete actions, brought the right message of doing business ethically and in compliance to the organization. How does senior management model its behavior on a company’s values and finally, how is such conduct monitored in an organization? I once had a Chief Executive Officer (CEO), observe the following, “You want me to be the ambassador for compliance.” I immediately said yes, that is exactly what I need you to do. A CEO, as an “Ambassador of Compliance”, can fully model the conduct that senior management engage in going forward. Another area a CEO can forcefully engage an entire company is through a powerful video message about doing business the right way and in compliance. A great example was a CenterPoint Energy video put out in 2015 after the Volkswagen (VW) emissions-testing scandal became public. The video featured Scott Prochazka, CenterPoint Energy President and CEO. He used the VW scandal to proactively address culture and values at the company and used the entire scenario as an opportunity to promote integrity in the workplace. But more than simply a one-time video, the company followed up with an additional resource, entitled, Manager’s Toolkit—What does Integrity mean to you? that managers used to facilitate discussions and ongoing communications with employees around the company’s ethics and compliance programs. Finally, the cost for the video was quite reasonable as it was produced internally. Three key takeaways: 1. Senior management must actually do compliance; not simply talk-the-talk of compliance but also walk-the-walk. 2. Use your CEO to talk about current events and how those ethical failures are lessons to be learned for your organization. 3. Your CEO as Compliance Ambassador. Learn more about your ad choices. Visit megaphone.fm/adchoices DAG Lisa Monaco’s speech in September 2022 announcing the Monaco Memo as articulated in the Monaco Doctrine laid out the very basics of compliance; that the key to every company is culture. She stated, “corporate culture matters. A corporate culture that fails to hold individuals accountable, or fails to invest in compliance — or worse, that thumbs its nose at compliance — leads to bad results.”

From the enforcement perspective, the DOJ will be assessing companies for the ethical cultures. From the compliance perspective, the ethical tone of a company and accountability all starts at the top and, most specifically, senior management. This requirement is more than simply the ubiquitous “tone-at-the-top,” as it focuses on the conduct of senior management. The DOJ wants to see a company’s senior leadership actually doing compliance. The DOJ asks if company leadership has, through their words and concrete actions, brought the right message of doing business ethically and in compliance to the organization. How does senior management model its behavior on a company’s values and finally, how is such conduct monitored in an organization?

I once had a Chief Executive Officer (CEO), observe the following, “You want me to be the ambassador for compliance.” I immediately said yes, that is exactly what I need you to do. A CEO, as an “Ambassador of Compliance”, can fully model the conduct that senior management engage in going forward. Another area a CEO can forcefully engage an entire company is through a powerful video message about doing business the right way and in compliance. A great example was a CenterPoint Energy video put out in 2015 after the Volkswagen (VW) emissions-testing scandal became public. The video featured Scott Prochazka, CenterPoint Energy President and CEO. He used the VW scandal to proactively address culture and values at the company and used the entire scenario as an opportunity to promote integrity in the workplace. But more than simply a one-time video, the company followed up with an additional resource, entitled, Manager’s Toolkit—What does Integrity mean to you? that managers used to facilitate discussions and ongoing communications with employees around the company’s ethics and compliance programs. Finally, the cost for the video was quite reasonable as it was produced internally.

Three key takeaways:

1. Senior management must actually do compliance; not simply talk-the-talk of compliance but also walk-the-walk.

2. Use your CEO to talk about current events and how those ethical failures are lessons to be learned for your organization.

3. Your CEO as Compliance Ambassador.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 616 no Day 2 - Continuous Monitoring and Continuous Improvement Continuous monitoring and improvement are two of the most important phrases for any compliance program. These twin concepts were perhaps the biggest modifications in the 2020 Update to the Evaluation of Corporate Compliance Programs. In 2021 and 2022, all companies’ risks changed as we moved from Working From Home to Return To Office and now a hybrid work model. Of course the great resignation has also played a part.These changes in our basic work location drove home perhaps the most prescient comment I heard during the pandemic, which was by Jed Gardner, who said, “We have moved from disaster recovery to business continuity to business as usual.” This means that risks will change in ways you may not see at speeds you do not anticipate. Your compliance program must be ready to respond to whatever those risks might be going forward. In the 2020 Update, the DOJ began to address this from the compliance program perspective with several questions. “Is the risk assessment current and subject to periodic review? Is the periodic review limited to a “snapshot” in time or based upon continuous access to operational data and information across functions? Has the periodic review led to updates in policies, procedures, and controls? Do these updates account for risks discovered through misconduct or other problems with the compliance program?” The next area for continuous monitoring and improvement was an area of compliance that is not normally associated with those concepts, Policies, and Procedures. Here questions included “When was the last time your policies and procedures were updated? Perhaps more importantly, under the 2020 Update, what was your process for doing so? Was there any rigor around your process? Did that rigor include incorporating information and data collected through continuous monitoring, real-time monitoring, or continuous access to operational data and information across functions?” The final area in the 2020 Update for consideration is called Continuous Improvement, Periodic Testing, and Review. The question included the following, “How often has the company updated its risk assessments and reviewed its compliance policies, procedures, and practices? Has the company undertaken a gap analysis to determine if particular risk areas are not sufficiently addressed in its policies, controls, or training? What steps has the company taken to determine whether policies/procedures/practices make sense for particular business segments/subsidiaries? Does the company review and adapt its compliance program based on lessons learned from its misconduct and/or other companies facing similar risks?” Three key takeaways: 1. How has your company’s risks changed over the past year? 2. What is your process for continuous monitoring and improvement? 3. What sources of information do you use that come from outside your organization? Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 02 Jan 2023 11:57:00 -0000 Day 2 - Continuous Monitoring and Continuous Improvement bonus 2 Thomas Fox In Day 2, we consider continuous monitoring and continuous improvement. Continuous monitoring and improvement are two of the most important phrases for any compliance program. These twin concepts were perhaps the biggest modifications in the 2020 Update to the Evaluation of Corporate Compliance Programs. In 2021 and 2022, all companies’ risks changed as we moved from Working From Home to Return To Office and now a hybrid work model. Of course the great resignation has also played a part.These changes in our basic work location drove home perhaps the most prescient comment I heard during the pandemic, which was by Jed Gardner, who said, “We have moved from disaster recovery to business continuity to business as usual.” This means that risks will change in ways you may not see at speeds you do not anticipate. Your compliance program must be ready to respond to whatever those risks might be going forward. In the 2020 Update, the DOJ began to address this from the compliance program perspective with several questions. “Is the risk assessment current and subject to periodic review? Is the periodic review limited to a “snapshot” in time or based upon continuous access to operational data and information across functions? Has the periodic review led to updates in policies, procedures, and controls? Do these updates account for risks discovered through misconduct or other problems with the compliance program?” The next area for continuous monitoring and improvement was an area of compliance that is not normally associated with those concepts, Policies, and Procedures. Here questions included “When was the last time your policies and procedures were updated? Perhaps more importantly, under the 2020 Update, what was your process for doing so? Was there any rigor around your process? Did that rigor include incorporating information and data collected through continuous monitoring, real-time monitoring, or continuous access to operational data and information across functions?” The final area in the 2020 Update for consideration is called Continuous Improvement, Periodic Testing, and Review. The question included the following, “How often has the company updated its risk assessments and reviewed its compliance policies, procedures, and practices? Has the company undertaken a gap analysis to determine if particular risk areas are not sufficiently addressed in its policies, controls, or training? What steps has the company taken to determine whether policies/procedures/practices make sense for particular business segments/subsidiaries? Does the company review and adapt its compliance program based on lessons learned from its misconduct and/or other companies facing similar risks?” Three key takeaways: 1. How has your company’s risks changed over the past year? 2. What is your process for continuous monitoring and improvement? 3. What sources of information do you use that come from outside your organization? Learn more about your ad choices. Visit megaphone.fm/adchoices Continuous monitoring and improvement are two of the most important phrases for any compliance program. These twin concepts were perhaps the biggest modifications in the 2020 Update to the Evaluation of Corporate Compliance Programs. In 2021 and 2022, all companies’ risks changed as we moved from Working From Home to Return To Office and now a hybrid work model. Of course the great resignation has also played a part.These changes in our basic work location drove home perhaps the most prescient comment I heard during the pandemic, which was by Jed Gardner, who said, “We have moved from disaster recovery to business continuity to business as usual.” This means that risks will change in ways you may not see at speeds you do not anticipate. Your compliance program must be ready to respond to whatever those risks might be going forward.

In the 2020 Update, the DOJ began to address this from the compliance program perspective with several questions. “Is the risk assessment current and subject to periodic review? Is the periodic review limited to a “snapshot” in time or based upon continuous access to operational data and information across functions? Has the periodic review led to updates in policies, procedures, and controls? Do these updates account for risks discovered through misconduct or other problems with the compliance program?”

The next area for continuous monitoring and improvement was an area of compliance that is not normally associated with those concepts, Policies, and Procedures. Here questions included “When was the last time your policies and procedures were updated? Perhaps more importantly, under the 2020 Update, what was your process for doing so? Was there any rigor around your process? Did that rigor include incorporating information and data collected through continuous monitoring, real-time monitoring, or continuous access to operational data and information across functions?”

The final area in the 2020 Update for consideration is called Continuous Improvement, Periodic Testing, and Review. The question included the following, “How often has the company updated its risk assessments and reviewed its compliance policies, procedures, and practices? Has the company undertaken a gap analysis to determine if particular risk areas are not sufficiently addressed in its policies, controls, or training? What steps has the company taken to determine whether policies/procedures/practices make sense for particular business segments/subsidiaries? Does the company review and adapt its compliance program based on lessons learned from its misconduct and/or other companies facing similar risks?”

Three key takeaways:

1. How has your company’s risks changed over the past year?

2. What is your process for continuous monitoring and improvement?

3. What sources of information do you use that come from outside your organization?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 616 no Day 1 - What 2022 Brought To Compliance Programs Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2023, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance.  2022 was a very significant year for every compliance practitioner and compliance program. While there was a paucity of corporate FCPA enforcement actions, there were three enforcement actions were significant with multiple lessons for the compliance professional. In ABB, we learned about the costs of a corrupt culture and recidivism, in Glencore, we saw happens to a company which engages in worldwide, systemic bribery and corruption. Finally, in Stericycle, the company had a culture of corruption burned into the DNA of the LATAM business unit which was so thorough that it was documented via bribery spreadsheets and analysis of revenue based on payments of bribes in LATAM. Yet even with this corrupt culture, the Stericycle enforcement action demonstrated how a company can take advantage of the discounts available under the FCPA Corporate Enforcement Policy by extensive cooperation and remediation during the pendency of the FCPA investigation, as the company obtained a 25% reduction off the bottom of the applicable US Sentencing Guidelines fine range. September saw the announcement of a significant refinement of Department of Justice (DOJ) enforcement policies on the around Foreign Corrupt Practices Act (FCPA) enforcement and corporate compliance programs. It was encapsulated in the Monaco Memo and a speech by Deputy Attorney General Lisa Monaco announcing the Monaco Doctrine. There was also additional commentary by Principal Associate Deputy Attorney General Marshall Miller, in a speech and a speech by Assistant Attorney General Kenneth A. Polite. Every compliance professional should all of them in detail as they significantly turn the heat up on corporate compliance programs. The Monaco Memo is both further clarification and further guidance for line prosecutors when they are considering whether to put a monitor in place. While we have seen these factors in a disparate manner, in disparate places, here they are in writing. Perhaps the greatest significance is that the Memo sets down all these matters in writing which leads to a blueprint for DOJ thinking and a roadmap for anyone who finds themselves in an FCPA investigation or enforcement action. Finally, the Monaco Memo cemented the new DOJ requirement for CCO certification of compliance programs at the end of a resolution. The final key event for compliance in 2022 was very much under the radar. It was the DOJ hiring of Matt Galvan to help develop a data analytics expertise and capability for the FCPA Unit and the Fraud Section. Galvan was most recently the CCO at AB InBev and perhaps the top compliance profession in the use of data analytics for a corporate compliance program. It will be most interesting to see where Galvan and the DOJ take this initiative, but it does portend the increasing use of data analytics in FCPA enforcement and compliance.   Three key takeaways: 1. Key FCPA cases in 2022 were Glencore, ABB and Stericyle. 2. The Monaco Memo refocused the DOJ’s efforts on FCPA and other white-collar crime and put the heat on compliance programs. 3. The DOJ’s hiring of Matt Galvan will focus the DOJ expertise in data analytics and their employment in compliance programs. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 01 Jan 2023 05:00:00 -0000 What 2022 Brought To Compliance Programs full Thomas Fox Welcome to Day 1 of 31 days to a more effective compliance program. In this series, you will learn steps and action items you can take at little to no charge to improve your compliance program. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2023, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance.  2022 was a very significant year for every compliance practitioner and compliance program. While there was a paucity of corporate FCPA enforcement actions, there were three enforcement actions were significant with multiple lessons for the compliance professional. In ABB, we learned about the costs of a corrupt culture and recidivism, in Glencore, we saw happens to a company which engages in worldwide, systemic bribery and corruption. Finally, in Stericycle, the company had a culture of corruption burned into the DNA of the LATAM business unit which was so thorough that it was documented via bribery spreadsheets and analysis of revenue based on payments of bribes in LATAM. Yet even with this corrupt culture, the Stericycle enforcement action demonstrated how a company can take advantage of the discounts available under the FCPA Corporate Enforcement Policy by extensive cooperation and remediation during the pendency of the FCPA investigation, as the company obtained a 25% reduction off the bottom of the applicable US Sentencing Guidelines fine range. September saw the announcement of a significant refinement of Department of Justice (DOJ) enforcement policies on the around Foreign Corrupt Practices Act (FCPA) enforcement and corporate compliance programs. It was encapsulated in the Monaco Memo and a speech by Deputy Attorney General Lisa Monaco announcing the Monaco Doctrine. There was also additional commentary by Principal Associate Deputy Attorney General Marshall Miller, in a speech and a speech by Assistant Attorney General Kenneth A. Polite. Every compliance professional should all of them in detail as they significantly turn the heat up on corporate compliance programs. The Monaco Memo is both further clarification and further guidance for line prosecutors when they are considering whether to put a monitor in place. While we have seen these factors in a disparate manner, in disparate places, here they are in writing. Perhaps the greatest significance is that the Memo sets down all these matters in writing which leads to a blueprint for DOJ thinking and a roadmap for anyone who finds themselves in an FCPA investigation or enforcement action. Finally, the Monaco Memo cemented the new DOJ requirement for CCO certification of compliance programs at the end of a resolution. The final key event for compliance in 2022 was very much under the radar. It was the DOJ hiring of Matt Galvan to help develop a data analytics expertise and capability for the FCPA Unit and the Fraud Section. Galvan was most recently the CCO at AB InBev and perhaps the top compliance profession in the use of data analytics for a corporate compliance program. It will be most interesting to see where Galvan and the DOJ take this initiative, but it does portend the increasing use of data analytics in FCPA enforcement and compliance.   Three key takeaways: 1. Key FCPA cases in 2022 were Glencore, ABB and Stericyle. 2. The Monaco Memo refocused the DOJ’s efforts on FCPA and other white-collar crime and put the heat on compliance programs. 3. The DOJ’s hiring of Matt Galvan will focus the DOJ expertise in data analytics and their employment in compliance programs. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2023, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance. 

2022 was a very significant year for every compliance practitioner and compliance program. While there was a paucity of corporate FCPA enforcement actions, there were three enforcement actions were significant with multiple lessons for the compliance professional. In ABB, we learned about the costs of a corrupt culture and recidivism, in Glencore, we saw happens to a company which engages in worldwide, systemic bribery and corruption. Finally, in Stericycle, the company had a culture of corruption burned into the DNA of the LATAM business unit which was so thorough that it was documented via bribery spreadsheets and analysis of revenue based on payments of bribes in LATAM. Yet even with this corrupt culture, the Stericycle enforcement action demonstrated how a company can take advantage of the discounts available under the FCPA Corporate Enforcement Policy by extensive cooperation and remediation during the pendency of the FCPA investigation, as the company obtained a 25% reduction off the bottom of the applicable US Sentencing Guidelines fine range.

September saw the announcement of a significant refinement of Department of Justice (DOJ) enforcement policies on the around Foreign Corrupt Practices Act (FCPA) enforcement and corporate compliance programs. It was encapsulated in the Monaco Memo and a speech by Deputy Attorney General Lisa Monaco announcing the Monaco Doctrine. There was also additional commentary by Principal Associate Deputy Attorney General Marshall Miller, in a speech and a speech by Assistant Attorney General Kenneth A. Polite. Every compliance professional should all of them in detail as they significantly turn the heat up on corporate compliance programs. The Monaco Memo is both further clarification and further guidance for line prosecutors when they are considering whether to put a monitor in place. While we have seen these factors in a disparate manner, in disparate places, here they are in writing. Perhaps the greatest significance is that the Memo sets down all these matters in writing which leads to a blueprint for DOJ thinking and a roadmap for anyone who finds themselves in an FCPA investigation or enforcement action. Finally, the Monaco Memo cemented the new DOJ requirement for CCO certification of compliance programs at the end of a resolution.

The final key event for compliance in 2022 was very much under the radar. It was the DOJ hiring of Matt Galvan to help develop a data analytics expertise and capability for the FCPA Unit and the Fraud Section. Galvan was most recently the CCO at AB InBev and perhaps the top compliance profession in the use of data analytics for a corporate compliance program. It will be most interesting to see where Galvan and the DOJ take this initiative, but it does portend the increasing use of data analytics in FCPA enforcement and compliance. 


 Three key takeaways:

1. Key FCPA cases in 2022 were Glencore, ABB and Stericyle.

2. The Monaco Memo refocused the DOJ’s efforts on FCPA and other white-collar crime and put the heat on compliance programs.

3. The DOJ’s hiring of Matt Galvan will focus the DOJ expertise in data analytics and their employment in compliance programs.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 616 Day 31 - Using a root cause analysis for remediation The 2020 Update re-emphasized the need for both performing a root cause analysis but equally importantly using it to remediate your compliance program. It stated, “a hallmark of a compliance program that is working effectively in practice is the extent to which a company is able to conduct a thoughtful root cause analysis of misconduct and timely and appropriately remediate to address the root causes.” It went on to state, what additional steps the company has taken “that demonstrate recognition of the seriousness of the misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risk”).” The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Identify current and future needs for organizational improvement. Your solution should be a repeatable, step-by-step processes, in which one process can confirm the results of another. Focusing on the corrective measures of root causes is more effective than simply treating the symptoms of a problem or event and you will have a much more robust solution in place. This is because the solution(s) are more effective when accomplished through a systematic process with conclusions backed up by evidence. When you step back and consider what the DOJ was trying to accomplish with its 2020 Update, it becomes clear what the DOJ expects from the compliance professional. Consider the structure of your compliance program and how it inter-relates to your company’s risk profile. When you have a compliance failure, use the root cause analysis to think about how each of the structural elements of your compliance program could impact how you manage and deal with that risk. Three key takeaways: The key is objectivity and independence. The critical element is how did you use the information you developed in the root cause analysis? The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 31 Jan 2022 05:00:00 -0000 Day 31 - Using a root cause analysis for remediation full Thomas Fox In Day 31 of 31 Days to a More Effective Compliance Program we discuss using a root cause analysis for compliance program remediation. The 2020 Update re-emphasized the need for both performing a root cause analysis but equally importantly using it to remediate your compliance program. It stated, “a hallmark of a compliance program that is working effectively in practice is the extent to which a company is able to conduct a thoughtful root cause analysis of misconduct and timely and appropriately remediate to address the root causes.” It went on to state, what additional steps the company has taken “that demonstrate recognition of the seriousness of the misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risk”).” The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Identify current and future needs for organizational improvement. Your solution should be a repeatable, step-by-step processes, in which one process can confirm the results of another. Focusing on the corrective measures of root causes is more effective than simply treating the symptoms of a problem or event and you will have a much more robust solution in place. This is because the solution(s) are more effective when accomplished through a systematic process with conclusions backed up by evidence. When you step back and consider what the DOJ was trying to accomplish with its 2020 Update, it becomes clear what the DOJ expects from the compliance professional. Consider the structure of your compliance program and how it inter-relates to your company’s risk profile. When you have a compliance failure, use the root cause analysis to think about how each of the structural elements of your compliance program could impact how you manage and deal with that risk. Three key takeaways: The key is objectivity and independence. The critical element is how did you use the information you developed in the root cause analysis? The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2020 Update re-emphasized the need for both performing a root cause analysis but equally importantly using it to remediate your compliance program. It stated, “a hallmark of a compliance program that is working effectively in practice is the extent to which a company is able to conduct a thoughtful root cause analysis of misconduct and timely and appropriately remediate to address the root causes.”

It went on to state, what additional steps the company has taken “that demonstrate recognition of the seriousness of the misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risk”).”

The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Identify current and future needs for organizational improvement. Your solution should be a repeatable, step-by-step processes, in which one process can confirm the results of another. Focusing on the corrective measures of root causes is more effective than simply treating the symptoms of a problem or event and you will have a much more robust solution in place. This is because the solution(s) are more effective when accomplished through a systematic process with conclusions backed up by evidence.

When you step back and consider what the DOJ was trying to accomplish with its 2020 Update, it becomes clear what the DOJ expects from the compliance professional. Consider the structure of your compliance program and how it inter-relates to your company’s risk profile. When you have a compliance failure, use the root cause analysis to think about how each of the structural elements of your compliance program could impact how you manage and deal with that risk.

Three key takeaways:

  1. The key is objectivity and independence.
  2. The critical element is how did you use the information you developed in the root cause analysis?
  3. The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 530 no Day 30 - What is a root cause analysis? One of the biggest changes in the 2020 FCPA Resource Guide is the addition of a new Hallmark, entitled “Investigation, Analysis, and Remediation of Misconduct”, which reads in full: The truest measure of an effective compliance program is how it responds to misconduct. Accordingly, for a compliance program to be truly effective, it should have a well-functioning and appropriately funded mechanism for the timely and thorough investigations of any allegations or suspicions of misconduct by the company, its employees, or agents. An effective investigations structure will also have an established means of documenting the company’s response, including any disciplinary or remediation measures taken. In addition to having a mechanism for responding to the specific incident of misconduct, the company’s program should also integrate lessons learned from any misconduct into the company’s policies, training, and controls. To do so, a company will need to analyze the root causes of the misconduct to timely and appropriately remediate those causes to prevent future compliance breaches.  Ultimately, performing a root cause analysis is not simply a matter of sitting down and asking a multitude of questions. You need to have an operational understanding of how a business operates and how they have developed their customer base. Overlay the need to understand what makes an effective compliance program, with the skepticism an auditor should bring so that you do not simply accept an answer that is provided to you, as you might in an internal investigation. As Marks noted, “a root cause analysis is not something where you can just go ask the five whys. You need these trained professionals who really understand what they’re doing.” Three key takeaways: A root cause analysis is now required if you have a reportable compliance failure. There is no one process for performing a root cause analysis. You should select the one which works for you and follow it. To properly perform a root cause analysis, you need trained professionals who really understand what they’re doing. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 30 Jan 2022 05:00:00 -0000 What Is a Root Cause Analysis? bonus 30 Thomas Fox In Day 30 of 31 Days to a More Effective Compliance Program we consider root cause analysis. One of the biggest changes in the 2020 FCPA Resource Guide is the addition of a new Hallmark, entitled “Investigation, Analysis, and Remediation of Misconduct”, which reads in full: The truest measure of an effective compliance program is how it responds to misconduct. Accordingly, for a compliance program to be truly effective, it should have a well-functioning and appropriately funded mechanism for the timely and thorough investigations of any allegations or suspicions of misconduct by the company, its employees, or agents. An effective investigations structure will also have an established means of documenting the company’s response, including any disciplinary or remediation measures taken. In addition to having a mechanism for responding to the specific incident of misconduct, the company’s program should also integrate lessons learned from any misconduct into the company’s policies, training, and controls. To do so, a company will need to analyze the root causes of the misconduct to timely and appropriately remediate those causes to prevent future compliance breaches.  Ultimately, performing a root cause analysis is not simply a matter of sitting down and asking a multitude of questions. You need to have an operational understanding of how a business operates and how they have developed their customer base. Overlay the need to understand what makes an effective compliance program, with the skepticism an auditor should bring so that you do not simply accept an answer that is provided to you, as you might in an internal investigation. As Marks noted, “a root cause analysis is not something where you can just go ask the five whys. You need these trained professionals who really understand what they’re doing.” Three key takeaways: A root cause analysis is now required if you have a reportable compliance failure. There is no one process for performing a root cause analysis. You should select the one which works for you and follow it. To properly perform a root cause analysis, you need trained professionals who really understand what they’re doing. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the biggest changes in the 2020 FCPA Resource Guide is the addition of a new Hallmark, entitled “Investigation, Analysis, and Remediation of Misconduct”, which reads in full:

The truest measure of an effective compliance program is how it responds to misconduct. Accordingly, for a compliance program to be truly effective, it should have a well-functioning and appropriately funded mechanism for the timely and thorough investigations of any allegations or suspicions of misconduct by the company, its employees, or agents. An effective investigations structure will also have an established means of documenting the company’s response, including any disciplinary or remediation measures taken.

In addition to having a mechanism for responding to the specific incident of misconduct, the company’s program should also integrate lessons learned from any misconduct into the company’s policies, training, and controls. To do so, a company will need to analyze the root causes of the misconduct to timely and appropriately remediate those causes to prevent future compliance breaches. 

Ultimately, performing a root cause analysis is not simply a matter of sitting down and asking a multitude of questions. You need to have an operational understanding of how a business operates and how they have developed their customer base. Overlay the need to understand what makes an effective compliance program, with the skepticism an auditor should bring so that you do not simply accept an answer that is provided to you, as you might in an internal investigation. As Marks noted, “a root cause analysis is not something where you can just go ask the five whys. You need these trained professionals who really understand what they’re doing.”

Three key takeaways:

  1. A root cause analysis is now required if you have a reportable compliance failure.
  2. There is no one process for performing a root cause analysis. You should select the one which works for you and follow it.
  3. To properly perform a root cause analysis, you need trained professionals who really understand what they’re doing.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 527 no Day 29 - Post-acquisition integration plan Your company has just made its largest acquisition ever and your CEO says they want you to have a compliance post-acquisition integration plan on their desk in one week. Where do you begin? A good place to start would be the 2020 FCPA Resource Guide language: Pre-acquisition due diligence, however, is normally only a portion of the compliance process for mergers and acquisitions. DOJ and SEC evaluate whether the acquiring company promptly incorporated the acquired company into all of its internal controls, including its compliance program. Companies should consider training new employees, reevaluating third parties under company standards, and, where appropriate, conducting audits on new business units. The bottom line is that you must train the newly acquired employees, reevaluate third parties under your company standards, and conduct compliance audits on new business units. This process should be based your pre-acquisition due diligence and risk assessment. Moreover, the DOJ and SEC clearly view both the pre- and post-acquisition phases of M&A as tied together in a unidimensional continuum. If pre-acquisition due diligence is not possible, you should review the requirements and time frames laid out in Opinion Release 08-02 or the 2020 FCPA Resource Guide, which noted, “pursuant to which companies can nevertheless be rewarded if they choose to conduct thorough post-acquisition FCPA due diligence.” Whatever compendium of steps you utilize for post-acquisition integration, they should be taken as soon as is practicable.  The earlier you can deploy these steps the better off your company will be at the end of the day. An acquisition that fails for compliance reasons is a preventable disaster of the first order. One need only consider the Latin Node Inc. FCPA enforcement actions where the acquiring company had to write off its entire investment because it had wholly failed to engage in appropriate pre-acquisition due diligence.  Three key takeaways: Planning is critical in the post-acquisition phase. Build upon what you learned in pre-acquisition due diligence. You literally need to be ready to hit the ground running when a transaction closes. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 29 Jan 2022 05:00:00 -0000 Post-acquisition Integration Plan bonus 29 Thomas Fox In Day 29 of 31 Days to a More Effective Compliance Program we review post-acquisition Integration plan in M&A. Your company has just made its largest acquisition ever and your CEO says they want you to have a compliance post-acquisition integration plan on their desk in one week. Where do you begin? A good place to start would be the 2020 FCPA Resource Guide language: Pre-acquisition due diligence, however, is normally only a portion of the compliance process for mergers and acquisitions. DOJ and SEC evaluate whether the acquiring company promptly incorporated the acquired company into all of its internal controls, including its compliance program. Companies should consider training new employees, reevaluating third parties under company standards, and, where appropriate, conducting audits on new business units. The bottom line is that you must train the newly acquired employees, reevaluate third parties under your company standards, and conduct compliance audits on new business units. This process should be based your pre-acquisition due diligence and risk assessment. Moreover, the DOJ and SEC clearly view both the pre- and post-acquisition phases of M&A as tied together in a unidimensional continuum. If pre-acquisition due diligence is not possible, you should review the requirements and time frames laid out in Opinion Release 08-02 or the 2020 FCPA Resource Guide, which noted, “pursuant to which companies can nevertheless be rewarded if they choose to conduct thorough post-acquisition FCPA due diligence.” Whatever compendium of steps you utilize for post-acquisition integration, they should be taken as soon as is practicable.  The earlier you can deploy these steps the better off your company will be at the end of the day. An acquisition that fails for compliance reasons is a preventable disaster of the first order. One need only consider the Latin Node Inc. FCPA enforcement actions where the acquiring company had to write off its entire investment because it had wholly failed to engage in appropriate pre-acquisition due diligence.  Three key takeaways: Planning is critical in the post-acquisition phase. Build upon what you learned in pre-acquisition due diligence. You literally need to be ready to hit the ground running when a transaction closes. Learn more about your ad choices. Visit megaphone.fm/adchoices Your company has just made its largest acquisition ever and your CEO says they want you to have a compliance post-acquisition integration plan on their desk in one week. Where do you begin? A good place to start would be the 2020 FCPA Resource Guide language:

Pre-acquisition due diligence, however, is normally only a portion of the compliance process for mergers and acquisitions. DOJ and SEC evaluate whether the acquiring company promptly incorporated the acquired company into all of its internal controls, including its compliance program. Companies should consider training new employees, reevaluating third parties under company standards, and, where appropriate, conducting audits on new business units.

The bottom line is that you must train the newly acquired employees, reevaluate third parties under your company standards, and conduct compliance audits on new business units. This process should be based your pre-acquisition due diligence and risk assessment. Moreover, the DOJ and SEC clearly view both the pre- and post-acquisition phases of M&A as tied together in a unidimensional continuum. If pre-acquisition due diligence is not possible, you should review the requirements and time frames laid out in Opinion Release 08-02 or the 2020 FCPA Resource Guide, which noted, “pursuant to which companies can nevertheless be rewarded if they choose to conduct thorough post-acquisition FCPA due diligence.” Whatever compendium of steps you utilize for post-acquisition integration, they should be taken as soon as is practicable. 

The earlier you can deploy these steps the better off your company will be at the end of the day. An acquisition that fails for compliance reasons is a preventable disaster of the first order. One need only consider the Latin Node Inc. FCPA enforcement actions where the acquiring company had to write off its entire investment because it had wholly failed to engage in appropriate pre-acquisition due diligence.

 Three key takeaways:

  1. Planning is critical in the post-acquisition phase.
  2. Build upon what you learned in pre-acquisition due diligence.
  3. You literally need to be ready to hit the ground running when a transaction closes.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 528 no Day 28 - Pre-acquisition due diligence in mergers and acquisitions A company that does not perform adequate due diligence prior to a merger or acquisition may face both legal and business risks. Perhaps most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. While most compliance practitioners have been long aware of the requirement in the post-acquisition context, the 2012 FCPA Guidance focused many compliance practitioners of the need to engage in robust pre-acquisition due diligence.  The 2020 Update made even more clear the need for a robust compliance presence in the pre-acquisition phase. It stated, “A well-designed compliance program should include comprehensive due diligence of any acquisition targets, as well as a process for timely and orderly integration of the acquired entity into existing compliance program structures and internal controls. Pre-M&A due diligence, where possible, enables the acquiring company to evaluate more accurately each target’s value and negotiate for the costs of any corruption or misconduct to be borne by the target. Flawed or incomplete pre- or post-acquisition due diligence and integration can allow misconduct to continue at the target company, causing resulting harm to a business’s profitability and reputation and risking civil and criminal liability.” There are multiple red flags which could be raised in this process, which might well warrant further investigation. They include if the target has ineffective compliance program elements in their compliance program or if there were frequent breach of policies and procedures. Obviously, a target which is in financial difficulty would bear closer scrutiny. Structurally, if the company did not have a formal ethics and compliance committee at the senior management or Board of Directors’ level, this could present issues. From the CCO perspective, if the position did not have Board or CEO access or if there were not regular reports to the Board, it could present an issue for compliance. Conversely, if there were frequent requests to waive policies, management over-ride of compliance controls or no consistent consequence management for violations; it could present clear red flags for further investigation. Three key takeaways:  The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward. Periodically review your M&A due diligence protocol. If red flags appear in pre-acquisition due diligence, they should be cleared. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 28 Jan 2022 05:00:00 -0000 Pre-acquisition Due Diligence in Mergers and Acquisitions bonus 29 Thomas Fox In Day 28 of 31 Days to a More Effective Compliance Program we review pre-acquisition due diligence in M&A. A company that does not perform adequate due diligence prior to a merger or acquisition may face both legal and business risks. Perhaps most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. While most compliance practitioners have been long aware of the requirement in the post-acquisition context, the 2012 FCPA Guidance focused many compliance practitioners of the need to engage in robust pre-acquisition due diligence.  The 2020 Update made even more clear the need for a robust compliance presence in the pre-acquisition phase. It stated, “A well-designed compliance program should include comprehensive due diligence of any acquisition targets, as well as a process for timely and orderly integration of the acquired entity into existing compliance program structures and internal controls. Pre-M&A due diligence, where possible, enables the acquiring company to evaluate more accurately each target’s value and negotiate for the costs of any corruption or misconduct to be borne by the target. Flawed or incomplete pre- or post-acquisition due diligence and integration can allow misconduct to continue at the target company, causing resulting harm to a business’s profitability and reputation and risking civil and criminal liability.” There are multiple red flags which could be raised in this process, which might well warrant further investigation. They include if the target has ineffective compliance program elements in their compliance program or if there were frequent breach of policies and procedures. Obviously, a target which is in financial difficulty would bear closer scrutiny. Structurally, if the company did not have a formal ethics and compliance committee at the senior management or Board of Directors’ level, this could present issues. From the CCO perspective, if the position did not have Board or CEO access or if there were not regular reports to the Board, it could present an issue for compliance. Conversely, if there were frequent requests to waive policies, management over-ride of compliance controls or no consistent consequence management for violations; it could present clear red flags for further investigation. Three key takeaways:  The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward. Periodically review your M&A due diligence protocol. If red flags appear in pre-acquisition due diligence, they should be cleared. Learn more about your ad choices. Visit megaphone.fm/adchoices A company that does not perform adequate due diligence prior to a merger or acquisition may face both legal and business risks. Perhaps most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. While most compliance practitioners have been long aware of the requirement in the post-acquisition context, the 2012 FCPA Guidance focused many compliance practitioners of the need to engage in robust pre-acquisition due diligence. 

The 2020 Update made even more clear the need for a robust compliance presence in the pre-acquisition phase. It stated, “A well-designed compliance program should include comprehensive due diligence of any acquisition targets, as well as a process for timely and orderly integration of the acquired entity into existing compliance program structures and internal controls. Pre-M&A due diligence, where possible, enables the acquiring company to evaluate more accurately each target’s value and negotiate for the costs of any corruption or misconduct to be borne by the target. Flawed or incomplete pre- or post-acquisition due diligence and integration can allow misconduct to continue at the target company, causing resulting harm to a business’s profitability and reputation and risking civil and criminal liability.”

There are multiple red flags which could be raised in this process, which might well warrant further investigation. They include if the target has ineffective compliance program elements in their compliance program or if there were frequent breach of policies and procedures. Obviously, a target which is in financial difficulty would bear closer scrutiny. Structurally, if the company did not have a formal ethics and compliance committee at the senior management or Board of Directors’ level, this could present issues. From the CCO perspective, if the position did not have Board or CEO access or if there were not regular reports to the Board, it could present an issue for compliance. Conversely, if there were frequent requests to waive policies, management over-ride of compliance controls or no consistent consequence management for violations; it could present clear red flags for further investigation.

Three key takeaways: 

  1. The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward.
  2. Periodically review your M&A due diligence protocol.
  3. If red flags appear in pre-acquisition due diligence, they should be cleared.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 528 no Day 27- Operationalizing Compliance Through Payroll One of the areas articulated in the 2020 Update was around payments and payroll. For the both the compliance professional and the corporate payroll function, there is a significant role to play in the operationalization of a corporate compliance program. The 2020 Update was replete with references to payment and its critical nature to any best practices compliance program. This includes references to payments to foreign officials, payments to third parties and hiding bribes in payments to distributors. The 2020 Update begins with an admonition to stop wasting time on low hanging fruit when there are much higher risks in your business operations. The role of payroll in compliance is not often considered in operationalizing your compliance program, yet the monies to fund bribes must come from somewhere. Unfortunately, one of those places is out of payroll. All CCOs need to sit down with his or her head of payroll, have them explain the role of payroll, then review the internal controls in place to see how they facilitate the goals of compliance. From that review, you can then determine how to use payroll to help to operationalize your compliance program. The DOJ has now provided its clearest statement on how it expects a company to actually do compliance going forward. Long gone are the days where the DOJ simply considered the inputs of a written program as sufficient to protect companies from compliance violations. Yet the mandate to operationalize a corporate compliance program drives home the concept that compliance is a business process, which should be administered by the appropriate business unit with the requisite SME. When it comes to following the money, payroll is the most well-suited corporate discipline to provide this first level of oversight and controls.  Three key takeaways: Payroll can be a key prevent and detect control. The 2020 Update specified the tying of the corporate compliance function to the corporate payroll function. Offshore payments remain a key indicator for a red flag. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 27 Jan 2022 05:00:00 -0000 Operationalizing Compliance Through Payroll bonus 27 Thomas Fox In Day 27 of 31 Days to a More Effective Compliance Program we consider operationalizing your compliance program through your payroll function. One of the areas articulated in the 2020 Update was around payments and payroll. For the both the compliance professional and the corporate payroll function, there is a significant role to play in the operationalization of a corporate compliance program. The 2020 Update was replete with references to payment and its critical nature to any best practices compliance program. This includes references to payments to foreign officials, payments to third parties and hiding bribes in payments to distributors. The 2020 Update begins with an admonition to stop wasting time on low hanging fruit when there are much higher risks in your business operations. The role of payroll in compliance is not often considered in operationalizing your compliance program, yet the monies to fund bribes must come from somewhere. Unfortunately, one of those places is out of payroll. All CCOs need to sit down with his or her head of payroll, have them explain the role of payroll, then review the internal controls in place to see how they facilitate the goals of compliance. From that review, you can then determine how to use payroll to help to operationalize your compliance program. The DOJ has now provided its clearest statement on how it expects a company to actually do compliance going forward. Long gone are the days where the DOJ simply considered the inputs of a written program as sufficient to protect companies from compliance violations. Yet the mandate to operationalize a corporate compliance program drives home the concept that compliance is a business process, which should be administered by the appropriate business unit with the requisite SME. When it comes to following the money, payroll is the most well-suited corporate discipline to provide this first level of oversight and controls.  Three key takeaways: Payroll can be a key prevent and detect control. The 2020 Update specified the tying of the corporate compliance function to the corporate payroll function. Offshore payments remain a key indicator for a red flag. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the areas articulated in the 2020 Update was around payments and payroll. For the both the compliance professional and the corporate payroll function, there is a significant role to play in the operationalization of a corporate compliance program. The 2020 Update was replete with references to payment and its critical nature to any best practices compliance program. This includes references to payments to foreign officials, payments to third parties and hiding bribes in payments to distributors. The 2020 Update begins with an admonition to stop wasting time on low hanging fruit when there are much higher risks in your business operations.

The role of payroll in compliance is not often considered in operationalizing your compliance program, yet the monies to fund bribes must come from somewhere. Unfortunately, one of those places is out of payroll. All CCOs need to sit down with his or her head of payroll, have them explain the role of payroll, then review the internal controls in place to see how they facilitate the goals of compliance. From that review, you can then determine how to use payroll to help to operationalize your compliance program.

The DOJ has now provided its clearest statement on how it expects a company to actually do compliance going forward. Long gone are the days where the DOJ simply considered the inputs of a written program as sufficient to protect companies from compliance violations. Yet the mandate to operationalize a corporate compliance program drives home the concept that compliance is a business process, which should be administered by the appropriate business unit with the requisite SME. When it comes to following the money, payroll is the most well-suited corporate discipline to provide this first level of oversight and controls. 

Three key takeaways:

  1. Payroll can be a key prevent and detect control.
  2. The 2020 Update specified the tying of the corporate compliance function to the corporate payroll function.
  3. Offshore payments remain a key indicator for a red flag.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 528 no Day 26 - Compliance function in an organization The role of the compliance professional and the compliance function in a corporation has steadily grown in stature and prestige over the years. When it came to the corporate compliance function, 2020 FCPA Resource Guide, under the Hallmarks of an Effective Compliance Program, simply noted the government would “consider whether the company devoted adequate staffing and resources to the compliance program given the size, structure, and risk profile of the business.” This Hallmark was significantly expanded in both the FCPA Corporate Enforcement Policy and 2020 Update. In the FCPA Corporate Enforcement Policy, the DOJ listed the following as factors relating to a corporate compliance function, that it would consider as indicia of an effective compliance and ethics program: 1) the resources the company has dedicated to compliance; 2) the quality and experience of the personnel involved in compliance, such that they can understand and identify the transactions and activities that pose a potential risk; 3) the authority and independence of the compliance function and the availability of compliance expertise to the board; 4) the compensation and promotion of the personnel involved in compliance, in view of their role, responsibilities, performance, and other appropriate factors; and 5) the reporting structure of any compliance personnel employed or contracted by the company. The 2020 Update and FCPA Corporate Enforcement Policy both demonstrate the continued evolution in the thinking of the DOJ around the corporate compliance function. Their articulated inquiries can only strengthen a corporate compliance function specifically; and the compliance profession more generally. The more the DOJ talks about the independence of the compliance function, coupled with resources being made available and authority concomitant with the corporate compliance function, the more corporations will see it is directly in their interest to provide the resources, authority and gravitas to compliance position in their organizations. Three key takeaways: How is compliance treated in the budget process? Has your compliance function had any decisions over-ridden by senior management? Beware outsourcing of compliance as any such contractor must have access to company documents and personnel. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 26 Jan 2022 05:00:00 -0000 Compliance Function in an Organization bonus 26 Thomas Fox In Day 26 of 31 Days to a More Effective Compliance Program we consider the role of a corporate compliance function in an organization. The role of the compliance professional and the compliance function in a corporation has steadily grown in stature and prestige over the years. When it came to the corporate compliance function, 2020 FCPA Resource Guide, under the Hallmarks of an Effective Compliance Program, simply noted the government would “consider whether the company devoted adequate staffing and resources to the compliance program given the size, structure, and risk profile of the business.” This Hallmark was significantly expanded in both the FCPA Corporate Enforcement Policy and 2020 Update. In the FCPA Corporate Enforcement Policy, the DOJ listed the following as factors relating to a corporate compliance function, that it would consider as indicia of an effective compliance and ethics program: 1) the resources the company has dedicated to compliance; 2) the quality and experience of the personnel involved in compliance, such that they can understand and identify the transactions and activities that pose a potential risk; 3) the authority and independence of the compliance function and the availability of compliance expertise to the board; 4) the compensation and promotion of the personnel involved in compliance, in view of their role, responsibilities, performance, and other appropriate factors; and 5) the reporting structure of any compliance personnel employed or contracted by the company. The 2020 Update and FCPA Corporate Enforcement Policy both demonstrate the continued evolution in the thinking of the DOJ around the corporate compliance function. Their articulated inquiries can only strengthen a corporate compliance function specifically; and the compliance profession more generally. The more the DOJ talks about the independence of the compliance function, coupled with resources being made available and authority concomitant with the corporate compliance function, the more corporations will see it is directly in their interest to provide the resources, authority and gravitas to compliance position in their organizations. Three key takeaways: How is compliance treated in the budget process? Has your compliance function had any decisions over-ridden by senior management? Beware outsourcing of compliance as any such contractor must have access to company documents and personnel. Learn more about your ad choices. Visit megaphone.fm/adchoices The role of the compliance professional and the compliance function in a corporation has steadily grown in stature and prestige over the years. When it came to the corporate compliance function, 2020 FCPA Resource Guide, under the Hallmarks of an Effective Compliance Program, simply noted the government would “consider whether the company devoted adequate staffing and resources to the compliance program given the size, structure, and risk profile of the business.”

This Hallmark was significantly expanded in both the FCPA Corporate Enforcement Policy and 2020 Update. In the FCPA Corporate Enforcement Policy, the DOJ listed the following as factors relating to a corporate compliance function, that it would consider as indicia of an effective compliance and ethics program: 1) the resources the company has dedicated to compliance; 2) the quality and experience of the personnel involved in compliance, such that they can understand and identify the transactions and activities that pose a potential risk; 3) the authority and independence of the compliance function and the availability of compliance expertise to the board; 4) the compensation and promotion of the personnel involved in compliance, in view of their role, responsibilities, performance, and other appropriate factors; and 5) the reporting structure of any compliance personnel employed or contracted by the company.

The 2020 Update and FCPA Corporate Enforcement Policy both demonstrate the continued evolution in the thinking of the DOJ around the corporate compliance function. Their articulated inquiries can only strengthen a corporate compliance function specifically; and the compliance profession more generally. The more the DOJ talks about the independence of the compliance function, coupled with resources being made available and authority concomitant with the corporate compliance function, the more corporations will see it is directly in their interest to provide the resources, authority and gravitas to compliance position in their organizations.

Three key takeaways:

  1. How is compliance treated in the budget process?
  2. Has your compliance function had any decisions over-ridden by senior management?
  3. Beware outsourcing of compliance as any such contractor must have access to company documents and personnel.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 531 no Day 25 - CCO authority and independence The role of the CCO has steadily grown in stature and prestige over the years. In the 2020 FCPA Resource Guide, under the Hallmarks of an Effective Compliance Program, it focused on the whether the CCO held senior management status and had a direct reporting line to the Board.  This Hallmark was significantly expanded in both the 2020 Update and the FCPA Corporate Enforcement Policy. And in so doing, the DOJ has increased the prestige, authority and role of both the CCO and corporate compliance function. The 2020 Update has five general areas of inquiry around the CCO and corporate compliance function. (1) How does the CCO salary and stature within the organization compare to other senior executives within the company. (2) What are the experience and stature of the CCO with an organization? Does the CCO have appropriate training for the role? (3) How much autonomy does the CCO have to report to the Board of Directors? How often do the CCO meet with directors? Are members of the senior management present for these meetings with the Board of Directors or of the Audit Committee? (4) What is your structure? Is the compliance function run by a designated chief compliance officer, or another executive within the company, and does that person have other roles within the company? (5) Is data in your organization so siloed that the CCO does not have access to it? If so, what are you doing about it? Once again for the compliance professional, the FCPA Corporate Enforcement Policy and 2020 Update make the importance of a best practices compliance program even more critical. The DOJ is focusing more on the role, expertise and how the compliance function is treated within an organization. Pay your CCO considerably less than your GC? You may now better be able to justify that discrepancy. If you have a legal department budget of $3 million and a compliance department budget of $500,000; you may be starting behind the eight-ball. Three key takeaways: How can you show the CCO really has a seat at the senior executive table? What are the professional qualifications of your CCO? Does your CCO have true independence to report directly to the Board of Directors? Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 25 Jan 2022 05:00:00 -0000 CCO Authority and Independence bonus 25 Thomas Fox In Day 25 of 31 Days to a More Effective Compliance Program we look at CCO authority and independence. The role of the CCO has steadily grown in stature and prestige over the years. In the 2020 FCPA Resource Guide, under the Hallmarks of an Effective Compliance Program, it focused on the whether the CCO held senior management status and had a direct reporting line to the Board.  This Hallmark was significantly expanded in both the 2020 Update and the FCPA Corporate Enforcement Policy. And in so doing, the DOJ has increased the prestige, authority and role of both the CCO and corporate compliance function. The 2020 Update has five general areas of inquiry around the CCO and corporate compliance function. (1) How does the CCO salary and stature within the organization compare to other senior executives within the company. (2) What are the experience and stature of the CCO with an organization? Does the CCO have appropriate training for the role? (3) How much autonomy does the CCO have to report to the Board of Directors? How often do the CCO meet with directors? Are members of the senior management present for these meetings with the Board of Directors or of the Audit Committee? (4) What is your structure? Is the compliance function run by a designated chief compliance officer, or another executive within the company, and does that person have other roles within the company? (5) Is data in your organization so siloed that the CCO does not have access to it? If so, what are you doing about it? Once again for the compliance professional, the FCPA Corporate Enforcement Policy and 2020 Update make the importance of a best practices compliance program even more critical. The DOJ is focusing more on the role, expertise and how the compliance function is treated within an organization. Pay your CCO considerably less than your GC? You may now better be able to justify that discrepancy. If you have a legal department budget of $3 million and a compliance department budget of $500,000; you may be starting behind the eight-ball. Three key takeaways: How can you show the CCO really has a seat at the senior executive table? What are the professional qualifications of your CCO? Does your CCO have true independence to report directly to the Board of Directors? Learn more about your ad choices. Visit megaphone.fm/adchoices The role of the CCO has steadily grown in stature and prestige over the years. In the 2020 FCPA Resource Guide, under the Hallmarks of an Effective Compliance Program, it focused on the whether the CCO held senior management status and had a direct reporting line to the Board. 

This Hallmark was significantly expanded in both the 2020 Update and the FCPA Corporate Enforcement Policy. And in so doing, the DOJ has increased the prestige, authority and role of both the CCO and corporate compliance function. The 2020 Update has five general areas of inquiry around the CCO and corporate compliance function. (1) How does the CCO salary and stature within the organization compare to other senior executives within the company. (2) What are the experience and stature of the CCO with an organization? Does the CCO have appropriate training for the role? (3) How much autonomy does the CCO have to report to the Board of Directors? How often do the CCO meet with directors? Are members of the senior management present for these meetings with the Board of Directors or of the Audit Committee? (4) What is your structure? Is the compliance function run by a designated chief compliance officer, or another executive within the company, and does that person have other roles within the company? (5) Is data in your organization so siloed that the CCO does not have access to it? If so, what are you doing about it?

Once again for the compliance professional, the FCPA Corporate Enforcement Policy and 2020 Update make the importance of a best practices compliance program even more critical. The DOJ is focusing more on the role, expertise and how the compliance function is treated within an organization. Pay your CCO considerably less than your GC? You may now better be able to justify that discrepancy. If you have a legal department budget of $3 million and a compliance department budget of $500,000; you may be starting behind the eight-ball.

Three key takeaways:

  1. How can you show the CCO really has a seat at the senior executive table?
  2. What are the professional qualifications of your CCO?
  3. Does your CCO have true independence to report directly to the Board of Directors?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 531 no Day 24 - Updates and feedback One of the critical elements found in the 2020 Update is the need to use the information you obtain, whether through risk assessment, root cause analysis, investigation, hotline report or any other manner to remediate the situation which allowed it to arise. Your company should establish a regular monitoring system to spot issues and address them. Effective monitoring means applying a consistent set of protocols, checks, and controls tailored to your company’s risks to detect and remediate compliance problems on an ongoing basis. To address this, your compliance team should be checking in routinely with local finance departments in your foreign offices to ask if they have noticed recent accounting irregularities. Regional directors should be required to keep tabs on potential improper activity in the countries in which they manage. These ongoing efforts demonstrate that your company is serious about compliance. It is a function of the CCO to reinforce the vision and goals of the compliance function, where assessment and updating are critical to an ongoing best practices compliance program. If you follow this protocol, you will put a mechanism in place to demonstrate your company’s commitment to compliance by following through on intentions as set forth in your strategic plan. What should you do with this information? Put a strategic plan in place ready to implement your findings of continuous improvement, by using the following: Review the goals of the strategic plan. This requires that you arrange a time for the CCO and team to review the goals of the Strategic Plan, which the CCO should lead to determine how this goal in the Plan measures up to its implementation in your company. Design an execution plan. The KISS method (Keep it Simple Sir) is the best to move forward. This would suggest that for each compliance goal, there should be a simple and straight forward plan to ensure that the goal in question is being addressed. Put accountabilities in place. In any plan of execution, there must be accountabilities attached to them. This requires the CCO or other senior compliance department representatives to put these in place and then mandate a report requirement on how the task assigned is being achieved. Schedule the next review of the plan. There should be a regular review of the process. It allows any problems which may arise to be detected and corrected more quickly than if meetings are held at a less frequent basis. Continuous monitoring is a key step but it is only the first step. It is not simply that you tested your compliance program but that you did something with the information you obtained to improve your program. Three key takeaways: Innovation can come through a new way to think about and use data going forward. Have a plan in place to use the information garnered in your monitoring incorporated back into your compliance program. Always remember that Document Document Document is critical if the regulators come knocking. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 24 Jan 2022 05:00:00 -0000 Updates and Feedback bonus 24 Thomas Fox In Day 24 of 31 Days to a More Effective Compliance Program we consider how use updates and feedback. One of the critical elements found in the 2020 Update is the need to use the information you obtain, whether through risk assessment, root cause analysis, investigation, hotline report or any other manner to remediate the situation which allowed it to arise. Your company should establish a regular monitoring system to spot issues and address them. Effective monitoring means applying a consistent set of protocols, checks, and controls tailored to your company’s risks to detect and remediate compliance problems on an ongoing basis. To address this, your compliance team should be checking in routinely with local finance departments in your foreign offices to ask if they have noticed recent accounting irregularities. Regional directors should be required to keep tabs on potential improper activity in the countries in which they manage. These ongoing efforts demonstrate that your company is serious about compliance. It is a function of the CCO to reinforce the vision and goals of the compliance function, where assessment and updating are critical to an ongoing best practices compliance program. If you follow this protocol, you will put a mechanism in place to demonstrate your company’s commitment to compliance by following through on intentions as set forth in your strategic plan. What should you do with this information? Put a strategic plan in place ready to implement your findings of continuous improvement, by using the following: Review the goals of the strategic plan. This requires that you arrange a time for the CCO and team to review the goals of the Strategic Plan, which the CCO should lead to determine how this goal in the Plan measures up to its implementation in your company. Design an execution plan. The KISS method (Keep it Simple Sir) is the best to move forward. This would suggest that for each compliance goal, there should be a simple and straight forward plan to ensure that the goal in question is being addressed. Put accountabilities in place. In any plan of execution, there must be accountabilities attached to them. This requires the CCO or other senior compliance department representatives to put these in place and then mandate a report requirement on how the task assigned is being achieved. Schedule the next review of the plan. There should be a regular review of the process. It allows any problems which may arise to be detected and corrected more quickly than if meetings are held at a less frequent basis. Continuous monitoring is a key step but it is only the first step. It is not simply that you tested your compliance program but that you did something with the information you obtained to improve your program. Three key takeaways: Innovation can come through a new way to think about and use data going forward. Have a plan in place to use the information garnered in your monitoring incorporated back into your compliance program. Always remember that Document Document Document is critical if the regulators come knocking. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the critical elements found in the 2020 Update is the need to use the information you obtain, whether through risk assessment, root cause analysis, investigation, hotline report or any other manner to remediate the situation which allowed it to arise. Your company should establish a regular monitoring system to spot issues and address them. Effective monitoring means applying a consistent set of protocols, checks, and controls tailored to your company’s risks to detect and remediate compliance problems on an ongoing basis. To address this, your compliance team should be checking in routinely with local finance departments in your foreign offices to ask if they have noticed recent accounting irregularities. Regional directors should be required to keep tabs on potential improper activity in the countries in which they manage. These ongoing efforts demonstrate that your company is serious about compliance.

It is a function of the CCO to reinforce the vision and goals of the compliance function, where assessment and updating are critical to an ongoing best practices compliance program. If you follow this protocol, you will put a mechanism in place to demonstrate your company’s commitment to compliance by following through on intentions as set forth in your strategic plan. What should you do with this information? Put a strategic plan in place ready to implement your findings of continuous improvement, by using the following:

  • Review the goals of the strategic plan. This requires that you arrange a time for the CCO and team to review the goals of the Strategic Plan, which the CCO should lead to determine how this goal in the Plan measures up to its implementation in your company.
  • Design an execution plan. The KISS method (Keep it Simple Sir) is the best to move forward. This would suggest that for each compliance goal, there should be a simple and straight forward plan to ensure that the goal in question is being addressed.
  • Put accountabilities in place. In any plan of execution, there must be accountabilities attached to them. This requires the CCO or other senior compliance department representatives to put these in place and then mandate a report requirement on how the task assigned is being achieved.
  • Schedule the next review of the plan. There should be a regular review of the process. It allows any problems which may arise to be detected and corrected more quickly than if meetings are held at a less frequent basis.

Continuous monitoring is a key step but it is only the first step. It is not simply that you tested your compliance program but that you did something with the information you obtained to improve your program.

Three key takeaways:

  1. Innovation can come through a new way to think about and use data going forward.
  2. Have a plan in place to use the information garnered in your monitoring incorporated back into your compliance program.
  3. Always remember that Document Document Document is critical if the regulators come knocking.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 530 no Day 23 - Assessing Compliance Internal Controls What happens when controls are continually overridden? Does that necessarily mean that companies are engaging in activities which violate the FCPA or some other law such as Sarbanes-Oxley (SOX). Cristina Revelo said she would start out with some basic questions such as “How often would something be manually approved? How often are controls skipped, what are the level of approvals that you have and what is your documentation? What are the reasons, and are you documenting how often a certain department is requiring those overrides?” While it could indicate a company lacks a culture of compliance or everything is an emergency, it might mean something else. It might mean that your internal controls need to be evaluated and then recalibrated. The Department of Justice calls this continuous monitoring leading to continuous improvement. Joe Oringel, co-founder of Visual Risk IQ, calls it continuous controls monitoring.  However, many compliance professionals, and particularly lawyers think once a control is in place, it’s set in stone, and it’s there forever. This derives from the unfortunate fact that once again many compliance professionals and most lawyers do not understand internal controls. Yet, internal controls, much like the rest of a compliance program can and should be continually monitored and continually improved based upon the information about such things as the number of overrides. Such a review can be evidence of a management problem or a culture of non-compliance at the organization. However, it could be that perhaps the controls need to be adjusted.  3 Key Takeaways 1. An internal control override is not necessarily a bad thing if proper procedure is followed. 2. Internal controls are not set in stone. 3. The key is to have a process for monitoring the controls, taking input, literally from each line of defense. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 23 Jan 2022 05:00:00 -0000 Assessing Compliance Internal Controls bonus 23 Thomas Fox In Day 23 of 31 Days to a More Effective Compliance Program we consider how to assess compliance internal controls. What happens when controls are continually overridden? Does that necessarily mean that companies are engaging in activities which violate the FCPA or some other law such as Sarbanes-Oxley (SOX). Cristina Revelo said she would start out with some basic questions such as “How often would something be manually approved? How often are controls skipped, what are the level of approvals that you have and what is your documentation? What are the reasons, and are you documenting how often a certain department is requiring those overrides?” While it could indicate a company lacks a culture of compliance or everything is an emergency, it might mean something else. It might mean that your internal controls need to be evaluated and then recalibrated. The Department of Justice calls this continuous monitoring leading to continuous improvement. Joe Oringel, co-founder of Visual Risk IQ, calls it continuous controls monitoring.  However, many compliance professionals, and particularly lawyers think once a control is in place, it’s set in stone, and it’s there forever. This derives from the unfortunate fact that once again many compliance professionals and most lawyers do not understand internal controls. Yet, internal controls, much like the rest of a compliance program can and should be continually monitored and continually improved based upon the information about such things as the number of overrides. Such a review can be evidence of a management problem or a culture of non-compliance at the organization. However, it could be that perhaps the controls need to be adjusted.  3 Key Takeaways 1. An internal control override is not necessarily a bad thing if proper procedure is followed. 2. Internal controls are not set in stone. 3. The key is to have a process for monitoring the controls, taking input, literally from each line of defense. Learn more about your ad choices. Visit megaphone.fm/adchoices What happens when controls are continually overridden? Does that necessarily mean that companies are engaging in activities which violate the FCPA or some other law such as Sarbanes-Oxley (SOX). Cristina Revelo said she would start out with some basic questions such as “How often would something be manually approved? How often are controls skipped, what are the level of approvals that you have and what is your documentation? What are the reasons, and are you documenting how often a certain department is requiring those overrides?” While it could indicate a company lacks a culture of compliance or everything is an emergency, it might mean something else. It might mean that your internal controls need to be evaluated and then recalibrated. The Department of Justice calls this continuous monitoring leading to continuous improvement. Joe Oringel, co-founder of Visual Risk IQ, calls it continuous controls monitoring. 

However, many compliance professionals, and particularly lawyers think once a control is in place, it’s set in stone, and it’s there forever. This derives from the unfortunate fact that once again many compliance professionals and most lawyers do not understand internal controls. Yet, internal controls, much like the rest of a compliance program can and should be continually monitored and continually improved based upon the information about such things as the number of overrides. Such a review can be evidence of a management problem or a culture of non-compliance at the organization. However, it could be that perhaps the controls need to be adjusted. 

3 Key Takeaways

1. An internal control override is not necessarily a bad thing if proper procedure is followed.

2. Internal controls are not set in stone.

3. The key is to have a process for monitoring the controls, taking input, literally from each line of defense.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 485 no Day 22 - Internal Reporting and Triaging Claims The call, email or tip comes into your office; an employee reports suspicious activity somewhere across the globe. That activity might well turn into a FCPA issue for your company. As the CCO, it will be up to you to begin the process which will determine, in many instances, how the company will respond going forward. This is more than simply maintaining hotlines. Companies have to make real efforts to listen to employees. You need to have managers who are trained on how to handle employee concerns; they must be incentivized to take on this compliance responsibility and you must devote communications resources to reinforcing the company’s culture and values to create an environment and expectation that managers will raise employee concerns. The reason is that a business’s own employees are a company’s best source of information about what is going on in the company. It is certainly a best practice for a company to listen to its own employees, particularly to help improve its processes and procedures. But more than listening to its employees, a company should provide a safe and secure route for employees to escalate their concerns. This is the underlying rationale behind an anonymous reporting system within any organization. Both the U.S. Sentencing Guidelines and the Organization of Economic Cooperation and Development (OECD) Good Practices list as one of their components an anonymous reporting mechanism by which employees can report compliance and ethics violations. Of course, the Dodd-Frank Whistleblower provisions also give heed to the implementation of a hotline. Given the number of ways that information about violations or potential violations can be communicated to the government regulators, having a robust triage system is an important way that a company can determine what resources to bring to bear on a compliance problem. Jonathan Marks has articulated a five-stage triage process which allows for not only an early assessment of any allegations but also a manner to think through your investigative approach. Marks cautions you must have an experienced investigator or other seasoned professional making these determinations, if not a more well-rounded group or committee. Next, consider what will be the types of evidence to review going forward. Finally, before selecting a triage solution, understand what tools are available, including both forensic and human, to complete the investigation.  Three key takeaways: 1. The DOJ and SEC put special emphasis on internal reporting lines. 2. Test your hotline on a regular basis to make sure it is working. 3. Every claim should be triaged before starting an investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 22 Jan 2022 05:00:00 -0000 Internal Reporting and Triaging Claims bonus 22 Thomas Fox In Day 22 of 31 Days to a More Effective Compliance Program we consider Internal Reporting and Triaging Claims. The call, email or tip comes into your office; an employee reports suspicious activity somewhere across the globe. That activity might well turn into a FCPA issue for your company. As the CCO, it will be up to you to begin the process which will determine, in many instances, how the company will respond going forward. This is more than simply maintaining hotlines. Companies have to make real efforts to listen to employees. You need to have managers who are trained on how to handle employee concerns; they must be incentivized to take on this compliance responsibility and you must devote communications resources to reinforcing the company’s culture and values to create an environment and expectation that managers will raise employee concerns. The reason is that a business’s own employees are a company’s best source of information about what is going on in the company. It is certainly a best practice for a company to listen to its own employees, particularly to help improve its processes and procedures. But more than listening to its employees, a company should provide a safe and secure route for employees to escalate their concerns. This is the underlying rationale behind an anonymous reporting system within any organization. Both the U.S. Sentencing Guidelines and the Organization of Economic Cooperation and Development (OECD) Good Practices list as one of their components an anonymous reporting mechanism by which employees can report compliance and ethics violations. Of course, the Dodd-Frank Whistleblower provisions also give heed to the implementation of a hotline. Given the number of ways that information about violations or potential violations can be communicated to the government regulators, having a robust triage system is an important way that a company can determine what resources to bring to bear on a compliance problem. Jonathan Marks has articulated a five-stage triage process which allows for not only an early assessment of any allegations but also a manner to think through your investigative approach. Marks cautions you must have an experienced investigator or other seasoned professional making these determinations, if not a more well-rounded group or committee. Next, consider what will be the types of evidence to review going forward. Finally, before selecting a triage solution, understand what tools are available, including both forensic and human, to complete the investigation.  Three key takeaways: 1. The DOJ and SEC put special emphasis on internal reporting lines. 2. Test your hotline on a regular basis to make sure it is working. 3. Every claim should be triaged before starting an investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices The call, email or tip comes into your office; an employee reports suspicious activity somewhere across the globe. That activity might well turn into a FCPA issue for your company. As the CCO, it will be up to you to begin the process which will determine, in many instances, how the company will respond going forward. This is more than simply maintaining hotlines. Companies have to make real efforts to listen to employees. You need to have managers who are trained on how to handle employee concerns; they must be incentivized to take on this compliance responsibility and you must devote communications resources to reinforcing the company’s culture and values to create an environment and expectation that managers will raise employee concerns.

The reason is that a business’s own employees are a company’s best source of information about what is going on in the company. It is certainly a best practice for a company to listen to its own employees, particularly to help improve its processes and procedures. But more than listening to its employees, a company should provide a safe and secure route for employees to escalate their concerns. This is the underlying rationale behind an anonymous reporting system within any organization. Both the U.S. Sentencing Guidelines and the Organization of Economic Cooperation and Development (OECD) Good Practices list as one of their components an anonymous reporting mechanism by which employees can report compliance and ethics violations. Of course, the Dodd-Frank Whistleblower provisions also give heed to the implementation of a hotline.

Given the number of ways that information about violations or potential violations can be communicated to the government regulators, having a robust triage system is an important way that a company can determine what resources to bring to bear on a compliance problem.

Jonathan Marks has articulated a five-stage triage process which allows for not only an early assessment of any allegations but also a manner to think through your investigative approach. Marks cautions you must have an experienced investigator or other seasoned professional making these determinations, if not a more well-rounded group or committee. Next, consider what will be the types of evidence to review going forward. Finally, before selecting a triage solution, understand what tools are available, including both forensic and human, to complete the investigation.

 Three key takeaways:

1. The DOJ and SEC put special emphasis on internal reporting lines.

2. Test your hotline on a regular basis to make sure it is working.

3. Every claim should be triaged before starting an investigation.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 631 no Day 21 - Continuous improvement in a compliance program The 2020 Update was very clear about the need for continuous improvement in any compliance program. It stated quite succinctly, “One hallmark of an effective compliance program is its capacity to improve and evolve. The actual implementation of controls in practice will necessarily reveal areas of risk and potential adjustment. A company’s business changes over time, as do the environments in which it operates, the nature of its customers, the laws that govern its actions, and the applicable industry standards. Accordingly, prosecutors should consider whether the company has engaged in meaningful efforts to review its compliance program and ensure that it is not stale.”   Continuous improvement through continuous monitoring or other similar techniques will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is in many ways a continuously evolving organism, just as your company is. You need to build in a way to keep pace with both market and regulatory changes to have a truly effective anti-corruption compliance program.  Three key takeaways: Your compliance program should be continually evolving. Monitoring and auditing are different, yet complimentary tools for continuous improvement. Culture assessment and monitoring are also now required as well. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 21 Jan 2022 05:00:00 -0000 Continuous Improvement in a Compliance Program bonus 21 Thomas Fox In Day 21 of 31 Days to a More Effective Compliance Program we review continuous improvement in a compliance program. The 2020 Update was very clear about the need for continuous improvement in any compliance program. It stated quite succinctly, “One hallmark of an effective compliance program is its capacity to improve and evolve. The actual implementation of controls in practice will necessarily reveal areas of risk and potential adjustment. A company’s business changes over time, as do the environments in which it operates, the nature of its customers, the laws that govern its actions, and the applicable industry standards. Accordingly, prosecutors should consider whether the company has engaged in meaningful efforts to review its compliance program and ensure that it is not stale.”   Continuous improvement through continuous monitoring or other similar techniques will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is in many ways a continuously evolving organism, just as your company is. You need to build in a way to keep pace with both market and regulatory changes to have a truly effective anti-corruption compliance program.  Three key takeaways: Your compliance program should be continually evolving. Monitoring and auditing are different, yet complimentary tools for continuous improvement. Culture assessment and monitoring are also now required as well. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2020 Update was very clear about the need for continuous improvement in any compliance program. It stated quite succinctly, “One hallmark of an effective compliance program is its capacity to improve and evolve. The actual implementation of controls in practice will necessarily reveal areas of risk and potential adjustment. A company’s business changes over time, as do the environments in which it operates, the nature of its customers, the laws that govern its actions, and the applicable industry standards. Accordingly, prosecutors should consider whether the company has engaged in meaningful efforts to review its compliance program and ensure that it is not stale.”  

Continuous improvement through continuous monitoring or other similar techniques will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is in many ways a continuously evolving organism, just as your company is. You need to build in a way to keep pace with both market and regulatory changes to have a truly effective anti-corruption compliance program.

 Three key takeaways:

  1. Your compliance program should be continually evolving.
  2. Monitoring and auditing are different, yet complimentary tools for continuous improvement.
  3. Culture assessment and monitoring are also now required as well.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 519 no Day 20 - Responding to Investigative Findings There is nothing like an internal whistleblower report about a compliance violation, the finding of such an issue, or (even worse) a subpoena from the DOJ or notice letter from the SEC to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check.  You may find yourself in the position that you will have to have some very frank discussions about what to expect in terms of costs and time outlays. While much of these discussions will focus on the investigative process and those costs, these discussions will allow you to initiate the talk about remediation going forward and begin to explain why money must be budgeted for the remediation process. One of the things rarely considered is how the investigation triggers the remediation process and what the relationship is between the two. When issues arise warranting an investigation that would rise to the Board of Directors level and potentially require disclosure to the government, there is usually a flurry of attention and activity. Everyone wants to know what is going on. In an interview with Russ Berland, CCO at Aventiv Technologies, he noted, “for that short moment in time, you have everyone’s full attention.” Yet it can still be “a tricky place, because you get your fifteen minutes to really get everyone’s full attention, and from then on, you’re fighting with everybody else for their attention, like the normal things in business life.” Three key takeaways: A serious FCPA allegation gets the attention of the Board and senior management. Use this time to move the compliance program forward. Be aware of how your investigation can impact and even inform your remediation efforts. Be prepared to deal with the dreaded “where else” question. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 20 Jan 2022 05:00:00 -0000 Responding to Investigative Findings bonus 20 Thomas Fox In Day 20 of 31 Days to a More Effective Compliance Program we consider how to respond to investigative findings. There is nothing like an internal whistleblower report about a compliance violation, the finding of such an issue, or (even worse) a subpoena from the DOJ or notice letter from the SEC to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check.  You may find yourself in the position that you will have to have some very frank discussions about what to expect in terms of costs and time outlays. While much of these discussions will focus on the investigative process and those costs, these discussions will allow you to initiate the talk about remediation going forward and begin to explain why money must be budgeted for the remediation process. One of the things rarely considered is how the investigation triggers the remediation process and what the relationship is between the two. When issues arise warranting an investigation that would rise to the Board of Directors level and potentially require disclosure to the government, there is usually a flurry of attention and activity. Everyone wants to know what is going on. In an interview with Russ Berland, CCO at Aventiv Technologies, he noted, “for that short moment in time, you have everyone’s full attention.” Yet it can still be “a tricky place, because you get your fifteen minutes to really get everyone’s full attention, and from then on, you’re fighting with everybody else for their attention, like the normal things in business life.” Three key takeaways: A serious FCPA allegation gets the attention of the Board and senior management. Use this time to move the compliance program forward. Be aware of how your investigation can impact and even inform your remediation efforts. Be prepared to deal with the dreaded “where else” question. Learn more about your ad choices. Visit megaphone.fm/adchoices There is nothing like an internal whistleblower report about a compliance violation, the finding of such an issue, or (even worse) a subpoena from the DOJ or notice letter from the SEC to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check.

 You may find yourself in the position that you will have to have some very frank discussions about what to expect in terms of costs and time outlays. While much of these discussions will focus on the investigative process and those costs, these discussions will allow you to initiate the talk about remediation going forward and begin to explain why money must be budgeted for the remediation process.

One of the things rarely considered is how the investigation triggers the remediation process and what the relationship is between the two. When issues arise warranting an investigation that would rise to the Board of Directors level and potentially require disclosure to the government, there is usually a flurry of attention and activity. Everyone wants to know what is going on. In an interview with Russ Berland, CCO at Aventiv Technologies, he noted, “for that short moment in time, you have everyone’s full attention.” Yet it can still be “a tricky place, because you get your fifteen minutes to really get everyone’s full attention, and from then on, you’re fighting with everybody else for their attention, like the normal things in business life.”

Three key takeaways:

  1. A serious FCPA allegation gets the attention of the Board and senior management. Use this time to move the compliance program forward.
  2. Be aware of how your investigation can impact and even inform your remediation efforts.
  3. Be prepared to deal with the dreaded “where else” question.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 524 no Day 19 - The investigation protocol After the internal report comes in and you have properly triaged the matter, you need to scope out and investigate it, promptly, thoroughly and with competent personnel. In the 2020 Update, provided these series of questions about your internal investigations:   Properly Scoped Investigations by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation? How does the company ensure that investigations are properly scoped? What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct an investigation, and who makes that determination?  Investigation Response – Does the company apply timing metrics to ensure responsiveness? Does the company have a process for monitoring the outcome of investigations and ensuring accountability for the response to any findings or recommendations?  Resources and Tracking of Results – Are the reporting and investigating mechanisms sufficiently funded? How has the company collected, tracked, analyzed, and used information from its reporting mechanisms? Does the company periodically analyze the reports or investigation findings for patterns of misconduct or other red flags for compliance weaknesses? Does the company periodically test the effectiveness of the hotline, for example by tracking a report from start to finish? In a presentation Jay Martin, retired Chief Compliance Officer at Baker Hughes and now Senior Counsel at Willkie Farr & Gallagher LLP and Jacki Trevino, Senior Director, Advisory Services Group at SAI Global Limited, discussed the specifics of an investigation protocol. It consisted of 1) opening and categorizing the case; 2) planning the investigation; 3) executing the investigation plan; 4) determining appropriate follow-up; and 5) closing the case. If you follow this basic protocol, you should be able to work through most investigations, in a clear, concise and cost-effective manner. Furthermore, you should have a report at the end of the day which should stand up to later scrutiny if a regulator comes looking. Finally, you will be able to “Document, Document, and Document”, not only the steps you took but why and the outcome obtained. Three key takeaways: A written protocol, created before an investigation, is a key starting point. Create specific steps to follow so there will be full transparency and documentation going forward. Consistency in approach is critical. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 19 Jan 2022 05:00:00 -0000 The Investigation Protocol bonus 19 Thomas Fox In Day 19 of 31 Days to a More Effective Compliance Program we consider your investigative protocol. After the internal report comes in and you have properly triaged the matter, you need to scope out and investigate it, promptly, thoroughly and with competent personnel. In the 2020 Update, provided these series of questions about your internal investigations:   Properly Scoped Investigations by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation? How does the company ensure that investigations are properly scoped? What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct an investigation, and who makes that determination?  Investigation Response – Does the company apply timing metrics to ensure responsiveness? Does the company have a process for monitoring the outcome of investigations and ensuring accountability for the response to any findings or recommendations?  Resources and Tracking of Results – Are the reporting and investigating mechanisms sufficiently funded? How has the company collected, tracked, analyzed, and used information from its reporting mechanisms? Does the company periodically analyze the reports or investigation findings for patterns of misconduct or other red flags for compliance weaknesses? Does the company periodically test the effectiveness of the hotline, for example by tracking a report from start to finish? In a presentation Jay Martin, retired Chief Compliance Officer at Baker Hughes and now Senior Counsel at Willkie Farr & Gallagher LLP and Jacki Trevino, Senior Director, Advisory Services Group at SAI Global Limited, discussed the specifics of an investigation protocol. It consisted of 1) opening and categorizing the case; 2) planning the investigation; 3) executing the investigation plan; 4) determining appropriate follow-up; and 5) closing the case. If you follow this basic protocol, you should be able to work through most investigations, in a clear, concise and cost-effective manner. Furthermore, you should have a report at the end of the day which should stand up to later scrutiny if a regulator comes looking. Finally, you will be able to “Document, Document, and Document”, not only the steps you took but why and the outcome obtained. Three key takeaways: A written protocol, created before an investigation, is a key starting point. Create specific steps to follow so there will be full transparency and documentation going forward. Consistency in approach is critical. Learn more about your ad choices. Visit megaphone.fm/adchoices After the internal report comes in and you have properly triaged the matter, you need to scope out and investigate it, promptly, thoroughly and with competent personnel. In the 2020 Update, provided these series of questions about your internal investigations:  

Properly Scoped Investigations by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation? How does the company ensure that investigations are properly scoped? What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct an investigation, and who makes that determination?

 Investigation Response – Does the company apply timing metrics to ensure responsiveness? Does the company have a process for monitoring the outcome of investigations and ensuring accountability for the response to any findings or recommendations?

 Resources and Tracking of Results – Are the reporting and investigating mechanisms sufficiently funded? How has the company collected, tracked, analyzed, and used information from its reporting mechanisms? Does the company periodically analyze the reports or investigation findings for patterns of misconduct or other red flags for compliance weaknesses? Does the company periodically test the effectiveness of the hotline, for example by tracking a report from start to finish?

In a presentation Jay Martin, retired Chief Compliance Officer at Baker Hughes and now Senior Counsel at Willkie Farr & Gallagher LLP and Jacki Trevino, Senior Director, Advisory Services Group at SAI Global Limited, discussed the specifics of an investigation protocol. It consisted of 1) opening and categorizing the case; 2) planning the investigation; 3) executing the investigation plan; 4) determining appropriate follow-up; and 5) closing the case. If you follow this basic protocol, you should be able to work through most investigations, in a clear, concise and cost-effective manner. Furthermore, you should have a report at the end of the day which should stand up to later scrutiny if a regulator comes looking. Finally, you will be able to “Document, Document, and Document”, not only the steps you took but why and the outcome obtained.

Three key takeaways:

  1. A written protocol, created before an investigation, is a key starting point.
  2. Create specific steps to follow so there will be full transparency and documentation going forward.
  3. Consistency in approach is critical.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 519 no Day 18 - Levels of due diligence Due diligence is generally recognized in three levels: Level I, Level II and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward.  The 2020 Update stated, “A well-designed compliance program should apply risk-based due diligence to its third- party relationships. Although the need for, and degree of, appropriate due diligence may vary based on the size and nature of the company, transaction, and third party, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.” The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward. There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions into your program. The Level I, II and III trichotomy appears to have the greatest favor and one that you should be able to implement in a straightforward manner. But the key is that you must assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence.  Three key takeaways: A Level I due diligence should only be used where there is a low risk of corruption. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared. Level III due diligence is deep dive, boots on the ground investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 18 Jan 2022 05:00:00 -0000 Levels of Due Diligence bonus 18 Thomas Fox In Day 18 of 31 Days to a More Effective Compliance Program we consider the levels of due diligence. Due diligence is generally recognized in three levels: Level I, Level II and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward.  The 2020 Update stated, “A well-designed compliance program should apply risk-based due diligence to its third- party relationships. Although the need for, and degree of, appropriate due diligence may vary based on the size and nature of the company, transaction, and third party, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.” The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward. There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions into your program. The Level I, II and III trichotomy appears to have the greatest favor and one that you should be able to implement in a straightforward manner. But the key is that you must assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence.  Three key takeaways: A Level I due diligence should only be used where there is a low risk of corruption. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared. Level III due diligence is deep dive, boots on the ground investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Due diligence is generally recognized in three levels: Level I, Level II and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward. 

The 2020 Update stated, “A well-designed compliance program should apply risk-based due diligence to its third- party relationships. Although the need for, and degree of, appropriate due diligence may vary based on the size and nature of the company, transaction, and third party, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.”

The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward.

There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions into your program. The Level I, II and III trichotomy appears to have the greatest favor and one that you should be able to implement in a straightforward manner. But the key is that you must assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence. 

Three key takeaways:

  1. A Level I due diligence should only be used where there is a low risk of corruption.
  2. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared.
  3. Level III due diligence is deep dive, boots on the ground investigation.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 514 no Day 17 - Managing your third parties The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the life cycle management of third parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation and compliance terms and conditions in contracts. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also the one where the rubber meets the road of operationalizingcompliance. It is also an area the DOJ specifically articulated in the 2020 Update that companies need to consider. Managing your third-parties is where the rubber meets the road in your overall third-party risk manage program. You must execute on this task. Even if you successfully navigate the first four steps in your third-party risk management program, those are in reality the easy steps. Managing the relationship is where the real work begins. Three key takeaways: Have a strategic approach to third-party risk management. Rank third parties based upon a variety of factors including compliance and business performance, length of relationship, benchmarking metrics and KPIs for ongoing monitoring and auditing. Managing the relationship is where the real work begins. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 17 Jan 2022 05:00:00 -0000 Managing Your Third Parties bonus 17 Thomas Fox In Day 17 of 31 Days to a More Effective Compliance Program we take up how to manage your 3rd parties. The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the life cycle management of third parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation and compliance terms and conditions in contracts. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also the one where the rubber meets the road of operationalizingcompliance. It is also an area the DOJ specifically articulated in the 2020 Update that companies need to consider. Managing your third-parties is where the rubber meets the road in your overall third-party risk manage program. You must execute on this task. Even if you successfully navigate the first four steps in your third-party risk management program, those are in reality the easy steps. Managing the relationship is where the real work begins. Three key takeaways: Have a strategic approach to third-party risk management. Rank third parties based upon a variety of factors including compliance and business performance, length of relationship, benchmarking metrics and KPIs for ongoing monitoring and auditing. Managing the relationship is where the real work begins. Learn more about your ad choices. Visit megaphone.fm/adchoices The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the life cycle management of third parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation and compliance terms and conditions in contracts. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also the one where the rubber meets the road of operationalizingcompliance. It is also an area the DOJ specifically articulated in the 2020 Update that companies need to consider.

Managing your third-parties is where the rubber meets the road in your overall third-party risk manage program. You must execute on this task. Even if you successfully navigate the first four steps in your third-party risk management program, those are in reality the easy steps. Managing the relationship is where the real work begins.

Three key takeaways:

  1. Have a strategic approach to third-party risk management.
  2. Rank third parties based upon a variety of factors including compliance and business performance, length of relationship, benchmarking metrics and KPIs for ongoing monitoring and auditing.
  3. Managing the relationship is where the real work begins.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 512 no Day 16 - The third-party risk management process As every compliance practitioner is well aware, third parties still present the highest risk under the FCPA. The 2020 Update devotes an entire prong to third-party management. It begins with the following:  Prosecutors should also assess whether the company knows the business rationale for needing the third party in the transaction, and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials. For example, a prosecutor should analyze whether the company has ensured that contract terms with third parties specifically describe the services to be performed, that the third party is actually performing the work, and that its compensation is commensurate with the work being provided in that industry and geographical region.   Prosecutors should further assess whether the company engaged in ongoing monitoring of the third-party relationships, be it through updated due diligence, training, audits, and/or annual compliance certifications by the third party. This clearly specifies that the DOJ expects an integrated approach that is operationalized throughout the company. This means you must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party risk management, which will fulfill the DOJ requirements as laid out in the 2020 FCPA Resource Guide and in the Hallmarks of an Effective Compliance Program. They five steps in the lifecycle of third-party management are:  Business Justification by the Business Sponsor; Questionnaire to Third-party; Due Diligence on Third-party, including triage of results; Compliance Terms and Conditions, including payment terms; and Management and Oversight of Third Parties After Contract Signing. Three key takeaways: Use the full 5-step process for third party management. Make sure you have business development involvement and buy-in. Operationalize all steps going forward by including business unit representatives. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 16 Jan 2022 05:00:00 -0000 Day 16 - The third-party risk management process bonus 16 Thomas Fox In Day 16 of 31 Days to a More Effective Compliance Program we consider the 5 steps in the 3rd party risk management process. As every compliance practitioner is well aware, third parties still present the highest risk under the FCPA. The 2020 Update devotes an entire prong to third-party management. It begins with the following:  Prosecutors should also assess whether the company knows the business rationale for needing the third party in the transaction, and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials. For example, a prosecutor should analyze whether the company has ensured that contract terms with third parties specifically describe the services to be performed, that the third party is actually performing the work, and that its compensation is commensurate with the work being provided in that industry and geographical region.   Prosecutors should further assess whether the company engaged in ongoing monitoring of the third-party relationships, be it through updated due diligence, training, audits, and/or annual compliance certifications by the third party. This clearly specifies that the DOJ expects an integrated approach that is operationalized throughout the company. This means you must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party risk management, which will fulfill the DOJ requirements as laid out in the 2020 FCPA Resource Guide and in the Hallmarks of an Effective Compliance Program. They five steps in the lifecycle of third-party management are:  Business Justification by the Business Sponsor; Questionnaire to Third-party; Due Diligence on Third-party, including triage of results; Compliance Terms and Conditions, including payment terms; and Management and Oversight of Third Parties After Contract Signing. Three key takeaways: Use the full 5-step process for third party management. Make sure you have business development involvement and buy-in. Operationalize all steps going forward by including business unit representatives. Learn more about your ad choices. Visit megaphone.fm/adchoices As every compliance practitioner is well aware, third parties still present the highest risk under the FCPA. The 2020 Update devotes an entire prong to third-party management. It begins with the following:

 Prosecutors should also assess whether the company knows the business rationale for needing the third party in the transaction, and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials. For example, a prosecutor should analyze whether the company has ensured that contract terms with third parties specifically describe the services to be performed, that the third party is actually performing the work, and that its compensation is commensurate with the work being provided in that industry and geographical region.   Prosecutors should further assess whether the company engaged in ongoing monitoring of the third-party relationships, be it through updated due diligence, training, audits, and/or annual compliance certifications by the third party.

This clearly specifies that the DOJ expects an integrated approach that is operationalized throughout the company. This means you must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party risk management, which will fulfill the DOJ requirements as laid out in the 2020 FCPA Resource Guide and in the Hallmarks of an Effective Compliance Program. They five steps in the lifecycle of third-party management are: 

  1. Business Justification by the Business Sponsor;
  2. Questionnaire to Third-party;
  3. Due Diligence on Third-party, including triage of results;
  4. Compliance Terms and Conditions, including payment terms; and
  5. Management and Oversight of Third Parties After Contract Signing.

Three key takeaways:

  1. Use the full 5-step process for third party management.
  2. Make sure you have business development involvement and buy-in.
  3. Operationalize all steps going forward by including business unit representatives.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 464 Day 15 - How Do You Evaluate a Risk Assessment? After you complete your risk assessment, you must then translate it into a risk profile. If your estimate of where your bribery risk is greatest is wrong, it will be an effort to address it. As Ben Locwin explained in his  BioProcess International article, entitled “Quality Risk Assessment and Management Strategies for Biopharmaceutical Companies”: Once we have assessed risks and determined a process that includes options to resolve and manage those risks whenever appropriate, then we can decide the level of resources with which to prioritize them. There always will be latent risks: those that we understand are there but that we cannot chase forever. But we need to make sure we have classified them correctly. With a good understanding of each of these, we are in a better position to speak about the quality of our businesses. William C. Athanas, in his Industry Week article, “Rethinking FCPA Compliance Strategies in a New Era of Enforcement”, posited that companies assume that FCPA violations follow a bell curve in which most employees are responsible for most of the violations. However, Athanas believed that the distribution pattern more closely follows a hockey-stick distribution, where virtually all violations are committed by just a few people. Athanas concluded by noting that is this limited group of employees, or what he terms the “shaft of the hockey-stick,” to which a company should devote the majority of its compliance resources. With a proper risk assessment, a company can then focus its compliance efforts such as intensive training sessions or detailed analysis of key financial transactions involving those employees with the greatest means and motive to commit a violation. The most significant risks with the greatest likelihood of occurring are deemed to be the priority risks. These become the focus of your most significant risk management efforts, couple with audit and monitoring going forward. A variety of tools can be used to continuously monitoring risk going forward. Consider providing employees with substantive training to guard against the most significant risks coming to pass and to keep the key messages fresh and top of mind. It is important to create a risk control summary that succinctly documents the nature of the risk and the actions taken to mitigate it. Finally, let this risk assessment and evaluation inform your compliance program, rather than letting the compliance program inform the risk assessment. Three key takeaways: Even after you complete your risk assessment, you must evaluate those risks for your company. The DOJ and SEC are looking for a well-reasoned approach on how you evaluate your risk. Create a risk matrix and rank your risks; then remediate and monitor as appropriate. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 15 Jan 2022 05:00:00 -0000 How Do You Evaluate a Risk Assessment? bonus 15 Thomas Fox In Day 15 of 31 Days to a More Effective Compliance Program we consider how to best evaluate a risk assessment. After you complete your risk assessment, you must then translate it into a risk profile. If your estimate of where your bribery risk is greatest is wrong, it will be an effort to address it. As Ben Locwin explained in his  BioProcess International article, entitled “Quality Risk Assessment and Management Strategies for Biopharmaceutical Companies”: Once we have assessed risks and determined a process that includes options to resolve and manage those risks whenever appropriate, then we can decide the level of resources with which to prioritize them. There always will be latent risks: those that we understand are there but that we cannot chase forever. But we need to make sure we have classified them correctly. With a good understanding of each of these, we are in a better position to speak about the quality of our businesses. William C. Athanas, in his Industry Week article, “Rethinking FCPA Compliance Strategies in a New Era of Enforcement”, posited that companies assume that FCPA violations follow a bell curve in which most employees are responsible for most of the violations. However, Athanas believed that the distribution pattern more closely follows a hockey-stick distribution, where virtually all violations are committed by just a few people. Athanas concluded by noting that is this limited group of employees, or what he terms the “shaft of the hockey-stick,” to which a company should devote the majority of its compliance resources. With a proper risk assessment, a company can then focus its compliance efforts such as intensive training sessions or detailed analysis of key financial transactions involving those employees with the greatest means and motive to commit a violation. The most significant risks with the greatest likelihood of occurring are deemed to be the priority risks. These become the focus of your most significant risk management efforts, couple with audit and monitoring going forward. A variety of tools can be used to continuously monitoring risk going forward. Consider providing employees with substantive training to guard against the most significant risks coming to pass and to keep the key messages fresh and top of mind. It is important to create a risk control summary that succinctly documents the nature of the risk and the actions taken to mitigate it. Finally, let this risk assessment and evaluation inform your compliance program, rather than letting the compliance program inform the risk assessment. Three key takeaways: Even after you complete your risk assessment, you must evaluate those risks for your company. The DOJ and SEC are looking for a well-reasoned approach on how you evaluate your risk. Create a risk matrix and rank your risks; then remediate and monitor as appropriate. Learn more about your ad choices. Visit megaphone.fm/adchoices After you complete your risk assessment, you must then translate it into a risk profile. If your estimate of where your bribery risk is greatest is wrong, it will be an effort to address it. As Ben Locwin explained in his  BioProcess International article, entitled “Quality Risk Assessment and Management Strategies for Biopharmaceutical Companies”:

Once we have assessed risks and determined a process that includes options to resolve and manage those risks whenever appropriate, then we can decide the level of resources with which to prioritize them. There always will be latent risks: those that we understand are there but that we cannot chase forever. But we need to make sure we have classified them correctly. With a good understanding of each of these, we are in a better position to speak about the quality of our businesses.

William C. Athanas, in his Industry Week article, “Rethinking FCPA Compliance Strategies in a New Era of Enforcement”, posited that companies assume that FCPA violations follow a bell curve in which most employees are responsible for most of the violations. However, Athanas believed that the distribution pattern more closely follows a hockey-stick distribution, where virtually all violations are committed by just a few people. Athanas concluded by noting that is this limited group of employees, or what he terms the “shaft of the hockey-stick,” to which a company should devote the majority of its compliance resources. With a proper risk assessment, a company can then focus its compliance efforts such as intensive training sessions or detailed analysis of key financial transactions involving those employees with the greatest means and motive to commit a violation.

The most significant risks with the greatest likelihood of occurring are deemed to be the priority risks. These become the focus of your most significant risk management efforts, couple with audit and monitoring going forward. A variety of tools can be used to continuously monitoring risk going forward. Consider providing employees with substantive training to guard against the most significant risks coming to pass and to keep the key messages fresh and top of mind. It is important to create a risk control summary that succinctly documents the nature of the risk and the actions taken to mitigate it. Finally, let this risk assessment and evaluation inform your compliance program, rather than letting the compliance program inform the risk assessment.

Three key takeaways:

  1. Even after you complete your risk assessment, you must evaluate those risks for your company.
  2. The DOJ and SEC are looking for a well-reasoned approach on how you evaluate your risk.
  3. Create a risk matrix and rank your risks; then remediate and monitor as appropriate.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 511 no Day 14 - Risk Assessments One cannot really say enough about risk assessments in the context of anti-corruption programs. This is because every corporate compliance program should be based upon a risk assessment, to understand your organization’s business from the commercial perspective, how your organization has identified, assessed, and defined its risk profile and, finally, the degree to which the program devotes appropriate scrutiny and resources to this range of risks. Yet the 2020 Update added a new emphasis that Risk Assessments should not be done not less than annually but in reality it should be done each time your risk change. Over the past couple of years, every company's risks changed in going from Work From Home to Return to the Office to Hybrid Work environments. Have you assessed each of these new paradigms for risks from the compliance perspective?   As far back as 1999, in the Metcalf & Eddy enforcement action, the DOJ has said that risk assessments that measure the likelihood and severity of possible FCPA violations should direct your resources to manage these risks. The 2012 FCPA Guidance stated it succinctly when it said, “Assessment of risk is fundamental to developing a strong compliance program and is another factor DOJ and SEC evaluate when assessing a company’s compliance program.” There are a number of ways you can slice and dice your basic inquiry. As with almost all FCPA compliance, it is important that your protocol be well thought out. If you use one, some or all of the above as your basic inquiries for your risk analysis, it should be acceptable for your starting point.  Three key takeaways: Since at least 1999, the DOJ has pointed to the risk assessment as the start of an effective compliance program. The DOJ will now consider both your risk assessment methodology for identifying risks and gathered evidence. You should base your compliance program on your risk assessment. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 14 Jan 2022 05:00:00 -0000 Risk Assessments bonus 14 Thomas Fox In Day 14 of 31 Days to a More Effective Compliance Program we take up risk assessments. One cannot really say enough about risk assessments in the context of anti-corruption programs. This is because every corporate compliance program should be based upon a risk assessment, to understand your organization’s business from the commercial perspective, how your organization has identified, assessed, and defined its risk profile and, finally, the degree to which the program devotes appropriate scrutiny and resources to this range of risks. Yet the 2020 Update added a new emphasis that Risk Assessments should not be done not less than annually but in reality it should be done each time your risk change. Over the past couple of years, every company's risks changed in going from Work From Home to Return to the Office to Hybrid Work environments. Have you assessed each of these new paradigms for risks from the compliance perspective?   As far back as 1999, in the Metcalf & Eddy enforcement action, the DOJ has said that risk assessments that measure the likelihood and severity of possible FCPA violations should direct your resources to manage these risks. The 2012 FCPA Guidance stated it succinctly when it said, “Assessment of risk is fundamental to developing a strong compliance program and is another factor DOJ and SEC evaluate when assessing a company’s compliance program.” There are a number of ways you can slice and dice your basic inquiry. As with almost all FCPA compliance, it is important that your protocol be well thought out. If you use one, some or all of the above as your basic inquiries for your risk analysis, it should be acceptable for your starting point.  Three key takeaways: Since at least 1999, the DOJ has pointed to the risk assessment as the start of an effective compliance program. The DOJ will now consider both your risk assessment methodology for identifying risks and gathered evidence. You should base your compliance program on your risk assessment. Learn more about your ad choices. Visit megaphone.fm/adchoices One cannot really say enough about risk assessments in the context of anti-corruption programs. This is because every corporate compliance program should be based upon a risk assessment, to understand your organization’s business from the commercial perspective, how your organization has identified, assessed, and defined its risk profile and, finally, the degree to which the program devotes appropriate scrutiny and resources to this range of risks. Yet the 2020 Update added a new emphasis that Risk Assessments should not be done not less than annually but in reality it should be done each time your risk change. Over the past couple of years, every company's risks changed in going from Work From Home to Return to the Office to Hybrid Work environments. Have you assessed each of these new paradigms for risks from the compliance perspective? 

 As far back as 1999, in the Metcalf & Eddy enforcement action, the DOJ has said that risk assessments that measure the likelihood and severity of possible FCPA violations should direct your resources to manage these risks. The 2012 FCPA Guidance stated it succinctly when it said, “Assessment of risk is fundamental to developing a strong compliance program and is another factor DOJ and SEC evaluate when assessing a company’s compliance program.”

There are a number of ways you can slice and dice your basic inquiry. As with almost all FCPA compliance, it is important that your protocol be well thought out. If you use one, some or all of the above as your basic inquiries for your risk analysis, it should be acceptable for your starting point. 

Three key takeaways:

  1. Since at least 1999, the DOJ has pointed to the risk assessment as the start of an effective compliance program.
  2. The DOJ will now consider both your risk assessment methodology for identifying risks and gathered evidence.
  3. You should base your compliance program on your risk assessment.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 591 no Day 13 - Institutional Justice and Institutional Fairness Companies have finally come to realize that institutional justice and fairness are perhaps the most basic tenet of any successful workplace. If employees believe they will be treated fairly, it will engender a level of trust that can work to not simply motivate employees but lead to a more successful workplace and, at the end of the day, a more profitable company. This encompasses the entire lifecycle of the employment relationship, from hiring through separation. It works in areas as seeming disparate as compensation and incentives, discipline, promotion and internal reporting.  On this final point, Kyle Welch and Stephen Stubben, in their 2019 paper entitled “Evidence on the Use and Efficacy of Internal Whistleblowing Systems”, noted that a robust whistleblower reporting system speaks to a functioning and ethical corporate culture. Employees who can report issues, in a fair manner, without fear of retaliation are more empowered to make the company run more efficiently and more profitably. Yet an equally interesting finding was where there was robust internal reporting, employees were more likely to speak up to improve overall business processes, thereby making the company more profitable. An often-overlooked role of any CCO or compliance professional is to help provide employees with institutional justice. If your compliance function is seen to be fair in the way it treats employees, in areas as varied as financial incentives, to promotions, to appropriate and consistent discipline meted out across the globe; employees are more likely to inform the compliance department when something goes array. If employees believe they will be treated fairly, it will go a long way to more fully operationalizing your compliance program. Three key takeaways: The DOJ and SEC have long called for appropriate and consistent application of both incentives and discipline. The Fair Process Doctrine will help set institutional justice as the norm in your organization. Inconsistent application of discipline will destroy your compliance program credibility. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 13 Jan 2022 05:00:00 -0000 Institutional Justice and Institutional Fairness bonus 13 Thomas Fox In Day 13 of 31 Days to a More Effective Compliance Program we consider why compliance must lead Institutional Justice and Institutional Fairness in a company. Companies have finally come to realize that institutional justice and fairness are perhaps the most basic tenet of any successful workplace. If employees believe they will be treated fairly, it will engender a level of trust that can work to not simply motivate employees but lead to a more successful workplace and, at the end of the day, a more profitable company. This encompasses the entire lifecycle of the employment relationship, from hiring through separation. It works in areas as seeming disparate as compensation and incentives, discipline, promotion and internal reporting.  On this final point, Kyle Welch and Stephen Stubben, in their 2019 paper entitled “Evidence on the Use and Efficacy of Internal Whistleblowing Systems”, noted that a robust whistleblower reporting system speaks to a functioning and ethical corporate culture. Employees who can report issues, in a fair manner, without fear of retaliation are more empowered to make the company run more efficiently and more profitably. Yet an equally interesting finding was where there was robust internal reporting, employees were more likely to speak up to improve overall business processes, thereby making the company more profitable. An often-overlooked role of any CCO or compliance professional is to help provide employees with institutional justice. If your compliance function is seen to be fair in the way it treats employees, in areas as varied as financial incentives, to promotions, to appropriate and consistent discipline meted out across the globe; employees are more likely to inform the compliance department when something goes array. If employees believe they will be treated fairly, it will go a long way to more fully operationalizing your compliance program. Three key takeaways: The DOJ and SEC have long called for appropriate and consistent application of both incentives and discipline. The Fair Process Doctrine will help set institutional justice as the norm in your organization. Inconsistent application of discipline will destroy your compliance program credibility. Learn more about your ad choices. Visit megaphone.fm/adchoices Companies have finally come to realize that institutional justice and fairness are perhaps the most basic tenet of any successful workplace. If employees believe they will be treated fairly, it will engender a level of trust that can work to not simply motivate employees but lead to a more successful workplace and, at the end of the day, a more profitable company. This encompasses the entire lifecycle of the employment relationship, from hiring through separation. It works in areas as seeming disparate as compensation and incentives, discipline, promotion and internal reporting.

 On this final point, Kyle Welch and Stephen Stubben, in their 2019 paper entitled “Evidence on the Use and Efficacy of Internal Whistleblowing Systems”, noted that a robust whistleblower reporting system speaks to a functioning and ethical corporate culture. Employees who can report issues, in a fair manner, without fear of retaliation are more empowered to make the company run more efficiently and more profitably. Yet an equally interesting finding was where there was robust internal reporting, employees were more likely to speak up to improve overall business processes, thereby making the company more profitable.

An often-overlooked role of any CCO or compliance professional is to help provide employees with institutional justice. If your compliance function is seen to be fair in the way it treats employees, in areas as varied as financial incentives, to promotions, to appropriate and consistent discipline meted out across the globe; employees are more likely to inform the compliance department when something goes array. If employees believe they will be treated fairly, it will go a long way to more fully operationalizing your compliance program.

Three key takeaways:

  1. The DOJ and SEC have long called for appropriate and consistent application of both incentives and discipline.
  2. The Fair Process Doctrine will help set institutional justice as the norm in your organization.
  3. Inconsistent application of discipline will destroy your compliance program credibility.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 569 no Day 12 - Financial Incentives for Compliance One of the areas that many companies have not paid as much attention to in their compliance programs is compensation. However, the DOJ and SEC have long made clear that they view monetary structure for compensation, rewarding those employees who do business in compliance with their employer’s compliance program, as one of the ways to reinforce the compliance program and the message of compliance. As far back as 2004, then SEC Director of Enforcement Stephen M. Cutler noted that integrity, ethics and compliance needed to be part of promotion, compensation and evaluation processes: “At the end of the day, the most effective way to communicate that “doing the right thing” is a priority, is to reward it.”  The 2020 FCPA Resources Guide stated the “DOJ and SEC recognize that positive incentives can also drive compliant behavior. These incentives can take many forms such as personnel evaluations and promotions, rewards for improving and developing a company’s compliance program, and rewards for ethics and compliance leadership.” Obviously, the power of a compensation plan is to motivate employees to not only to sell more but to act in ways that support your company’s business model and overall culture and values. For the compliance practitioner, one of the biggest reasons is to first change a company’s culture to make compliance more important, and then integrate it into the DNA of your organization. But you must be able to evolve in your thinking and professionalism to recognize the opportunities to change and then adapt your incentive program to make the doing of compliance part of your company’s everyday business process.  Three key takeaways: The DOJ and SEC have long advocated compensation as a way to motivate employees into ethical and compliant behaviors Keep the compliance aspects of your compensation structure simple and easy for your employees to understand Have full transparency in the framework of your compensation structure Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 12 Jan 2022 05:00:00 -0000 Financial Incentives for Compliance bonus 12 Thomas Fox In Day 12 of 31 Days to a More Effective Compliance Program we consider how to use financial incentives to facilitate your compliance regime. One of the areas that many companies have not paid as much attention to in their compliance programs is compensation. However, the DOJ and SEC have long made clear that they view monetary structure for compensation, rewarding those employees who do business in compliance with their employer’s compliance program, as one of the ways to reinforce the compliance program and the message of compliance. As far back as 2004, then SEC Director of Enforcement Stephen M. Cutler noted that integrity, ethics and compliance needed to be part of promotion, compensation and evaluation processes: “At the end of the day, the most effective way to communicate that “doing the right thing” is a priority, is to reward it.”  The 2020 FCPA Resources Guide stated the “DOJ and SEC recognize that positive incentives can also drive compliant behavior. These incentives can take many forms such as personnel evaluations and promotions, rewards for improving and developing a company’s compliance program, and rewards for ethics and compliance leadership.” Obviously, the power of a compensation plan is to motivate employees to not only to sell more but to act in ways that support your company’s business model and overall culture and values. For the compliance practitioner, one of the biggest reasons is to first change a company’s culture to make compliance more important, and then integrate it into the DNA of your organization. But you must be able to evolve in your thinking and professionalism to recognize the opportunities to change and then adapt your incentive program to make the doing of compliance part of your company’s everyday business process.  Three key takeaways: The DOJ and SEC have long advocated compensation as a way to motivate employees into ethical and compliant behaviors Keep the compliance aspects of your compensation structure simple and easy for your employees to understand Have full transparency in the framework of your compensation structure Learn more about your ad choices. Visit megaphone.fm/adchoices One of the areas that many companies have not paid as much attention to in their compliance programs is compensation. However, the DOJ and SEC have long made clear that they view monetary structure for compensation, rewarding those employees who do business in compliance with their employer’s compliance program, as one of the ways to reinforce the compliance program and the message of compliance. As far back as 2004, then SEC Director of Enforcement Stephen M. Cutler noted that integrity, ethics and compliance needed to be part of promotion, compensation and evaluation processes: “At the end of the day, the most effective way to communicate that “doing the right thing” is a priority, is to reward it.”

 The 2020 FCPA Resources Guide stated the “DOJ and SEC recognize that positive incentives can also drive compliant behavior. These incentives can take many forms such as personnel evaluations and promotions, rewards for improving and developing a company’s compliance program, and rewards for ethics and compliance leadership.”

Obviously, the power of a compensation plan is to motivate employees to not only to sell more but to act in ways that support your company’s business model and overall culture and values. For the compliance practitioner, one of the biggest reasons is to first change a company’s culture to make compliance more important, and then integrate it into the DNA of your organization. But you must be able to evolve in your thinking and professionalism to recognize the opportunities to change and then adapt your incentive program to make the doing of compliance part of your company’s everyday business process. 

Three key takeaways:

  1. The DOJ and SEC have long advocated compensation as a way to motivate employees into ethical and compliant behaviors
  2. Keep the compliance aspects of your compensation structure simple and easy for your employees to understand
  3. Have full transparency in the framework of your compensation structure

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no Day 11 - Tailored and Effective Compliance Training. One of the key goals of any compliance program is to train employees in awareness and understanding of the FCPA; your specific company compliance program; and to create and foster a culture of compliance. While it seems axiomatic that compliance training is a mainstay of any best practices compliance program, the conversation around training has evolved over the years. Beginning in the fall of 2016, through the announcement of the FCPA Enforcement Pilot Program, the DOJ began to talk about whether you have determined the effectiveness of your training. This conversation continued with the 2017 Evaluation where it asked, “How has the company measured the effectiveness of the training?” This point has bedeviled many compliance professionals yet is now a key metric for the government in evaluating compliance training. It evolved further in the 2020 Update with the mandate that training must be “truly effective”. Finally, the training must be presented in a language in which the employees understand, which means in a local language, if the training is outside the US or other non-English-speaking countries. The 2017 Evaluation focused into whether your training was “tailored” for the audience. This added two requirements. The first was to assess your employees for risk to determine the type of training you might need to deliver by risk ranking your employees. Obviously, the sales force would be the highest risk but there may be others who are deserving of high-risk training as well. From this risk ranking, you were required to develop tailored training for the risks those employees will face. What are ‘espresso shots’ of training to help facilitate effective training? Tina Rampino, Associate Managing Director, at K2 Integrity suggests keeping your compliance training segments concise as “shorter, bite-size learning is a trend in training programs.” This means that instead of offering half-day and full-day sessions, break programs into shorter segments of 20 minutes or less, which are easier for participants to absorb - and schedule. Another example is that short cartoons or animated videos can be excellent quarterly reminders. Done properly, they do not feel like an assessment or certainly not a ‘check-the-box’ exercise. The bottom line is that with all training most employees must undergo now and even more so in the continued time of the Covid-19 Omicron Variant, espresso shots give people back a lot of time.  Three key takeaways: How and why have you tailored your compliance training and how do you determine its effectiveness? Try an espresso shot of training. How is your training presented: both in languages and media? Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 11 Jan 2022 05:00:00 -0000 Tailored and Effective Compliance Training. bonus 11 Thomas Fox In Day 11 of 31 Days to a More Effective Compliance Program we consider how to have both tailored and effective compliance training. One of the key goals of any compliance program is to train employees in awareness and understanding of the FCPA; your specific company compliance program; and to create and foster a culture of compliance. While it seems axiomatic that compliance training is a mainstay of any best practices compliance program, the conversation around training has evolved over the years. Beginning in the fall of 2016, through the announcement of the FCPA Enforcement Pilot Program, the DOJ began to talk about whether you have determined the effectiveness of your training. This conversation continued with the 2017 Evaluation where it asked, “How has the company measured the effectiveness of the training?” This point has bedeviled many compliance professionals yet is now a key metric for the government in evaluating compliance training. It evolved further in the 2020 Update with the mandate that training must be “truly effective”. Finally, the training must be presented in a language in which the employees understand, which means in a local language, if the training is outside the US or other non-English-speaking countries. The 2017 Evaluation focused into whether your training was “tailored” for the audience. This added two requirements. The first was to assess your employees for risk to determine the type of training you might need to deliver by risk ranking your employees. Obviously, the sales force would be the highest risk but there may be others who are deserving of high-risk training as well. From this risk ranking, you were required to develop tailored training for the risks those employees will face. What are ‘espresso shots’ of training to help facilitate effective training? Tina Rampino, Associate Managing Director, at K2 Integrity suggests keeping your compliance training segments concise as “shorter, bite-size learning is a trend in training programs.” This means that instead of offering half-day and full-day sessions, break programs into shorter segments of 20 minutes or less, which are easier for participants to absorb - and schedule. Another example is that short cartoons or animated videos can be excellent quarterly reminders. Done properly, they do not feel like an assessment or certainly not a ‘check-the-box’ exercise. The bottom line is that with all training most employees must undergo now and even more so in the continued time of the Covid-19 Omicron Variant, espresso shots give people back a lot of time.  Three key takeaways: How and why have you tailored your compliance training and how do you determine its effectiveness? Try an espresso shot of training. How is your training presented: both in languages and media? Learn more about your ad choices. Visit megaphone.fm/adchoices One of the key goals of any compliance program is to train employees in awareness and understanding of the FCPA; your specific company compliance program; and to create and foster a culture of compliance. While it seems axiomatic that compliance training is a mainstay of any best practices compliance program, the conversation around training has evolved over the years. Beginning in the fall of 2016, through the announcement of the FCPA Enforcement Pilot Program, the DOJ began to talk about whether you have determined the effectiveness of your training. This conversation continued with the 2017 Evaluation where it asked, “How has the company measured the effectiveness of the training?” This point has bedeviled many compliance professionals yet is now a key metric for the government in evaluating compliance training. It evolved further in the 2020 Update with the mandate that training must be “truly effective”. Finally, the training must be presented in a language in which the employees understand, which means in a local language, if the training is outside the US or other non-English-speaking countries. The 2017 Evaluation focused into whether your training was “tailored” for the audience. This added two requirements. The first was to assess your employees for risk to determine the type of training you might need to deliver by risk ranking your employees. Obviously, the sales force would be the highest risk but there may be others who are deserving of high-risk training as well. From this risk ranking, you were required to develop tailored training for the risks those employees will face.

What are ‘espresso shots’ of training to help facilitate effective training? Tina Rampino, Associate Managing Director, at K2 Integrity suggests keeping your compliance training segments concise as “shorter, bite-size learning is a trend in training programs.” This means that instead of offering half-day and full-day sessions, break programs into shorter segments of 20 minutes or less, which are easier for participants to absorb - and schedule. Another example is that short cartoons or animated videos can be excellent quarterly reminders. Done properly, they do not feel like an assessment or certainly not a ‘check-the-box’ exercise. The bottom line is that with all training most employees must undergo now and even more so in the continued time of the Covid-19 Omicron Variant, espresso shots give people back a lot of time.

 Three key takeaways:

  1. How and why have you tailored your compliance training and how do you determine its effectiveness?
  2. Try an espresso shot of training.
  3. How is your training presented: both in languages and media?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 no Day 10 - The Use of Social Media in Compliance What is the message of compliance inside of a corporation and how it is distributed? In a compliance program, the largest portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communications are free or available at very low cost. Why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward?  Louis Sapirman, Vice President and Chief Ethics & Compliance Officer for Panasonic Corporation of North America – Panasonic USA, often talks about the integration of social media into compliance. You should start with the tech-savvy nature of the today’s workforce. It is not simply about having a younger workforce but a workforce whose primary tool for communication is social media. If your company is in the services business, it probably means your employee base is using technological tools to deliver business solutions. Finally, consider the data-driven nature of business today so using technological tools to deliver products and solutions is something your company most probably does now. Finally, never forget the social part of social media. Social media is a more holistic, multiple-sided communication. Not only are you setting out expectations but also these tools allow you to receive back communications from your employees. The D&B experience around the name change for its Code of Conduct is but one example. You can also see that if you have several concerns expressed it could alert you earlier to begin some detection and move towards prevention in your compliance program. Another approach is to use audio as a part of your compliance communications. Podcasts are a great way to tell a long form story about your compliance successes and challenges. Ronnie Feldman, founder of L&E Entertainment continually reminds us that the engagement of your compliance audience is through the entertainment of your compliance communications. But the key is the audio format can be a powerful tool for you and a way to reach your employee base that you are not taking advantage. It can be as simple as interviewing employees on the importance of culture and how they use culture to guide their decision-making process in their daily work. You are only limited by your imagination.  Three key takeaways: 1. Incorporation of social media into your compliance communications can pay big dividends. 2. Focus on the ‘social’ part of social media. 3. Consider incorporating podcasts and other audio clips into your compliance communications and training. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 10 Jan 2022 05:00:00 -0000 The Use of Social Media in Compliance bonus 10 Thomas Fox In Day 10 of 31 Days to a More Effective Compliance Program we discuss using social media in your compliance program. What is the message of compliance inside of a corporation and how it is distributed? In a compliance program, the largest portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communications are free or available at very low cost. Why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward?  Louis Sapirman, Vice President and Chief Ethics & Compliance Officer for Panasonic Corporation of North America – Panasonic USA, often talks about the integration of social media into compliance. You should start with the tech-savvy nature of the today’s workforce. It is not simply about having a younger workforce but a workforce whose primary tool for communication is social media. If your company is in the services business, it probably means your employee base is using technological tools to deliver business solutions. Finally, consider the data-driven nature of business today so using technological tools to deliver products and solutions is something your company most probably does now. Finally, never forget the social part of social media. Social media is a more holistic, multiple-sided communication. Not only are you setting out expectations but also these tools allow you to receive back communications from your employees. The D&B experience around the name change for its Code of Conduct is but one example. You can also see that if you have several concerns expressed it could alert you earlier to begin some detection and move towards prevention in your compliance program. Another approach is to use audio as a part of your compliance communications. Podcasts are a great way to tell a long form story about your compliance successes and challenges. Ronnie Feldman, founder of L&E Entertainment continually reminds us that the engagement of your compliance audience is through the entertainment of your compliance communications. But the key is the audio format can be a powerful tool for you and a way to reach your employee base that you are not taking advantage. It can be as simple as interviewing employees on the importance of culture and how they use culture to guide their decision-making process in their daily work. You are only limited by your imagination.  Three key takeaways: 1. Incorporation of social media into your compliance communications can pay big dividends. 2. Focus on the ‘social’ part of social media. 3. Consider incorporating podcasts and other audio clips into your compliance communications and training. Learn more about your ad choices. Visit megaphone.fm/adchoices What is the message of compliance inside of a corporation and how it is distributed? In a compliance program, the largest portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communications are free or available at very low cost. Why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward? 

Louis Sapirman, Vice President and Chief Ethics & Compliance Officer for Panasonic Corporation of North America – Panasonic USA, often talks about the integration of social media into compliance. You should start with the tech-savvy nature of the today’s workforce. It is not simply about having a younger workforce but a workforce whose primary tool for communication is social media. If your company is in the services business, it probably means your employee base is using technological tools to deliver business solutions. Finally, consider the data-driven nature of business today so using technological tools to deliver products and solutions is something your company most probably does now.

Finally, never forget the social part of social media. Social media is a more holistic, multiple-sided communication. Not only are you setting out expectations but also these tools allow you to receive back communications from your employees. The D&B experience around the name change for its Code of Conduct is but one example. You can also see that if you have several concerns expressed it could alert you earlier to begin some detection and move towards prevention in your compliance program.

Another approach is to use audio as a part of your compliance communications. Podcasts are a great way to tell a long form story about your compliance successes and challenges. Ronnie Feldman, founder of L&E Entertainment continually reminds us that the engagement of your compliance audience is through the entertainment of your compliance communications. But the key is the audio format can be a powerful tool for you and a way to reach your employee base that you are not taking advantage. It can be as simple as interviewing employees on the importance of culture and how they use culture to guide their decision-making process in their daily work. You are only limited by your imagination.

 Three key takeaways:

1. Incorporation of social media into your compliance communications can pay big dividends.

2. Focus on the ‘social’ part of social media.

3. Consider incorporating podcasts and other audio clips into your compliance communications and training.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 580 no Day 9 - 360 Degrees of Compliance Communications A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is in touch with and visible to your employees at all times. It is about creating a distinctive brand philosophy of compliance which is centered on your consumers. In other words, it helps a compliance practitioner to anticipate all the aspects of your employees needs around compliance. This is especially true when compliance is either perceived as something that comes out of the home office or is perceived as the “Land of No.” A 360-degree view of compliance gives you the opportunity to build a new brand image for your compliance program. This is important as the 2020 Update mandates that for a compliance program to be effective, it must be understood by a wide variety of stakeholders. Communications is often thought of as a two-way street, upward and downward, inbound and outbound, or side-to-side. However, it is better to think of it as a 360-degree effort. You simply can no longer effectively communicate in just two ways. You now communicate in a more holistic manner, and in multiple ways. If you are just thinking about communications in the classic form, you are missing something that is happening around you. 360-degrees of compliance communication is not just a classic form of communication but rather it is a communication in the concept of every interaction, whether they be planned or accidental. It is all a form of communication. This is particularly true if you are a compliance professional, practitioner or CCO. The things you do, the way you act, and the way people see you, you are always communicating. It is not simply communicating one to one as often you may be communicating to a group across siloed boundaries, to the constituencies you had not even planned to initially communicate with. It also allows you to see and hear new ideas, concepts or simply ways to create a more effective compliance regime for your front line BD folks and your first line of defense.  Three key takeaways: 1. Remember the definition of 360-degrees of communication. It is an effort that moves the compliance identity into a holistic approach so compliance is in touch and visible to your employees at all times 2. What is your objective? What are you trying to do with your 360-degrees of communications and how are you using that mechanism to deliver the objectives of your compliance program? 3. Evaluate. You need to evaluate three factors: 1) has the message been delivered; 2) has it been heard; and 3) is it being implemented? Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 09 Jan 2022 05:00:00 -0000 360 Degrees of Compliance Communications bonus 9 Thomas Fox In Day 9 of 31 Days to a More Effective Compliance Program we discuss 360 Degrees of Compliance Communications. A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is in touch with and visible to your employees at all times. It is about creating a distinctive brand philosophy of compliance which is centered on your consumers. In other words, it helps a compliance practitioner to anticipate all the aspects of your employees needs around compliance. This is especially true when compliance is either perceived as something that comes out of the home office or is perceived as the “Land of No.” A 360-degree view of compliance gives you the opportunity to build a new brand image for your compliance program. This is important as the 2020 Update mandates that for a compliance program to be effective, it must be understood by a wide variety of stakeholders. Communications is often thought of as a two-way street, upward and downward, inbound and outbound, or side-to-side. However, it is better to think of it as a 360-degree effort. You simply can no longer effectively communicate in just two ways. You now communicate in a more holistic manner, and in multiple ways. If you are just thinking about communications in the classic form, you are missing something that is happening around you. 360-degrees of compliance communication is not just a classic form of communication but rather it is a communication in the concept of every interaction, whether they be planned or accidental. It is all a form of communication. This is particularly true if you are a compliance professional, practitioner or CCO. The things you do, the way you act, and the way people see you, you are always communicating. It is not simply communicating one to one as often you may be communicating to a group across siloed boundaries, to the constituencies you had not even planned to initially communicate with. It also allows you to see and hear new ideas, concepts or simply ways to create a more effective compliance regime for your front line BD folks and your first line of defense.  Three key takeaways: 1. Remember the definition of 360-degrees of communication. It is an effort that moves the compliance identity into a holistic approach so compliance is in touch and visible to your employees at all times 2. What is your objective? What are you trying to do with your 360-degrees of communications and how are you using that mechanism to deliver the objectives of your compliance program? 3. Evaluate. You need to evaluate three factors: 1) has the message been delivered; 2) has it been heard; and 3) is it being implemented? Learn more about your ad choices. Visit megaphone.fm/adchoices A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is in touch with and visible to your employees at all times. It is about creating a distinctive brand philosophy of compliance which is centered on your consumers. In other words, it helps a compliance practitioner to anticipate all the aspects of your employees needs around compliance. This is especially true when compliance is either perceived as something that comes out of the home office or is perceived as the “Land of No.” A 360-degree view of compliance gives you the opportunity to build a new brand image for your compliance program. This is important as the 2020 Update mandates that for a compliance program to be effective, it must be understood by a wide variety of stakeholders.

Communications is often thought of as a two-way street, upward and downward, inbound and outbound, or side-to-side. However, it is better to think of it as a 360-degree effort. You simply can no longer effectively communicate in just two ways. You now communicate in a more holistic manner, and in multiple ways. If you are just thinking about communications in the classic form, you are missing something that is happening around you.

360-degrees of compliance communication is not just a classic form of communication but rather it is a communication in the concept of every interaction, whether they be planned or accidental. It is all a form of communication. This is particularly true if you are a compliance professional, practitioner or CCO. The things you do, the way you act, and the way people see you, you are always communicating. It is not simply communicating one to one as often you may be communicating to a group across siloed boundaries, to the constituencies you had not even planned to initially communicate with. It also allows you to see and hear new ideas, concepts or simply ways to create a more effective compliance regime for your front line BD folks and your first line of defense. 

Three key takeaways:

1. Remember the definition of 360-degrees of communication. It is an effort that moves the compliance identity into a holistic approach so compliance is in touch and visible to your employees at all times

2. What is your objective? What are you trying to do with your 360-degrees of communications and how are you using that mechanism to deliver the objectives of your compliance program?

3. Evaluate. You need to evaluate three factors: 1) has the message been delivered; 2) has it been heard; and 3) is it being implemented?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 570 no Day 8 - Internal Controls and Compliance What are internal controls? The best definition I have come across is from Jonathan Marks who defined internal controls as: An internal control is an action or process of interlocking activities designed to support the policies and procedures detailing the specific preventative, detective, corrective, directive and corroborative actions required to achieve the desired process outcomes or the objectives(s). This, along with continuous auditing, continuous monitoring and training reasonably assures:  The achievement of the process objectives linked to the organization’s objectives; Operational effectiveness and efficiency; Reliable (complete and accurate) books and records (financial reporting); Compliance with laws, regulations and policies; and  The reduction of risk-fraud, waste and abuse, which,    Aids in the decline of process and policy variation, leading to more predictive outcomes. The DOJ and SEC, in the 2020 FCPA Resource Guide, stated: Internal controls over financial reporting are the processes used by compa­nies to provide reasonable assurances regarding the reliabil­ity of financial reporting and the preparation of financial statements. They include various components, such as: a control environment that covers the tone set by the organi­zation regarding integrity and ethics; risk assessments; con­trol activities that cover policies and procedures designed to ensure that management directives are carried out (e.g., approvals, authorizations, reconciliations, and segregation of duties); information and communication; and monitoring. … The design of a company’s internal controls must take into account the operational realities and risks attendant to the company’s business, such as: the nature of its products or services; how the products or services get to market; the nature of its work force; the degree of regulation; the extent of its government interaction; and the degree to which it has operations in countries with a high risk of corruption. This was supplemented in the 2020 Update, with a pair of pointed questions: whether a company has made significant investigation into its internal controls and have they been tested, then remediated based upon the testing? The bottom line is that internal controls are just good financial controls. The internal controls that detail requirements for third-party representatives in the compliance context will help to detect fraud, which could well lead to bribery and corruption. As an exercise, map your existing internal controls to the Ten Hallmarks of an Effective Compliance Program or some other well-known anti-corruption regime to see where gaps may exist. This will help you to determine whether adequate compliance internal controls are present in your company. From there you can move to see if they are working in practice. Three key takeaways: Effective internal controls are required under the FCPA Internal controls are a critical part of any best practices compliance program There are four significant controls for the compliance practitioner to implement initially. (a) Delegation of authority (DOA); (b) Maintenance of the vendor master file; (c) Contracts with third parties; and (d) Movement of cash/currency. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 08 Jan 2022 05:00:00 -0000 Internal Controls and Compliance bonus 8 Thomas Fox In Day 8 of 31 Days to a More Effective Compliance Program we discuss internal controls and compliance. What are internal controls? The best definition I have come across is from Jonathan Marks who defined internal controls as: An internal control is an action or process of interlocking activities designed to support the policies and procedures detailing the specific preventative, detective, corrective, directive and corroborative actions required to achieve the desired process outcomes or the objectives(s). This, along with continuous auditing, continuous monitoring and training reasonably assures:  The achievement of the process objectives linked to the organization’s objectives; Operational effectiveness and efficiency; Reliable (complete and accurate) books and records (financial reporting); Compliance with laws, regulations and policies; and  The reduction of risk-fraud, waste and abuse, which,    Aids in the decline of process and policy variation, leading to more predictive outcomes. The DOJ and SEC, in the 2020 FCPA Resource Guide, stated: Internal controls over financial reporting are the processes used by compa­nies to provide reasonable assurances regarding the reliabil­ity of financial reporting and the preparation of financial statements. They include various components, such as: a control environment that covers the tone set by the organi­zation regarding integrity and ethics; risk assessments; con­trol activities that cover policies and procedures designed to ensure that management directives are carried out (e.g., approvals, authorizations, reconciliations, and segregation of duties); information and communication; and monitoring. … The design of a company’s internal controls must take into account the operational realities and risks attendant to the company’s business, such as: the nature of its products or services; how the products or services get to market; the nature of its work force; the degree of regulation; the extent of its government interaction; and the degree to which it has operations in countries with a high risk of corruption. This was supplemented in the 2020 Update, with a pair of pointed questions: whether a company has made significant investigation into its internal controls and have they been tested, then remediated based upon the testing? The bottom line is that internal controls are just good financial controls. The internal controls that detail requirements for third-party representatives in the compliance context will help to detect fraud, which could well lead to bribery and corruption. As an exercise, map your existing internal controls to the Ten Hallmarks of an Effective Compliance Program or some other well-known anti-corruption regime to see where gaps may exist. This will help you to determine whether adequate compliance internal controls are present in your company. From there you can move to see if they are working in practice. Three key takeaways: Effective internal controls are required under the FCPA Internal controls are a critical part of any best practices compliance program There are four significant controls for the compliance practitioner to implement initially. (a) Delegation of authority (DOA); (b) Maintenance of the vendor master file; (c) Contracts with third parties; and (d) Movement of cash/currency. Learn more about your ad choices. Visit megaphone.fm/adchoices What are internal controls? The best definition I have come across is from Jonathan Marks who defined internal controls as:

An internal control is an action or process of interlocking activities designed to support the policies and procedures detailing the specific preventative, detective, corrective, directive and corroborative actions required to achieve the desired process outcomes or the objectives(s). This, along with continuous auditing, continuous monitoring and training reasonably assures: 

  • The achievement of the process objectives linked to the organization’s objectives;
  • Operational effectiveness and efficiency;
  • Reliable (complete and accurate) books and records (financial reporting);
  • Compliance with laws, regulations and policies; and 
  • The reduction of risk-fraud, waste and abuse, which,

   Aids in the decline of process and policy variation, leading to more predictive outcomes.

The DOJ and SEC, in the 2020 FCPA Resource Guide, stated:

Internal controls over financial reporting are the processes used by compa­nies to provide reasonable assurances regarding the reliabil­ity of financial reporting and the preparation of financial statements. They include various components, such as: a control environment that covers the tone set by the organi­zation regarding integrity and ethics; risk assessments; con­trol activities that cover policies and procedures designed to ensure that management directives are carried out (e.g., approvals, authorizations, reconciliations, and segregation of duties); information and communication; and monitoring. … The design of a company’s internal controls must take into account the operational realities and risks attendant to the company’s business, such as: the nature of its products or services; how the products or services get to market; the nature of its work force; the degree of regulation; the extent of its government interaction; and the degree to which it has operations in countries with a high risk of corruption.

This was supplemented in the 2020 Update, with a pair of pointed questions: whether a company has made significant investigation into its internal controls and have they been tested, then remediated based upon the testing?

The bottom line is that internal controls are just good financial controls. The internal controls that detail requirements for third-party representatives in the compliance context will help to detect fraud, which could well lead to bribery and corruption. As an exercise, map your existing internal controls to the Ten Hallmarks of an Effective Compliance Program or some other well-known anti-corruption regime to see where gaps may exist. This will help you to determine whether adequate compliance internal controls are present in your company. From there you can move to see if they are working in practice.

Three key takeaways:

  1. Effective internal controls are required under the FCPA
  2. Internal controls are a critical part of any best practices compliance program
  3. There are four significant controls for the compliance practitioner to implement initially. (a) Delegation of authority (DOA); (b) Maintenance of the vendor master file; (c) Contracts with third parties; and (d) Movement of cash/currency.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 497 no Day 7 - Policies and Procedures There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2020 Update made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as part of its risk assessment process.” This statement made clear that the regulators will take a strong view against a company that does not have well thought out and articulated policies and procedures against bribery and corruption; all of which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital layer of communication and acts as an internal control. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to policies and procedures in anti-corruption compliance. The specific written policies and procedures required for a best practices compliance program are well known and long established. According to the 2020 FCPA Resources Guide, some of the risks companies should keep in mind include the nature and extent of transactions with foreign governments (including payments to foreign officials); use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments. Policies help form the basis of expectations for standards of conduct in your company. Procedures are the documents that implement these standards of conduct.  Three key takeaways: 1. Written compliance policies and procedures, together the Code of Conduct, with form the backbone of your compliance program. 2. The DOJ and SEC expect a well-thought out and articulated set of compliance policies and procedures and that they be adequately communicated throughout your organization. 3. Institutional fairness for the application of policies and procedures demands consistent application of your policies and procedures across the globe. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 07 Jan 2022 05:00:00 -0000 Policies and Procedures bonus 7 Thomas Fox In Day 7 of 31 Days to a More Effective Compliance Program we take up Policies and Procedures. There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2020 Update made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as part of its risk assessment process.” This statement made clear that the regulators will take a strong view against a company that does not have well thought out and articulated policies and procedures against bribery and corruption; all of which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital layer of communication and acts as an internal control. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to policies and procedures in anti-corruption compliance. The specific written policies and procedures required for a best practices compliance program are well known and long established. According to the 2020 FCPA Resources Guide, some of the risks companies should keep in mind include the nature and extent of transactions with foreign governments (including payments to foreign officials); use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments. Policies help form the basis of expectations for standards of conduct in your company. Procedures are the documents that implement these standards of conduct.  Three key takeaways: 1. Written compliance policies and procedures, together the Code of Conduct, with form the backbone of your compliance program. 2. The DOJ and SEC expect a well-thought out and articulated set of compliance policies and procedures and that they be adequately communicated throughout your organization. 3. Institutional fairness for the application of policies and procedures demands consistent application of your policies and procedures across the globe. Learn more about your ad choices. Visit megaphone.fm/adchoices There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2020 Update made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as part of its risk assessment process.” This statement made clear that the regulators will take a strong view against a company that does not have well thought out and articulated policies and procedures against bribery and corruption; all of which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital layer of communication and acts as an internal control. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to policies and procedures in anti-corruption compliance.

The specific written policies and procedures required for a best practices compliance program are well known and long established. According to the 2020 FCPA Resources Guide, some of the risks companies should keep in mind include the nature and extent of transactions with foreign governments (including payments to foreign officials); use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments. Policies help form the basis of expectations for standards of conduct in your company. Procedures are the documents that implement these standards of conduct.

 Three key takeaways:

1. Written compliance policies and procedures, together the Code of Conduct, with form the backbone of your compliance program.

2. The DOJ and SEC expect a well-thought out and articulated set of compliance policies and procedures and that they be adequately communicated throughout your organization.

3. Institutional fairness for the application of policies and procedures demands consistent application of your policies and procedures across the globe.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 580 no Day 6 - The Code of Conduct What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in regulator’s face during an enforcement action as proof of ethical overall behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal in the creation of your company’s Code of Conduct? How important is the Code of Conduct? Consider the 2016 SEC enforcement action involving United Airlines, Inc., which turned on violation of the company’s Code of Conduct. The breach of the Code of Conduct was determined to be a FCPA internal controls violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity which has authority over, among other things, United’s operations at the company’s huge east coast hub at Newark, NJ. The substance of your Code of Conduct should be tailored to your company’s culture, and to its industry and corporate identity. It should provide a mechanism by which employees who are trying to do the right thing in the compliance and business ethics arena can do so. The Code of Conduct can be used as a basis for employee review and evaluation. It should certainly be invoked if there is a violation. Your company’s disciplinary procedures must be stated in the Code. These would include all forms of disciplines, up to and including dismissal, for serious violations of the Code. Further, your company’s Code should emphasize it will comply with all applicable laws and regulations, wherever it does business. The code needs to be written in plain English and translated into other languages as necessary so that all applicable persons can understand it. Three key takeaways: 1. A Code of Conduct is a foundational document in any compliance regime.  2. The substance of your Code of Conduct should be tailored to the company’s culture, to its industry and corporate identity. 3. “Document, Document, and Document” your training and communication efforts regarding you Code of Conduct. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 06 Jan 2022 05:00:00 -0000 Day 6 - The Code of Conduct bonus 6 Thomas Fox In Day 6 of 31 Days to a More Effective Compliance Program we take up the Code of Conduct. What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in regulator’s face during an enforcement action as proof of ethical overall behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal in the creation of your company’s Code of Conduct? How important is the Code of Conduct? Consider the 2016 SEC enforcement action involving United Airlines, Inc., which turned on violation of the company’s Code of Conduct. The breach of the Code of Conduct was determined to be a FCPA internal controls violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity which has authority over, among other things, United’s operations at the company’s huge east coast hub at Newark, NJ. The substance of your Code of Conduct should be tailored to your company’s culture, and to its industry and corporate identity. It should provide a mechanism by which employees who are trying to do the right thing in the compliance and business ethics arena can do so. The Code of Conduct can be used as a basis for employee review and evaluation. It should certainly be invoked if there is a violation. Your company’s disciplinary procedures must be stated in the Code. These would include all forms of disciplines, up to and including dismissal, for serious violations of the Code. Further, your company’s Code should emphasize it will comply with all applicable laws and regulations, wherever it does business. The code needs to be written in plain English and translated into other languages as necessary so that all applicable persons can understand it. Three key takeaways: 1. A Code of Conduct is a foundational document in any compliance regime.  2. The substance of your Code of Conduct should be tailored to the company’s culture, to its industry and corporate identity. 3. “Document, Document, and Document” your training and communication efforts regarding you Code of Conduct. Learn more about your ad choices. Visit megaphone.fm/adchoices What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in regulator’s face during an enforcement action as proof of ethical overall behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal in the creation of your company’s Code of Conduct?

How important is the Code of Conduct? Consider the 2016 SEC enforcement action involving United Airlines, Inc., which turned on violation of the company’s Code of Conduct. The breach of the Code of Conduct was determined to be a FCPA internal controls violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity which has authority over, among other things, United’s operations at the company’s huge east coast hub at Newark, NJ.

The substance of your Code of Conduct should be tailored to your company’s culture, and to its industry and corporate identity. It should provide a mechanism by which employees who are trying to do the right thing in the compliance and business ethics arena can do so. The Code of Conduct can be used as a basis for employee review and evaluation. It should certainly be invoked if there is a violation. Your company’s disciplinary procedures must be stated in the Code. These would include all forms of disciplines, up to and including dismissal, for serious violations of the Code. Further, your company’s Code should emphasize it will comply with all applicable laws and regulations, wherever it does business. The code needs to be written in plain English and translated into other languages as necessary so that all applicable persons can understand it.

Three key takeaways:

1. A Code of Conduct is a foundational document in any compliance regime. 

2. The substance of your Code of Conduct should be tailored to the company’s culture, to its industry and corporate identity.

3. “Document, Document, and Document” your training and communication efforts regarding you Code of Conduct.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 597 no Day 5 - The Board and Operationalizing Compliance The most significant development for Boards and compliance in 2021 came from the Delaware courts, which have been expanding the civil law obligations of Boards through a series of court decisions involving the expansion of the Caremark Doctrine for a couple of years. These developments began with the Marchand decision which required Boards to manage the risks their organizations face. Next was the Clovis Oncology which required ongoing monitoring by the Board. The next case is Hughes which stands for the proposition that having the structures, policies and procedures in place is not enough. The Board must fully engage in oversight of a compliance program. Finally in 2021 came Boeing which stands for the continuing proposition that a Board cannot simply have the trappings of oversight, it must do the serious work required and have evidence of that work (Document, Document, and Document). The decision in Boeing is yet a further expansion of the Caremark Doctrine, once again beginning with Marchand. Boeing also stands for the proposition that a company must assess its risks and then manage those risks right up through the Board level. Finally a Board must be aggressive in their approach and not simply passively taking in what management has presented to them.  The DOJ has also made clear its thoughts on the role of the Board of Directors. The role of the Board is different than that of senior management. Both the 2020 Update  and DOJ Antitrust Division’s 2019 Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations was even more explicit in announcing their expectation for robust Board oversight of a corporate compliance function.  Name any of the most recent corporate scandals; Wells Fargo, Theranos, Volkswagen, Boeing, etc., and there was no compliance expertise on the Board. It is now enshrined as a best practice for companies to have a seasoned compliance professional on the Board. I would also add the DOJ may soon expect there be a Compliance Committee separate and apart from the Audit Committee. The DOJ continually speaks about the need for companies to operationalize their compliance programs. Businesses must work to integrate compliance into the DNA of their organization. Having a Board member with specific compliance expertise or heading a Compliance Committee can provide a level of oversight and commitment to achieving this goal. The DOJ enshrined this requirement in the FCPA Corporate Enforcement Policy. This means that when your company is evaluated by the DOJ, under the factors set out in the 2020 Update and FCPA Corporate Enforcement Policy, to retrospectively determine if your company had a best practices compliance program in place at the time of any violation, you need to have not only the structure of the Board-level Compliance Committee but also the specific subject matter expertise (SME) on the Board and on that committee. All of this means that every Board of Directors needs a true compliance expert. Almost every Board has a former Chief Financial Officer (CFO), former head of Internal Audit or persons with a similar background, and often times these are also the Audit Committee members of the Board. Such a background brings a level of sophistication, training and SME that can help all companies with their financial reporting and other finance-based issues. So why is there not such SME at the Board level from the compliance profession? #Comment Begins  Three key takeaways: 1. The 2020 Update required active Board of Director engagement and oversight around compliance. 2. Board communication on compliance is a two-way street; both inbound and outbound. 3. The Delaware courts have been expanding Boards roles through expansion of the Caremark Doctrine. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 05 Jan 2022 05:00:00 -0000 Day 5 - The Board and Operationalizing Compliance bonus 5 Thomas Fox In Day of 31 Days to a More Effective Compliance Program, we consider the evolving role of the Board of Directors in compliance. The most significant development for Boards and compliance in 2021 came from the Delaware courts, which have been expanding the civil law obligations of Boards through a series of court decisions involving the expansion of the Caremark Doctrine for a couple of years. These developments began with the Marchand decision which required Boards to manage the risks their organizations face. Next was the Clovis Oncology which required ongoing monitoring by the Board. The next case is Hughes which stands for the proposition that having the structures, policies and procedures in place is not enough. The Board must fully engage in oversight of a compliance program. Finally in 2021 came Boeing which stands for the continuing proposition that a Board cannot simply have the trappings of oversight, it must do the serious work required and have evidence of that work (Document, Document, and Document). The decision in Boeing is yet a further expansion of the Caremark Doctrine, once again beginning with Marchand. Boeing also stands for the proposition that a company must assess its risks and then manage those risks right up through the Board level. Finally a Board must be aggressive in their approach and not simply passively taking in what management has presented to them.  The DOJ has also made clear its thoughts on the role of the Board of Directors. The role of the Board is different than that of senior management. Both the 2020 Update  and DOJ Antitrust Division’s 2019 Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations was even more explicit in announcing their expectation for robust Board oversight of a corporate compliance function.  Name any of the most recent corporate scandals; Wells Fargo, Theranos, Volkswagen, Boeing, etc., and there was no compliance expertise on the Board. It is now enshrined as a best practice for companies to have a seasoned compliance professional on the Board. I would also add the DOJ may soon expect there be a Compliance Committee separate and apart from the Audit Committee. The DOJ continually speaks about the need for companies to operationalize their compliance programs. Businesses must work to integrate compliance into the DNA of their organization. Having a Board member with specific compliance expertise or heading a Compliance Committee can provide a level of oversight and commitment to achieving this goal. The DOJ enshrined this requirement in the FCPA Corporate Enforcement Policy. This means that when your company is evaluated by the DOJ, under the factors set out in the 2020 Update and FCPA Corporate Enforcement Policy, to retrospectively determine if your company had a best practices compliance program in place at the time of any violation, you need to have not only the structure of the Board-level Compliance Committee but also the specific subject matter expertise (SME) on the Board and on that committee. All of this means that every Board of Directors needs a true compliance expert. Almost every Board has a former Chief Financial Officer (CFO), former head of Internal Audit or persons with a similar background, and often times these are also the Audit Committee members of the Board. Such a background brings a level of sophistication, training and SME that can help all companies with their financial reporting and other finance-based issues. So why is there not such SME at the Board level from the compliance profession? #Comment Begins  Three key takeaways: 1. The 2020 Update required active Board of Director engagement and oversight around compliance. 2. Board communication on compliance is a two-way street; both inbound and outbound. 3. The Delaware courts have been expanding Boards roles through expansion of the Caremark Doctrine. Learn more about your ad choices. Visit megaphone.fm/adchoices The most significant development for Boards and compliance in 2021 came from the Delaware courts, which have been expanding the civil law obligations of Boards through a series of court decisions involving the expansion of the Caremark Doctrine for a couple of years. These developments began with the Marchand decision which required Boards to manage the risks their organizations face. Next was the Clovis Oncology which required ongoing monitoring by the Board. The next case is Hughes which stands for the proposition that having the structures, policies and procedures in place is not enough. The Board must fully engage in oversight of a compliance program. Finally in 2021 came Boeing which stands for the continuing proposition that a Board cannot simply have the trappings of oversight, it must do the serious work required and have evidence of that work (Document, Document, and Document). The decision in Boeing is yet a further expansion of the Caremark Doctrine, once again beginning with Marchand. Boeing also stands for the proposition that a company must assess its risks and then manage those risks right up through the Board level. Finally a Board must be aggressive in their approach and not simply passively taking in what management has presented to them. 

The DOJ has also made clear its thoughts on the role of the Board of Directors. The role of the Board is different than that of senior management. Both the 2020 Update  and DOJ Antitrust Division’s 2019 Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations was even more explicit in announcing their expectation for robust Board oversight of a corporate compliance function. 

Name any of the most recent corporate scandals; Wells Fargo, Theranos, Volkswagen, Boeing, etc., and there was no compliance expertise on the Board. It is now enshrined as a best practice for companies to have a seasoned compliance professional on the Board. I would also add the DOJ may soon expect there be a Compliance Committee separate and apart from the Audit Committee.

The DOJ continually speaks about the need for companies to operationalize their compliance programs. Businesses must work to integrate compliance into the DNA of their organization. Having a Board member with specific compliance expertise or heading a Compliance Committee can provide a level of oversight and commitment to achieving this goal. The DOJ enshrined this requirement in the FCPA Corporate Enforcement Policy. This means that when your company is evaluated by the DOJ, under the factors set out in the 2020 Update and FCPA Corporate Enforcement Policy, to retrospectively determine if your company had a best practices compliance program in place at the time of any violation, you need to have not only the structure of the Board-level Compliance Committee but also the specific subject matter expertise (SME) on the Board and on that committee.

All of this means that every Board of Directors needs a true compliance expert. Almost every Board has a former Chief Financial Officer (CFO), former head of Internal Audit or persons with a similar background, and often times these are also the Audit Committee members of the Board. Such a background brings a level of sophistication, training and SME that can help all companies with their financial reporting and other finance-based issues. So why is there not such SME at the Board level from the compliance profession?

#Comment Begins

 Three key takeaways:

1. The 2020 Update required active Board of Director engagement and oversight around compliance.

2. Board communication on compliance is a two-way street; both inbound and outbound.

3. The Delaware courts have been expanding Boards roles through expansion of the Caremark Doctrine.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 616 Day 4 - Moving Compliance Tone Down Through an Organization Mike Volkov has said, “Even when a company does all the right things at the senior management level, the real issue is whether or not that culture has embedded itself in middle and lower management. A company’s culture is reflected in the values and beliefs that exist throughout the company.” To fully operationalize your compliance program, you must articulate the message of ethical values and doing business in compliance and then drive that message from the top down, throughout your organization. What should the tone in the middle be? What should middle management’s role be in the company’s compliance program? This role is critical because the majority of company employees work most directly with middle, rather than top management and, consequently, they will take their cues from how middle management responds to a situation. Perhaps most importantly, middle management must listen to the concerns of employees. Even if middle management cannot affect a direct change, it is important that employees have an outlet to express their concerns. Your organization should train middle managers to enhance listening skills in the overall context of providing training for their “Manager’s Toolkit.” This can be particularly true if there is a compliance violation or other incident which requires some form of employee discipline. Most employees think it important that there be organizational justice so that people believe they will be treated fairly. For if there is organizational justice, it engenders perceived procedural fairness which makes it more likely an employee will be willing accept a decision that they may not like or disagree with the end result. Even with great “tone at the top” and positive “mood in the middle”, you cannot stop. One of the greatest challenges of a compliance practitioner is how to impact the most front-line employees or the “tone at the bottom”. One of the things you can do is assemble a compliance focus group to find out how business is done in the field and if it differs from what your company expects from an ethical and compliance perspective. Begin by assembling a group of employees who are familiar with the challenges of doing business in a compliant manner in certain geographic regions to discuss the challenges of doing business ethically and in compliance. Ask them questions about their understanding of your compliance regime. Then categorize the answers into the theory and practice of compliance in your company. Employees often look to their direct supervisor to determine what the tone of an organization is and will be going forward. Many employees of large, multi-national organizations may never have direct contact with the CEO or even senior management. By moving the values of compliance through an organization into the middle, you will be in a much better position to inculcate these values and operationalizing compliance with them.  Three key takeaways: 1. Tone at the top—direct supervisors become the most important influence on people in the company 2. Give your middle managers a Tool Kit around compliance so they can fully operationalize compliance 3. Organizational justice is an additional way to help operationalize compliance Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 04 Jan 2022 05:00:00 -0000 Day 4 - Moving Compliance Tone Down Through an Organization bonus 4 Thomas Fox In Day 4 of 31 Days to a More Effective Compliance Program, we consider moving compliance tone down through an organization. Mike Volkov has said, “Even when a company does all the right things at the senior management level, the real issue is whether or not that culture has embedded itself in middle and lower management. A company’s culture is reflected in the values and beliefs that exist throughout the company.” To fully operationalize your compliance program, you must articulate the message of ethical values and doing business in compliance and then drive that message from the top down, throughout your organization. What should the tone in the middle be? What should middle management’s role be in the company’s compliance program? This role is critical because the majority of company employees work most directly with middle, rather than top management and, consequently, they will take their cues from how middle management responds to a situation. Perhaps most importantly, middle management must listen to the concerns of employees. Even if middle management cannot affect a direct change, it is important that employees have an outlet to express their concerns. Your organization should train middle managers to enhance listening skills in the overall context of providing training for their “Manager’s Toolkit.” This can be particularly true if there is a compliance violation or other incident which requires some form of employee discipline. Most employees think it important that there be organizational justice so that people believe they will be treated fairly. For if there is organizational justice, it engenders perceived procedural fairness which makes it more likely an employee will be willing accept a decision that they may not like or disagree with the end result. Even with great “tone at the top” and positive “mood in the middle”, you cannot stop. One of the greatest challenges of a compliance practitioner is how to impact the most front-line employees or the “tone at the bottom”. One of the things you can do is assemble a compliance focus group to find out how business is done in the field and if it differs from what your company expects from an ethical and compliance perspective. Begin by assembling a group of employees who are familiar with the challenges of doing business in a compliant manner in certain geographic regions to discuss the challenges of doing business ethically and in compliance. Ask them questions about their understanding of your compliance regime. Then categorize the answers into the theory and practice of compliance in your company. Employees often look to their direct supervisor to determine what the tone of an organization is and will be going forward. Many employees of large, multi-national organizations may never have direct contact with the CEO or even senior management. By moving the values of compliance through an organization into the middle, you will be in a much better position to inculcate these values and operationalizing compliance with them.  Three key takeaways: 1. Tone at the top—direct supervisors become the most important influence on people in the company 2. Give your middle managers a Tool Kit around compliance so they can fully operationalize compliance 3. Organizational justice is an additional way to help operationalize compliance Learn more about your ad choices. Visit megaphone.fm/adchoices Mike Volkov has said, “Even when a company does all the right things at the senior management level, the real issue is whether or not that culture has embedded itself in middle and lower management. A company’s culture is reflected in the values and beliefs that exist throughout the company.” To fully operationalize your compliance program, you must articulate the message of ethical values and doing business in compliance and then drive that message from the top down, throughout your organization.

What should the tone in the middle be? What should middle management’s role be in the company’s compliance program? This role is critical because the majority of company employees work most directly with middle, rather than top management and, consequently, they will take their cues from how middle management responds to a situation. Perhaps most importantly, middle management must listen to the concerns of employees. Even if middle management cannot affect a direct change, it is important that employees have an outlet to express their concerns. Your organization should train middle managers to enhance listening skills in the overall context of providing training for their “Manager’s Toolkit.” This can be particularly true if there is a compliance violation or other incident which requires some form of employee discipline. Most employees think it important that there be organizational justice so that people believe they will be treated fairly. For if there is organizational justice, it engenders perceived procedural fairness which makes it more likely an employee will be willing accept a decision that they may not like or disagree with the end result.

Even with great “tone at the top” and positive “mood in the middle”, you cannot stop. One of the greatest challenges of a compliance practitioner is how to impact the most front-line employees or the “tone at the bottom”. One of the things you can do is assemble a compliance focus group to find out how business is done in the field and if it differs from what your company expects from an ethical and compliance perspective. Begin by assembling a group of employees who are familiar with the challenges of doing business in a compliant manner in certain geographic regions to discuss the challenges of doing business ethically and in compliance. Ask them questions about their understanding of your compliance regime. Then categorize the answers into the theory and practice of compliance in your company.

Employees often look to their direct supervisor to determine what the tone of an organization is and will be going forward. Many employees of large, multi-national organizations may never have direct contact with the CEO or even senior management. By moving the values of compliance through an organization into the middle, you will be in a much better position to inculcate these values and operationalizing compliance with them.

 Three key takeaways:

1. Tone at the top—direct supervisors become the most important influence on people in the company

2. Give your middle managers a Tool Kit around compliance so they can fully operationalize compliance

3. Organizational justice is an additional way to help operationalize compliance

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 556 no Day 3 - Leadership’s Conduct at the Top DAG Lisa Monaco’s speech on FCPA enforcement and compliance laid out the very basics; that the key to every company is culture. She stated, “corporate culture matters. A corporate culture that fails to hold individuals accountable, or fails to invest in compliance — or worse, that thumbs its nose at compliance — leads to bad results.” From the enforcement perspective, the DOJ will be assessing companies for the ethical cultures. From the compliance perspective, the ethical tone of a company and accountability all starts at the top and, most specifically, senior management. This requirement is more than simply the ubiquitous “tone-at-the-top,” as it focuses on the conduct of senior management. The DOJ wants to see a company’s senior leadership actually doing compliance. The DOJ asks if company leadership has, through their words and concrete actions, brought the right message of doing business ethically and in compliance to the organization. How does senior management model its behavior on a company’s values and finally, how is such conduct monitored in an organization? I once had a Chief Executive Officer (CEO), observe the following, “You want me to be the ambassador for compliance.” I immediately said yes, that is exactly what I need you to do. A CEO, as an “Ambassador of Compliance”, can fully model the conduct that senior management engage in going forward. Another area a CEO can forcefully engage an entire company is through a powerful video message about doing business the right way and in compliance. A great example was a CenterPoint Energy video put out in 2015 after the Volkswagen (VW) emissions-testing scandal became public. The video featured Scott Prochazka, CenterPoint Energy President and CEO. He used the VW scandal to proactively address culture and values at the company and used the entire scenario as an opportunity to promote integrity in the workplace. But more than simply a one-time video, the company followed up with an additional resource, entitled, Manager’s Toolkit—What does Integrity mean to you? that managers used to facilitate discussions and ongoing communications with employees around the company’s ethics and compliance programs. Finally, the cost for the video was quite reasonable as it was produced internally.  Three key takeaways: 1. Senior management must actually do compliance; not simply talk-the-talk of compliance but also walk-the-walk. 2. Use your CEO to talk about current events and how those ethical failures are lessons to be learned for your organization. 3. Your CEO as Compliance Ambassador. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 03 Jan 2022 05:00:00 -0000 Day 3 - Leadership’s Conduct at the Top bonus 3 Thomas Fox In Day 3 of 31 Days to a More Effective Compliance Program, we look at the requirement for leadership at the top. DAG Lisa Monaco’s speech on FCPA enforcement and compliance laid out the very basics; that the key to every company is culture. She stated, “corporate culture matters. A corporate culture that fails to hold individuals accountable, or fails to invest in compliance — or worse, that thumbs its nose at compliance — leads to bad results.” From the enforcement perspective, the DOJ will be assessing companies for the ethical cultures. From the compliance perspective, the ethical tone of a company and accountability all starts at the top and, most specifically, senior management. This requirement is more than simply the ubiquitous “tone-at-the-top,” as it focuses on the conduct of senior management. The DOJ wants to see a company’s senior leadership actually doing compliance. The DOJ asks if company leadership has, through their words and concrete actions, brought the right message of doing business ethically and in compliance to the organization. How does senior management model its behavior on a company’s values and finally, how is such conduct monitored in an organization? I once had a Chief Executive Officer (CEO), observe the following, “You want me to be the ambassador for compliance.” I immediately said yes, that is exactly what I need you to do. A CEO, as an “Ambassador of Compliance”, can fully model the conduct that senior management engage in going forward. Another area a CEO can forcefully engage an entire company is through a powerful video message about doing business the right way and in compliance. A great example was a CenterPoint Energy video put out in 2015 after the Volkswagen (VW) emissions-testing scandal became public. The video featured Scott Prochazka, CenterPoint Energy President and CEO. He used the VW scandal to proactively address culture and values at the company and used the entire scenario as an opportunity to promote integrity in the workplace. But more than simply a one-time video, the company followed up with an additional resource, entitled, Manager’s Toolkit—What does Integrity mean to you? that managers used to facilitate discussions and ongoing communications with employees around the company’s ethics and compliance programs. Finally, the cost for the video was quite reasonable as it was produced internally.  Three key takeaways: 1. Senior management must actually do compliance; not simply talk-the-talk of compliance but also walk-the-walk. 2. Use your CEO to talk about current events and how those ethical failures are lessons to be learned for your organization. 3. Your CEO as Compliance Ambassador. Learn more about your ad choices. Visit megaphone.fm/adchoices DAG Lisa Monaco’s speech on FCPA enforcement and compliance laid out the very basics; that the key to every company is culture. She stated, “corporate culture matters. A corporate culture that fails to hold individuals accountable, or fails to invest in compliance — or worse, that thumbs its nose at compliance — leads to bad results.”

From the enforcement perspective, the DOJ will be assessing companies for the ethical cultures. From the compliance perspective, the ethical tone of a company and accountability all starts at the top and, most specifically, senior management. This requirement is more than simply the ubiquitous “tone-at-the-top,” as it focuses on the conduct of senior management. The DOJ wants to see a company’s senior leadership actually doing compliance. The DOJ asks if company leadership has, through their words and concrete actions, brought the right message of doing business ethically and in compliance to the organization. How does senior management model its behavior on a company’s values and finally, how is such conduct monitored in an organization?

I once had a Chief Executive Officer (CEO), observe the following, “You want me to be the ambassador for compliance.” I immediately said yes, that is exactly what I need you to do. A CEO, as an “Ambassador of Compliance”, can fully model the conduct that senior management engage in going forward. Another area a CEO can forcefully engage an entire company is through a powerful video message about doing business the right way and in compliance. A great example was a CenterPoint Energy video put out in 2015 after the Volkswagen (VW) emissions-testing scandal became public. The video featured Scott Prochazka, CenterPoint Energy President and CEO. He used the VW scandal to proactively address culture and values at the company and used the entire scenario as an opportunity to promote integrity in the workplace. But more than simply a one-time video, the company followed up with an additional resource, entitled, Manager’s Toolkit—What does Integrity mean to you? that managers used to facilitate discussions and ongoing communications with employees around the company’s ethics and compliance programs. Finally, the cost for the video was quite reasonable as it was produced internally.


 Three key takeaways:

1. Senior management must actually do compliance; not simply talk-the-talk of compliance but also walk-the-walk.

2. Use your CEO to talk about current events and how those ethical failures are lessons to be learned for your organization.

3. Your CEO as Compliance Ambassador.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 616 Day 2 - Continuous Monitoring and Continuous Improvement Continuous monitoring and continuous improvement are two of the most important phrases for any compliance program. These twin concepts were perhaps the biggest modifications in the 2020 Update to the Evaluation of Corporate Compliance Programs. In 2021, all companies’ risks changed as we moved from Working From Home to Return To Office and now a hybrid work model. These changes in our basic work location drove home perhaps the most prescient comment I heard during the pandemic year of 2020, which was by Jed Gardner, who said “We have moved from disaster recovery to business continuity to business as usual.” What this means is that risks will change in ways you may not see at speeds you not anticipate. Your compliance program must be ready to respond to whatever those risks might be going forward.  In the 2020 Update, the DOJ it began to address this from the compliance program perspective with several questions. “Is the risk assessment current and subject to periodic review? Is the periodic review limited to a “snapshot” in time or based upon continuous access to operational data and information across functions? Has the periodic review led to updates in policies, procedures, and controls? Do these updates account for risks discovered through misconduct or other problems with the compliance program?”  The next area for continuous monitoring and continuous improvement was in an area of compliance which is not normally associated with those concepts, Policies and Procedures. Here questions included “When was the last time your policies and procedures were updated? Perhaps more importantly under the 2020 Update what was your process for doing so? Was there any rigor around your process? Did that rigor include incorporating information and data collected through continuous monitoring, real-time monitoring or continuous access to operational data and information across functions?” The final area in the 2020 Update for consideration is appropriate called Continuous Improvement, Periodic Testing and Review. Here the question included the following, “How often has the company updated its risk assessments and reviewed its compliance policies, procedures, and practices? Has the company undertaken a gap analysis to determine if particular areas of risk are not sufficiently addressed in its policies, controls, or training? What steps has the company taken to determine whether policies/procedures/practices make sense for particular business segments/subsidiaries? Does the company review and adapt its compliance program based upon lessons learned from its own misconduct and/or that of other companies facing similar risks?” Three key takeaways:  1. How has your company’s risks changed over the past year? 2. What is your process for continuous monitoring and improvement? 3. What sources of information do you use come from outside your organization? Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 02 Jan 2022 05:00:00 -0000 Day 2 - Continuous Monitoring and Continuous Improvement bonus 2 Thomas Fox In Day 2 of 31 Days to a More Effective Compliance Program, we consider continuous monitoring and continuous improvement. Continuous monitoring and continuous improvement are two of the most important phrases for any compliance program. These twin concepts were perhaps the biggest modifications in the 2020 Update to the Evaluation of Corporate Compliance Programs. In 2021, all companies’ risks changed as we moved from Working From Home to Return To Office and now a hybrid work model. These changes in our basic work location drove home perhaps the most prescient comment I heard during the pandemic year of 2020, which was by Jed Gardner, who said “We have moved from disaster recovery to business continuity to business as usual.” What this means is that risks will change in ways you may not see at speeds you not anticipate. Your compliance program must be ready to respond to whatever those risks might be going forward.  In the 2020 Update, the DOJ it began to address this from the compliance program perspective with several questions. “Is the risk assessment current and subject to periodic review? Is the periodic review limited to a “snapshot” in time or based upon continuous access to operational data and information across functions? Has the periodic review led to updates in policies, procedures, and controls? Do these updates account for risks discovered through misconduct or other problems with the compliance program?”  The next area for continuous monitoring and continuous improvement was in an area of compliance which is not normally associated with those concepts, Policies and Procedures. Here questions included “When was the last time your policies and procedures were updated? Perhaps more importantly under the 2020 Update what was your process for doing so? Was there any rigor around your process? Did that rigor include incorporating information and data collected through continuous monitoring, real-time monitoring or continuous access to operational data and information across functions?” The final area in the 2020 Update for consideration is appropriate called Continuous Improvement, Periodic Testing and Review. Here the question included the following, “How often has the company updated its risk assessments and reviewed its compliance policies, procedures, and practices? Has the company undertaken a gap analysis to determine if particular areas of risk are not sufficiently addressed in its policies, controls, or training? What steps has the company taken to determine whether policies/procedures/practices make sense for particular business segments/subsidiaries? Does the company review and adapt its compliance program based upon lessons learned from its own misconduct and/or that of other companies facing similar risks?” Three key takeaways:  1. How has your company’s risks changed over the past year? 2. What is your process for continuous monitoring and improvement? 3. What sources of information do you use come from outside your organization? Learn more about your ad choices. Visit megaphone.fm/adchoices Continuous monitoring and continuous improvement are two of the most important phrases for any compliance program. These twin concepts were perhaps the biggest modifications in the 2020 Update to the Evaluation of Corporate Compliance Programs. In 2021, all companies’ risks changed as we moved from Working From Home to Return To Office and now a hybrid work model. These changes in our basic work location drove home perhaps the most prescient comment I heard during the pandemic year of 2020, which was by Jed Gardner, who said “We have moved from disaster recovery to business continuity to business as usual.” What this means is that risks will change in ways you may not see at speeds you not anticipate. Your compliance program must be ready to respond to whatever those risks might be going forward. 


In the 2020 Update, the DOJ it began to address this from the compliance program perspective with several questions. “Is the risk assessment current and subject to periodic review? Is the periodic review limited to a “snapshot” in time or based upon continuous access to operational data and information across functions? Has the periodic review led to updates in policies, procedures, and controls? Do these updates account for risks discovered through misconduct or other problems with the compliance program?” 


The next area for continuous monitoring and continuous improvement was in an area of compliance which is not normally associated with those concepts, Policies and Procedures. Here questions included “When was the last time your policies and procedures were updated? Perhaps more importantly under the 2020 Update what was your process for doing so? Was there any rigor around your process? Did that rigor include incorporating information and data collected through continuous monitoring, real-time monitoring or continuous access to operational data and information across functions?”


The final area in the 2020 Update for consideration is appropriate called Continuous Improvement, Periodic Testing and Review. Here the question included the following, “How often has the company updated its risk assessments and reviewed its compliance policies, procedures, and practices? Has the company undertaken a gap analysis to determine if particular areas of risk are not sufficiently addressed in its policies, controls, or training? What steps has the company taken to determine whether policies/procedures/practices make sense for particular business segments/subsidiaries? Does the company review and adapt its compliance program based upon lessons learned from its own misconduct and/or that of other companies facing similar risks?”


Three key takeaways: 

1. How has your company’s risks changed over the past year?

2. What is your process for continuous monitoring and improvement?

3. What sources of information do you use come from outside your organization?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 616 no Day 1-What 2021 Brought to Compliance Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2021, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance. 2021 was a very significant year for every compliance practitioner and compliance program. While there was a paucity of corporate FCPA enforcement actions, the three enforcement actions were significant with multiple lessons for the compliance professional. In Deutsche Bank, we learned about the costs of a corrupt culture and recidivism, in Amec Foster Wheeler, we saw happens to a company which pays bribes and then tries back out; the criminals they are dealing with have them in an untenable position that they must continue to pay the bribes and how catastrophic failure in pre- and post-acquisition due diligence can lead to massive FCPA violations. Finally, in WPP, we saw how accepted business incentives can become perverse, what happens when you ignore whistleblowers. However, there were two major policy announcements from the Biden Administration which every compliance professional needs to not simply be aware of but study and implement solutions based upon these announcements.  In late October, Deputy Attorney General Lisa O. Monaco key changes in the DOJ approach to FCPA enforcement.: (1) “today I am directing the department to restore prior guidance making clear that to be eligible for any cooperation credit, companies must provide the department with all non-privileged information about individuals involved in or responsible for the misconduct at issue. To be clear, a company must identify all individuals involved in the misconduct, regardless of their position, status or seniority.” This portends a return to the strictures of the Yates Memo. (2) “The second change I am announcing today deals with the issue of a company’s prior misconduct and how that affects our decisions about the appropriate corporate resolution. (3) The final change I am announcing today deals with the use of corporate monitors.” This final change is a rejection of the strictures laid out in the Benczkowski Memo regarding the DOJ use of corporate monitorships. In November, the Biden Administration released the United States Strategy on Countering Corruption (the “Strategy”); subtitled “Pursuant To The National Security Study Memorandum On Establishing The Fight Against Corruption as a Core United States National Security Interest”; in response to President Biden’s prior declaration of corruption as a national security issue of the United States. While obviously focused on the US government’s role in leading the fight against corruption, the entire document portends a major sea change in the approach of fighting bribery and corruption, literally on a worldwide basis. For this reason alone, it should be studied by all compliance professionals. Obviously, this more holistic approach is most welcomed. Corruption does more than simply steal money from the world economy.  Three key takeaways: The Biden Administration released its Strategy on Countering Corruption. Deputy Attorney General Lisa Monaco gave a speech refocusing the DOJ’s efforts on FCPA and other white-collar crime. Even with a paucity of FCPA enforcement actions, there were multiple lessons for the compliance professional. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 01 Jan 2022 05:00:00 -0000 Day 1-What 2021 Brought to Compliance bonus 1 Thomas Fox Join Tom on a 31 Day exploration of how to design or enhance your compliance program. In Day 1, what 2021 brought to compliance. Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2021, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance. 2021 was a very significant year for every compliance practitioner and compliance program. While there was a paucity of corporate FCPA enforcement actions, the three enforcement actions were significant with multiple lessons for the compliance professional. In Deutsche Bank, we learned about the costs of a corrupt culture and recidivism, in Amec Foster Wheeler, we saw happens to a company which pays bribes and then tries back out; the criminals they are dealing with have them in an untenable position that they must continue to pay the bribes and how catastrophic failure in pre- and post-acquisition due diligence can lead to massive FCPA violations. Finally, in WPP, we saw how accepted business incentives can become perverse, what happens when you ignore whistleblowers. However, there were two major policy announcements from the Biden Administration which every compliance professional needs to not simply be aware of but study and implement solutions based upon these announcements.  In late October, Deputy Attorney General Lisa O. Monaco key changes in the DOJ approach to FCPA enforcement.: (1) “today I am directing the department to restore prior guidance making clear that to be eligible for any cooperation credit, companies must provide the department with all non-privileged information about individuals involved in or responsible for the misconduct at issue. To be clear, a company must identify all individuals involved in the misconduct, regardless of their position, status or seniority.” This portends a return to the strictures of the Yates Memo. (2) “The second change I am announcing today deals with the issue of a company’s prior misconduct and how that affects our decisions about the appropriate corporate resolution. (3) The final change I am announcing today deals with the use of corporate monitors.” This final change is a rejection of the strictures laid out in the Benczkowski Memo regarding the DOJ use of corporate monitorships. In November, the Biden Administration released the United States Strategy on Countering Corruption (the “Strategy”); subtitled “Pursuant To The National Security Study Memorandum On Establishing The Fight Against Corruption as a Core United States National Security Interest”; in response to President Biden’s prior declaration of corruption as a national security issue of the United States. While obviously focused on the US government’s role in leading the fight against corruption, the entire document portends a major sea change in the approach of fighting bribery and corruption, literally on a worldwide basis. For this reason alone, it should be studied by all compliance professionals. Obviously, this more holistic approach is most welcomed. Corruption does more than simply steal money from the world economy.  Three key takeaways: The Biden Administration released its Strategy on Countering Corruption. Deputy Attorney General Lisa Monaco gave a speech refocusing the DOJ’s efforts on FCPA and other white-collar crime. Even with a paucity of FCPA enforcement actions, there were multiple lessons for the compliance professional. Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2021, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance.

2021 was a very significant year for every compliance practitioner and compliance program. While there was a paucity of corporate FCPA enforcement actions, the three enforcement actions were significant with multiple lessons for the compliance professional. In Deutsche Bank, we learned about the costs of a corrupt culture and recidivism, in Amec Foster Wheeler, we saw happens to a company which pays bribes and then tries back out; the criminals they are dealing with have them in an untenable position that they must continue to pay the bribes and how catastrophic failure in pre- and post-acquisition due diligence can lead to massive FCPA violations. Finally, in WPP, we saw how accepted business incentives can become perverse, what happens when you ignore whistleblowers. However, there were two major policy announcements from the Biden Administration which every compliance professional needs to not simply be aware of but study and implement solutions based upon these announcements.

 In late October, Deputy Attorney General Lisa O. Monaco key changes in the DOJ approach to FCPA enforcement.: (1) “today I am directing the department to restore prior guidance making clear that to be eligible for any cooperation credit, companies must provide the department with all non-privileged information about individuals involved in or responsible for the misconduct at issue. To be clear, a company must identify all individuals involved in the misconduct, regardless of their position, status or seniority.” This portends a return to the strictures of the Yates Memo. (2) “The second change I am announcing today deals with the issue of a company’s prior misconduct and how that affects our decisions about the appropriate corporate resolution. (3) The final change I am announcing today deals with the use of corporate monitors.” This final change is a rejection of the strictures laid out in the Benczkowski Memo regarding the DOJ use of corporate monitorships.

In November, the Biden Administration released the United States Strategy on Countering Corruption (the “Strategy”); subtitled “Pursuant To The National Security Study Memorandum On Establishing The Fight Against Corruption as a Core United States National Security Interest”; in response to President Biden’s prior declaration of corruption as a national security issue of the United States. While obviously focused on the US government’s role in leading the fight against corruption, the entire document portends a major sea change in the approach of fighting bribery and corruption, literally on a worldwide basis. For this reason alone, it should be studied by all compliance professionals. Obviously, this more holistic approach is most welcomed. Corruption does more than simply steal money from the world economy.

 Three key takeaways:

  1. The Biden Administration released its Strategy on Countering Corruption.
  2. Deputy Attorney General Lisa Monaco gave a speech refocusing the DOJ’s efforts on FCPA and other white-collar crime.
  3. Even with a paucity of FCPA enforcement actions, there were multiple lessons for the compliance professional.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 616 no Day 31 | Using a root cause analysis for remediation The 2020 Update re-emphasized the need for both performing a root cause analysis but equally importantly using it to remediate your compliance program. It stated, “a hallmark of a compliance program that is working effectively in practice is the extent to which a company is able to conduct a thoughtful root cause analysis of misconduct and timely and appropriately remediate to address the root causes.”  It went on to state, what additional steps the company has taken “that demonstrate recognition of the seriousness of the misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risk”).” The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Identify current and future needs for organizational improvement. Your solution should be a repeatable, step-by-step processes, in which one process can confirm the results of another. Focusing on the corrective measures of root causes is more effective than simply treating the symptoms of a problem or event and you will have a much more robust solution in place. This is because the solution(s) are more effective when accomplished through a systematic process with conclusions backed up by evidence. When you step back and consider what the DOJ was trying to accomplish with its 2020 Update, it becomes clear what the DOJ expects from the compliance professional. Consider the structure of your compliance program and how it inter-relates to your company’s risk profile. When you have a compliance failure, use the root cause analysis to think about how each of the structural elements of your compliance program could impact how you manage and deal with that risk. Three key takeaways: The key is objectivity and independence. The critical element is how did you use the information you developed in the root cause analysis? The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 31 Jan 2021 17:30:38 -0000 Day 31 | Using a root cause analysis for remediation full Thomas Fox How should you utilize a root cause analysis for remediation going forward? The 2020 Update re-emphasized the need for both performing a root cause analysis but equally importantly using it to remediate your compliance program. It stated, “a hallmark of a compliance program that is working effectively in practice is the extent to which a company is able to conduct a thoughtful root cause analysis of misconduct and timely and appropriately remediate to address the root causes.”  It went on to state, what additional steps the company has taken “that demonstrate recognition of the seriousness of the misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risk”).” The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Identify current and future needs for organizational improvement. Your solution should be a repeatable, step-by-step processes, in which one process can confirm the results of another. Focusing on the corrective measures of root causes is more effective than simply treating the symptoms of a problem or event and you will have a much more robust solution in place. This is because the solution(s) are more effective when accomplished through a systematic process with conclusions backed up by evidence. When you step back and consider what the DOJ was trying to accomplish with its 2020 Update, it becomes clear what the DOJ expects from the compliance professional. Consider the structure of your compliance program and how it inter-relates to your company’s risk profile. When you have a compliance failure, use the root cause analysis to think about how each of the structural elements of your compliance program could impact how you manage and deal with that risk. Three key takeaways: The key is objectivity and independence. The critical element is how did you use the information you developed in the root cause analysis? The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2020 Update re-emphasized the need for both performing a root cause analysis but equally importantly using it to remediate your compliance program. It stated, “a hallmark of a compliance program that is working effectively in practice is the extent to which a company is able to conduct a thoughtful root cause analysis of misconduct and timely and appropriately remediate to address the root causes.”

 It went on to state, what additional steps the company has taken “that demonstrate recognition of the seriousness of the misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risk”).”

The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Identify current and future needs for organizational improvement. Your solution should be a repeatable, step-by-step processes, in which one process can confirm the results of another. Focusing on the corrective measures of root causes is more effective than simply treating the symptoms of a problem or event and you will have a much more robust solution in place. This is because the solution(s) are more effective when accomplished through a systematic process with conclusions backed up by evidence.

When you step back and consider what the DOJ was trying to accomplish with its 2020 Update, it becomes clear what the DOJ expects from the compliance professional. Consider the structure of your compliance program and how it inter-relates to your company’s risk profile. When you have a compliance failure, use the root cause analysis to think about how each of the structural elements of your compliance program could impact how you manage and deal with that risk.

Three key takeaways:

  1. The key is objectivity and independence.
  2. The critical element is how did you use the information you developed in the root cause analysis?
  3. The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 521 no Day 30 | What is a root cause analysis? One of the biggest changes in the 2020 FCPA Resource Guide is the addition of a new Hallmark, entitled “Investigation, Analysis, and Remediation of Misconduct”, which reads in full: The truest measure of an effective compliance program is how it responds to misconduct. Accordingly, for a compliance program to be truly effective, it should have a well-functioning and appropriately funded mechanism for the timely and thorough investigations of any allegations or suspicions of misconduct by the company, its employees, or agents. An effective investigations structure will also have an established means of documenting the company’s response, including any disciplinary or remediation measures taken. In addition to having a mechanism for responding to the specific incident of misconduct, the company’s program should also integrate lessons learned from any misconduct into the company’s policies, training, and controls. To do so, a company will need to analyze the root causes of the misconduct to timely and appropriately remediate those causes to prevent future compliance breaches.  Ultimately, performing a root cause analysis is not simply a matter of sitting down and asking a multitude of questions. You need to have an operational understanding of how a business operates and how they have developed their customer base. Overlay the need to understand what makes an effective compliance program, with the skepticism an auditor should bring so that you do not simply accept an answer that is provided to you, as you might in an internal investigation. As Marks noted, “a root cause analysis is not something where you can just go ask the five whys. You need these trained professionals who really understand what they’re doing.” Three key takeaways: A root cause analysis is now required if you have a reportable compliance failure. There is no one process for performing a root cause analysis. You should select the one which works for you and follow it. To properly perform a root cause analysis, you need trained professionals who really understand what they’re doing. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 30 Jan 2021 12:36:09 -0000 Day 30 | What is a root cause analysis? full Thomas Fox What is a root cause analysis and how should you utilize it? One of the biggest changes in the 2020 FCPA Resource Guide is the addition of a new Hallmark, entitled “Investigation, Analysis, and Remediation of Misconduct”, which reads in full: The truest measure of an effective compliance program is how it responds to misconduct. Accordingly, for a compliance program to be truly effective, it should have a well-functioning and appropriately funded mechanism for the timely and thorough investigations of any allegations or suspicions of misconduct by the company, its employees, or agents. An effective investigations structure will also have an established means of documenting the company’s response, including any disciplinary or remediation measures taken. In addition to having a mechanism for responding to the specific incident of misconduct, the company’s program should also integrate lessons learned from any misconduct into the company’s policies, training, and controls. To do so, a company will need to analyze the root causes of the misconduct to timely and appropriately remediate those causes to prevent future compliance breaches.  Ultimately, performing a root cause analysis is not simply a matter of sitting down and asking a multitude of questions. You need to have an operational understanding of how a business operates and how they have developed their customer base. Overlay the need to understand what makes an effective compliance program, with the skepticism an auditor should bring so that you do not simply accept an answer that is provided to you, as you might in an internal investigation. As Marks noted, “a root cause analysis is not something where you can just go ask the five whys. You need these trained professionals who really understand what they’re doing.” Three key takeaways: A root cause analysis is now required if you have a reportable compliance failure. There is no one process for performing a root cause analysis. You should select the one which works for you and follow it. To properly perform a root cause analysis, you need trained professionals who really understand what they’re doing. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the biggest changes in the 2020 FCPA Resource Guide is the addition of a new Hallmark, entitled “Investigation, Analysis, and Remediation of Misconduct”, which reads in full:

The truest measure of an effective compliance program is how it responds to misconduct. Accordingly, for a compliance program to be truly effective, it should have a well-functioning and appropriately funded mechanism for the timely and thorough investigations of any allegations or suspicions of misconduct by the company, its employees, or agents. An effective investigations structure will also have an established means of documenting the company’s response, including any disciplinary or remediation measures taken.

In addition to having a mechanism for responding to the specific incident of misconduct, the company’s program should also integrate lessons learned from any misconduct into the company’s policies, training, and controls. To do so, a company will need to analyze the root causes of the misconduct to timely and appropriately remediate those causes to prevent future compliance breaches. 

Ultimately, performing a root cause analysis is not simply a matter of sitting down and asking a multitude of questions. You need to have an operational understanding of how a business operates and how they have developed their customer base. Overlay the need to understand what makes an effective compliance program, with the skepticism an auditor should bring so that you do not simply accept an answer that is provided to you, as you might in an internal investigation. As Marks noted, “a root cause analysis is not something where you can just go ask the five whys. You need these trained professionals who really understand what they’re doing.”

Three key takeaways:

  1. A root cause analysis is now required if you have a reportable compliance failure.
  2. There is no one process for performing a root cause analysis. You should select the one which works for you and follow it.
  3. To properly perform a root cause analysis, you need trained professionals who really understand what they’re doing.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 461 no Day 29 | Post-acquisition integration plan Your company has just made its largest acquisition ever and your CEO says they want you to have a compliance post-acquisition integration plan on their desk in one week. Where do you begin? A good place to start would be the 2020 FCPA Resource Guide language: Pre-acquisition due diligence, however, is normally only a portion of the compliance process for mergers and acquisitions. DOJ and SEC evaluate whether the acquiring company promptly incorporated the acquired company into all of its internal controls, including its compliance program. Companies should consider training new employees, reevaluating third parties under company standards, and, where appropriate, conducting audits on new business units. The bottom line is that you must train the newly acquired employees, reevaluate third parties under your company standards, and conduct compliance audits on new business units. This process should be based your pre-acquisition due diligence and risk assessment. Moreover, the DOJ and SEC clearly view both the pre- and post-acquisition phases of M&A as tied together in a unidimensional continuum. If pre-acquisition due diligence is not possible, you should review the requirements and time frames laid out in Opinion Release 08-02 or the 2020 FCPA Resource Guide, which noted, “pursuant to which companies can nevertheless be rewarded if they choose to conduct thorough post-acquisition FCPA due diligence.” Whatever compendium of steps you utilize for post-acquisition integration, they should be taken as soon as is practicable.  The earlier you can deploy these steps the better off your company will be at the end of the day. An acquisition that fails for compliance reasons is a preventable disaster of the first order. One need only consider the Latin Node Inc. FCPA enforcement actions where the acquiring company had to write off its entire investment because it had wholly failed to engage in appropriate pre-acquisition due diligence.  Three key takeaways: Planning is critical in the post-acquisition phase. Build upon what you learned in pre-acquisition due diligence. You literally need to be ready to hit the ground running when a transaction closes. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 29 Jan 2021 17:00:00 -0000 Day 29 | Post-acquisition integration plan full Thomas Fox What is your post-acquisition integration? Your company has just made its largest acquisition ever and your CEO says they want you to have a compliance post-acquisition integration plan on their desk in one week. Where do you begin? A good place to start would be the 2020 FCPA Resource Guide language: Pre-acquisition due diligence, however, is normally only a portion of the compliance process for mergers and acquisitions. DOJ and SEC evaluate whether the acquiring company promptly incorporated the acquired company into all of its internal controls, including its compliance program. Companies should consider training new employees, reevaluating third parties under company standards, and, where appropriate, conducting audits on new business units. The bottom line is that you must train the newly acquired employees, reevaluate third parties under your company standards, and conduct compliance audits on new business units. This process should be based your pre-acquisition due diligence and risk assessment. Moreover, the DOJ and SEC clearly view both the pre- and post-acquisition phases of M&A as tied together in a unidimensional continuum. If pre-acquisition due diligence is not possible, you should review the requirements and time frames laid out in Opinion Release 08-02 or the 2020 FCPA Resource Guide, which noted, “pursuant to which companies can nevertheless be rewarded if they choose to conduct thorough post-acquisition FCPA due diligence.” Whatever compendium of steps you utilize for post-acquisition integration, they should be taken as soon as is practicable.  The earlier you can deploy these steps the better off your company will be at the end of the day. An acquisition that fails for compliance reasons is a preventable disaster of the first order. One need only consider the Latin Node Inc. FCPA enforcement actions where the acquiring company had to write off its entire investment because it had wholly failed to engage in appropriate pre-acquisition due diligence.  Three key takeaways: Planning is critical in the post-acquisition phase. Build upon what you learned in pre-acquisition due diligence. You literally need to be ready to hit the ground running when a transaction closes. Learn more about your ad choices. Visit megaphone.fm/adchoices Your company has just made its largest acquisition ever and your CEO says they want you to have a compliance post-acquisition integration plan on their desk in one week. Where do you begin? A good place to start would be the 2020 FCPA Resource Guide language:

Pre-acquisition due diligence, however, is normally only a portion of the compliance process for mergers and acquisitions. DOJ and SEC evaluate whether the acquiring company promptly incorporated the acquired company into all of its internal controls, including its compliance program. Companies should consider training new employees, reevaluating third parties under company standards, and, where appropriate, conducting audits on new business units.

The bottom line is that you must train the newly acquired employees, reevaluate third parties under your company standards, and conduct compliance audits on new business units. This process should be based your pre-acquisition due diligence and risk assessment. Moreover, the DOJ and SEC clearly view both the pre- and post-acquisition phases of M&A as tied together in a unidimensional continuum. If pre-acquisition due diligence is not possible, you should review the requirements and time frames laid out in Opinion Release 08-02 or the 2020 FCPA Resource Guide, which noted, “pursuant to which companies can nevertheless be rewarded if they choose to conduct thorough post-acquisition FCPA due diligence.” Whatever compendium of steps you utilize for post-acquisition integration, they should be taken as soon as is practicable. 

The earlier you can deploy these steps the better off your company will be at the end of the day. An acquisition that fails for compliance reasons is a preventable disaster of the first order. One need only consider the Latin Node Inc. FCPA enforcement actions where the acquiring company had to write off its entire investment because it had wholly failed to engage in appropriate pre-acquisition due diligence.

 Three key takeaways:

  1. Planning is critical in the post-acquisition phase.
  2. Build upon what you learned in pre-acquisition due diligence.
  3. You literally need to be ready to hit the ground running when a transaction closes.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 461 no Day 28 | Pre-acquisition due diligence in mergers and acquisitions A company that does not perform adequate due diligence prior to a merger or acquisition may face both legal and business risks. Perhaps most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. While most compliance practitioners have been long aware of the requirement in the post-acquisition context, the 2012 FCPA Guidance focused many compliance practitioners of the need to engage in robust pre-acquisition due diligence.  The 2020 Update made even more clear the need for a robust compliance presence in the pre-acquisition phase. It stated, “A well-designed compliance program should include comprehensive due diligence of any acquisition targets, as well as a process for timely and orderly integration of the acquired entity into existing compliance program structures and internal controls. Pre-M&A due diligence, where possible, enables the acquiring company to evaluate more accurately each target’s value and negotiate for the costs of any corruption or misconduct to be borne by the target. Flawed or incomplete pre- or post-acquisition due diligence and integration can allow misconduct to continue at the target company, causing resulting harm to a business’s profitability and reputation and risking civil and criminal liability.” There are multiple red flags which could be raised in this process, which might well warrant further investigation. They include if the target has ineffective compliance program elements in their compliance program or if there were frequent breach of policies and procedures. Obviously, a target which is in financial difficulty would bear closer scrutiny. Structurally, if the company did not have a formal ethics and compliance committee at the senior management or Board of Directors’ level, this could present issues. From the CCO perspective, if the position did not have Board or CEO access or if there were not regular reports to the Board, it could present an issue for compliance. Conversely, if there were frequent requests to waive policies, management over-ride of compliance controls or no consistent consequence management for violations; it could present clear red flags for further investigation. Three key takeaways:  The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward. Periodically review your M&A due diligence protocol. If red flags appear in pre-acquisition due diligence, they should be cleared. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 28 Jan 2021 17:00:00 -0000 Day 28 | Pre-acquisition due diligence in mergers and acquisitions full Thomas Fox A company that does not perform adequate due diligence prior to a merger or acquisition may face both legal and business risks. A company that does not perform adequate due diligence prior to a merger or acquisition may face both legal and business risks. Perhaps most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. While most compliance practitioners have been long aware of the requirement in the post-acquisition context, the 2012 FCPA Guidance focused many compliance practitioners of the need to engage in robust pre-acquisition due diligence.  The 2020 Update made even more clear the need for a robust compliance presence in the pre-acquisition phase. It stated, “A well-designed compliance program should include comprehensive due diligence of any acquisition targets, as well as a process for timely and orderly integration of the acquired entity into existing compliance program structures and internal controls. Pre-M&A due diligence, where possible, enables the acquiring company to evaluate more accurately each target’s value and negotiate for the costs of any corruption or misconduct to be borne by the target. Flawed or incomplete pre- or post-acquisition due diligence and integration can allow misconduct to continue at the target company, causing resulting harm to a business’s profitability and reputation and risking civil and criminal liability.” There are multiple red flags which could be raised in this process, which might well warrant further investigation. They include if the target has ineffective compliance program elements in their compliance program or if there were frequent breach of policies and procedures. Obviously, a target which is in financial difficulty would bear closer scrutiny. Structurally, if the company did not have a formal ethics and compliance committee at the senior management or Board of Directors’ level, this could present issues. From the CCO perspective, if the position did not have Board or CEO access or if there were not regular reports to the Board, it could present an issue for compliance. Conversely, if there were frequent requests to waive policies, management over-ride of compliance controls or no consistent consequence management for violations; it could present clear red flags for further investigation. Three key takeaways:  The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward. Periodically review your M&A due diligence protocol. If red flags appear in pre-acquisition due diligence, they should be cleared. Learn more about your ad choices. Visit megaphone.fm/adchoices A company that does not perform adequate due diligence prior to a merger or acquisition may face both legal and business risks. Perhaps most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. While most compliance practitioners have been long aware of the requirement in the post-acquisition context, the 2012 FCPA Guidance focused many compliance practitioners of the need to engage in robust pre-acquisition due diligence. 

The 2020 Update made even more clear the need for a robust compliance presence in the pre-acquisition phase. It stated, “A well-designed compliance program should include comprehensive due diligence of any acquisition targets, as well as a process for timely and orderly integration of the acquired entity into existing compliance program structures and internal controls. Pre-M&A due diligence, where possible, enables the acquiring company to evaluate more accurately each target’s value and negotiate for the costs of any corruption or misconduct to be borne by the target. Flawed or incomplete pre- or post-acquisition due diligence and integration can allow misconduct to continue at the target company, causing resulting harm to a business’s profitability and reputation and risking civil and criminal liability.”

There are multiple red flags which could be raised in this process, which might well warrant further investigation. They include if the target has ineffective compliance program elements in their compliance program or if there were frequent breach of policies and procedures. Obviously, a target which is in financial difficulty would bear closer scrutiny. Structurally, if the company did not have a formal ethics and compliance committee at the senior management or Board of Directors’ level, this could present issues. From the CCO perspective, if the position did not have Board or CEO access or if there were not regular reports to the Board, it could present an issue for compliance. Conversely, if there were frequent requests to waive policies, management over-ride of compliance controls or no consistent consequence management for violations; it could present clear red flags for further investigation.

Three key takeaways: 

  1. The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward.
  2. Periodically review your M&A due diligence protocol.
  3. If red flags appear in pre-acquisition due diligence, they should be cleared.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 461 no Day 27 | Operationalizing compliance through payroll One of the areas articulated in the 2020 Update was around payments and payroll. For the both the compliance professional and the corporate payroll function, there is a significant role to play in the operationalization of a corporate compliance program. The 2020 Update was replete with references to payment and its critical nature to any best practices compliance program. This includes references to payments to foreign officials, payments to third parties and hiding bribes in payments to distributors. The 2020 Update begins with an admonition to stop wasting time on low hanging fruit when there are much higher risks in your business operations. The role of payroll in compliance is not often considered in operationalizing your compliance program, yet the monies to fund bribes must come from somewhere. Unfortunately, one of those places is out of payroll. All CCOs need to sit down with his or her head of payroll, have them explain the role of payroll, then review the internal controls in place to see how they facilitate the goals of compliance. From that review, you can then determine how to use payroll to help to operationalize your compliance program. The DOJ has now provided its clearest statement on how it expects a company to actually do compliance going forward. Long gone are the days where the DOJ simply considered the inputs of a written program as sufficient to protect companies from compliance violations. Yet the mandate to operationalize a corporate compliance program drives home the concept that compliance is a business process, which should be administered by the appropriate business unit with the requisite SME. When it comes to following the money, payroll is the most well-suited corporate discipline to provide this first level of oversight and controls.  Three key takeaways: Payroll can be a key prevent and detect control. The 2020 Update specified the tying of the corporate compliance function to the corporate payroll function. Offshore payments remain a key indicator for a red flag. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 27 Jan 2021 17:00:00 -0000 Day 27 | Operationalizing compliance through payroll full Thomas Fox How can payroll help to operationalize your compliance program? One of the areas articulated in the 2020 Update was around payments and payroll. For the both the compliance professional and the corporate payroll function, there is a significant role to play in the operationalization of a corporate compliance program. The 2020 Update was replete with references to payment and its critical nature to any best practices compliance program. This includes references to payments to foreign officials, payments to third parties and hiding bribes in payments to distributors. The 2020 Update begins with an admonition to stop wasting time on low hanging fruit when there are much higher risks in your business operations. The role of payroll in compliance is not often considered in operationalizing your compliance program, yet the monies to fund bribes must come from somewhere. Unfortunately, one of those places is out of payroll. All CCOs need to sit down with his or her head of payroll, have them explain the role of payroll, then review the internal controls in place to see how they facilitate the goals of compliance. From that review, you can then determine how to use payroll to help to operationalize your compliance program. The DOJ has now provided its clearest statement on how it expects a company to actually do compliance going forward. Long gone are the days where the DOJ simply considered the inputs of a written program as sufficient to protect companies from compliance violations. Yet the mandate to operationalize a corporate compliance program drives home the concept that compliance is a business process, which should be administered by the appropriate business unit with the requisite SME. When it comes to following the money, payroll is the most well-suited corporate discipline to provide this first level of oversight and controls.  Three key takeaways: Payroll can be a key prevent and detect control. The 2020 Update specified the tying of the corporate compliance function to the corporate payroll function. Offshore payments remain a key indicator for a red flag. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the areas articulated in the 2020 Update was around payments and payroll. For the both the compliance professional and the corporate payroll function, there is a significant role to play in the operationalization of a corporate compliance program. The 2020 Update was replete with references to payment and its critical nature to any best practices compliance program. This includes references to payments to foreign officials, payments to third parties and hiding bribes in payments to distributors. The 2020 Update begins with an admonition to stop wasting time on low hanging fruit when there are much higher risks in your business operations.

The role of payroll in compliance is not often considered in operationalizing your compliance program, yet the monies to fund bribes must come from somewhere. Unfortunately, one of those places is out of payroll. All CCOs need to sit down with his or her head of payroll, have them explain the role of payroll, then review the internal controls in place to see how they facilitate the goals of compliance. From that review, you can then determine how to use payroll to help to operationalize your compliance program.

The DOJ has now provided its clearest statement on how it expects a company to actually do compliance going forward. Long gone are the days where the DOJ simply considered the inputs of a written program as sufficient to protect companies from compliance violations. Yet the mandate to operationalize a corporate compliance program drives home the concept that compliance is a business process, which should be administered by the appropriate business unit with the requisite SME. When it comes to following the money, payroll is the most well-suited corporate discipline to provide this first level of oversight and controls. 

Three key takeaways:

  1. Payroll can be a key prevent and detect control.
  2. The 2020 Update specified the tying of the corporate compliance function to the corporate payroll function.
  3. Offshore payments remain a key indicator for a red flag.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 461 Day 26 | Compliance function in an organization The role of the compliance professional and the compliance function in a corporation has steadily grown in stature and prestige over the years. When it came to the corporate compliance function, 2020 FCPA Resource Guide, under the Hallmarks of an Effective Compliance Program, simply noted the government would “consider whether the company devoted adequate staffing and resources to the compliance program given the size, structure, and risk profile of the business.” This Hallmark was significantly expanded in both the FCPA Corporate Enforcement Policy and 2020 Update. In the FCPA Corporate Enforcement Policy, the DOJ listed the following as factors relating to a corporate compliance function, that it would consider as indicia of an effective compliance and ethics program: 1) the resources the company has dedicated to compliance; 2) the quality and experience of the personnel involved in compliance, such that they can understand and identify the transactions and activities that pose a potential risk; 3) the authority and independence of the compliance function and the availability of compliance expertise to the board; 4) the compensation and promotion of the personnel involved in compliance, in view of their role, responsibilities, performance, and other appropriate factors; and 5) the reporting structure of any compliance personnel employed or contracted by the company. The 2020 Update and FCPA Corporate Enforcement Policy both demonstrate the continued evolution in the thinking of the DOJ around the corporate compliance function. Their articulated inquiries can only strengthen a corporate compliance function specifically; and the compliance profession more generally. The more the DOJ talks about the independence of the compliance function, coupled with resources being made available and authority concomitant with the corporate compliance function, the more corporations will see it is directly in their interest to provide the resources, authority and gravitas to compliance position in their organizations. Three key takeaways: How is compliance treated in the budget process? Has your compliance function had any decisions over-ridden by senior management? Beware outsourcing of compliance as any such contractor must have access to company documents and personnel. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 26 Jan 2021 17:00:00 -0000 Day 26 | Compliance function in an organization full Thomas Fox The role of the compliance professional and the compliance function in a corporation has steadily grown in stature and prestige over the years. The role of the compliance professional and the compliance function in a corporation has steadily grown in stature and prestige over the years. When it came to the corporate compliance function, 2020 FCPA Resource Guide, under the Hallmarks of an Effective Compliance Program, simply noted the government would “consider whether the company devoted adequate staffing and resources to the compliance program given the size, structure, and risk profile of the business.” This Hallmark was significantly expanded in both the FCPA Corporate Enforcement Policy and 2020 Update. In the FCPA Corporate Enforcement Policy, the DOJ listed the following as factors relating to a corporate compliance function, that it would consider as indicia of an effective compliance and ethics program: 1) the resources the company has dedicated to compliance; 2) the quality and experience of the personnel involved in compliance, such that they can understand and identify the transactions and activities that pose a potential risk; 3) the authority and independence of the compliance function and the availability of compliance expertise to the board; 4) the compensation and promotion of the personnel involved in compliance, in view of their role, responsibilities, performance, and other appropriate factors; and 5) the reporting structure of any compliance personnel employed or contracted by the company. The 2020 Update and FCPA Corporate Enforcement Policy both demonstrate the continued evolution in the thinking of the DOJ around the corporate compliance function. Their articulated inquiries can only strengthen a corporate compliance function specifically; and the compliance profession more generally. The more the DOJ talks about the independence of the compliance function, coupled with resources being made available and authority concomitant with the corporate compliance function, the more corporations will see it is directly in their interest to provide the resources, authority and gravitas to compliance position in their organizations. Three key takeaways: How is compliance treated in the budget process? Has your compliance function had any decisions over-ridden by senior management? Beware outsourcing of compliance as any such contractor must have access to company documents and personnel. Learn more about your ad choices. Visit megaphone.fm/adchoices The role of the compliance professional and the compliance function in a corporation has steadily grown in stature and prestige over the years. When it came to the corporate compliance function, 2020 FCPA Resource Guide, under the Hallmarks of an Effective Compliance Program, simply noted the government would “consider whether the company devoted adequate staffing and resources to the compliance program given the size, structure, and risk profile of the business.”

This Hallmark was significantly expanded in both the FCPA Corporate Enforcement Policy and 2020 Update. In the FCPA Corporate Enforcement Policy, the DOJ listed the following as factors relating to a corporate compliance function, that it would consider as indicia of an effective compliance and ethics program: 1) the resources the company has dedicated to compliance; 2) the quality and experience of the personnel involved in compliance, such that they can understand and identify the transactions and activities that pose a potential risk; 3) the authority and independence of the compliance function and the availability of compliance expertise to the board; 4) the compensation and promotion of the personnel involved in compliance, in view of their role, responsibilities, performance, and other appropriate factors; and 5) the reporting structure of any compliance personnel employed or contracted by the company.

The 2020 Update and FCPA Corporate Enforcement Policy both demonstrate the continued evolution in the thinking of the DOJ around the corporate compliance function. Their articulated inquiries can only strengthen a corporate compliance function specifically; and the compliance profession more generally. The more the DOJ talks about the independence of the compliance function, coupled with resources being made available and authority concomitant with the corporate compliance function, the more corporations will see it is directly in their interest to provide the resources, authority and gravitas to compliance position in their organizations.

Three key takeaways:

  1. How is compliance treated in the budget process?
  2. Has your compliance function had any decisions over-ridden by senior management?
  3. Beware outsourcing of compliance as any such contractor must have access to company documents and personnel.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 461 no Day 25 | CCO authority and independence The role of the CCO has steadily grown in stature and prestige over the years. In the 2020 FCPA Resource Guide, under the Hallmarks of an Effective Compliance Program, it focused on the whether the CCO held senior management status and had a direct reporting line to the Board.  This Hallmark was significantly expanded in both the 2020 Update and the FCPA Corporate Enforcement Policy. And in so doing, the DOJ has increased the prestige, authority and role of both the CCO and corporate compliance function. The 2020 Update has five general areas of inquiry around the CCO and corporate compliance function. (1) How does the CCO salary and stature within the organization compare to other senior executives within the company. (2) What are the experience and stature of the CCO with an organization? Does the CCO have appropriate training for the role? (3) How much autonomy does the CCO have to report to the Board of Directors? How often do the CCO meet with directors? Are members of the senior management present for these meetings with the Board of Directors or of the Audit Committee? (4) What is your structure? Is the compliance function run by a designated chief compliance officer, or another executive within the company, and does that person have other roles within the company? (5) Is data in your organization so siloed that the CCO does not have access to it? If so, what are you doing about it? Once again for the compliance professional, the FCPA Corporate Enforcement Policy and 2020 Update make the importance of a best practices compliance program even more critical. The DOJ is focusing more on the role, expertise and how the compliance function is treated within an organization. Pay your CCO considerably less than your GC? You may now better be able to justify that discrepancy. If you have a legal department budget of $3 million and a compliance department budget of $500,000; you may be starting behind the eight-ball. Three key takeaways: How can you show the CCO really has a seat at the senior executive table? What are the professional qualifications of your CCO? Does your CCO have true independence to report directly to the Board of Directors? Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 25 Jan 2021 14:25:57 -0000 Day 25 | CCO authority and independence full Thomas Fox How can you show the authority and independence of the CCO? The role of the CCO has steadily grown in stature and prestige over the years. In the 2020 FCPA Resource Guide, under the Hallmarks of an Effective Compliance Program, it focused on the whether the CCO held senior management status and had a direct reporting line to the Board.  This Hallmark was significantly expanded in both the 2020 Update and the FCPA Corporate Enforcement Policy. And in so doing, the DOJ has increased the prestige, authority and role of both the CCO and corporate compliance function. The 2020 Update has five general areas of inquiry around the CCO and corporate compliance function. (1) How does the CCO salary and stature within the organization compare to other senior executives within the company. (2) What are the experience and stature of the CCO with an organization? Does the CCO have appropriate training for the role? (3) How much autonomy does the CCO have to report to the Board of Directors? How often do the CCO meet with directors? Are members of the senior management present for these meetings with the Board of Directors or of the Audit Committee? (4) What is your structure? Is the compliance function run by a designated chief compliance officer, or another executive within the company, and does that person have other roles within the company? (5) Is data in your organization so siloed that the CCO does not have access to it? If so, what are you doing about it? Once again for the compliance professional, the FCPA Corporate Enforcement Policy and 2020 Update make the importance of a best practices compliance program even more critical. The DOJ is focusing more on the role, expertise and how the compliance function is treated within an organization. Pay your CCO considerably less than your GC? You may now better be able to justify that discrepancy. If you have a legal department budget of $3 million and a compliance department budget of $500,000; you may be starting behind the eight-ball. Three key takeaways: How can you show the CCO really has a seat at the senior executive table? What are the professional qualifications of your CCO? Does your CCO have true independence to report directly to the Board of Directors? Learn more about your ad choices. Visit megaphone.fm/adchoices The role of the CCO has steadily grown in stature and prestige over the years. In the 2020 FCPA Resource Guide, under the Hallmarks of an Effective Compliance Program, it focused on the whether the CCO held senior management status and had a direct reporting line to the Board. 

This Hallmark was significantly expanded in both the 2020 Update and the FCPA Corporate Enforcement Policy. And in so doing, the DOJ has increased the prestige, authority and role of both the CCO and corporate compliance function. The 2020 Update has five general areas of inquiry around the CCO and corporate compliance function. (1) How does the CCO salary and stature within the organization compare to other senior executives within the company. (2) What are the experience and stature of the CCO with an organization? Does the CCO have appropriate training for the role? (3) How much autonomy does the CCO have to report to the Board of Directors? How often do the CCO meet with directors? Are members of the senior management present for these meetings with the Board of Directors or of the Audit Committee? (4) What is your structure? Is the compliance function run by a designated chief compliance officer, or another executive within the company, and does that person have other roles within the company? (5) Is data in your organization so siloed that the CCO does not have access to it? If so, what are you doing about it?

Once again for the compliance professional, the FCPA Corporate Enforcement Policy and 2020 Update make the importance of a best practices compliance program even more critical. The DOJ is focusing more on the role, expertise and how the compliance function is treated within an organization. Pay your CCO considerably less than your GC? You may now better be able to justify that discrepancy. If you have a legal department budget of $3 million and a compliance department budget of $500,000; you may be starting behind the eight-ball.

Three key takeaways:

  1. How can you show the CCO really has a seat at the senior executive table?
  2. What are the professional qualifications of your CCO?
  3. Does your CCO have true independence to report directly to the Board of Directors?


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 461 no Day 24 | Updates and feedback One of the critical elements found in the 2020 Update is the need to use the information you obtain, whether through risk assessment, root cause analysis, investigation, hotline report or any other manner to remediate the situation which allowed it to arise. Your company should establish a regular monitoring system to spot issues and address them. Effective monitoring means applying a consistent set of protocols, checks, and controls tailored to your company’s risks to detect and remediate compliance problems on an ongoing basis. To address this, your compliance team should be checking in routinely with local finance departments in your foreign offices to ask if they have noticed recent accounting irregularities. Regional directors should be required to keep tabs on potential improper activity in the countries in which they manage. These ongoing efforts demonstrate that your company is serious about compliance. It is a function of the CCO to reinforce the vision and goals of the compliance function, where assessment and updating are critical to an ongoing best practices compliance program. If you follow this protocol, you will put a mechanism in place to demonstrate your company’s commitment to compliance by following through on intentions as set forth in your strategic plan. What should you do with this information? Put a strategic plan in place ready to implement your findings of continuous improvement, by using the following: Review the goals of the strategic plan. This requires that you arrange a time for the CCO and team to review the goals of the Strategic Plan, which the CCO should lead to determine how this goal in the Plan measures up to its implementation in your company. Design an execution plan. The KISS method (Keep it Simple Sir) is the best to move forward. This would suggest that for each compliance goal, there should be a simple and straight forward plan to ensure that the goal in question is being addressed. Put accountabilities in place. In any plan of execution, there must be accountabilities attached to them. This requires the CCO or other senior compliance department representatives to put these in place and then mandate a report requirement on how the task assigned is being achieved. Schedule the next review of the plan. There should be a regular review of the process. It allows any problems which may arise to be detected and corrected more quickly than if meetings are held at a less frequent basis. Continuous monitoring is a key step but it is only the first step. It is not simply that you tested your compliance program but that you did something with the information you obtained to improve your program. Three key takeaways: Innovation can come through a new way to think about and use data going forward. Have a plan in place to use the information garnered in your monitoring incorporated back into your compliance program. Always remember that Document Document Document is critical if the regulators come knocking. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 24 Jan 2021 14:11:00 -0000 Day 24 | Updates and feedback full Thomas Fox How can you engage in continuous monitoring and continuous feedback? Through updates and feedback. One of the critical elements found in the 2020 Update is the need to use the information you obtain, whether through risk assessment, root cause analysis, investigation, hotline report or any other manner to remediate the situation which allowed it to arise. Your company should establish a regular monitoring system to spot issues and address them. Effective monitoring means applying a consistent set of protocols, checks, and controls tailored to your company’s risks to detect and remediate compliance problems on an ongoing basis. To address this, your compliance team should be checking in routinely with local finance departments in your foreign offices to ask if they have noticed recent accounting irregularities. Regional directors should be required to keep tabs on potential improper activity in the countries in which they manage. These ongoing efforts demonstrate that your company is serious about compliance. It is a function of the CCO to reinforce the vision and goals of the compliance function, where assessment and updating are critical to an ongoing best practices compliance program. If you follow this protocol, you will put a mechanism in place to demonstrate your company’s commitment to compliance by following through on intentions as set forth in your strategic plan. What should you do with this information? Put a strategic plan in place ready to implement your findings of continuous improvement, by using the following: Review the goals of the strategic plan. This requires that you arrange a time for the CCO and team to review the goals of the Strategic Plan, which the CCO should lead to determine how this goal in the Plan measures up to its implementation in your company. Design an execution plan. The KISS method (Keep it Simple Sir) is the best to move forward. This would suggest that for each compliance goal, there should be a simple and straight forward plan to ensure that the goal in question is being addressed. Put accountabilities in place. In any plan of execution, there must be accountabilities attached to them. This requires the CCO or other senior compliance department representatives to put these in place and then mandate a report requirement on how the task assigned is being achieved. Schedule the next review of the plan. There should be a regular review of the process. It allows any problems which may arise to be detected and corrected more quickly than if meetings are held at a less frequent basis. Continuous monitoring is a key step but it is only the first step. It is not simply that you tested your compliance program but that you did something with the information you obtained to improve your program. Three key takeaways: Innovation can come through a new way to think about and use data going forward. Have a plan in place to use the information garnered in your monitoring incorporated back into your compliance program. Always remember that Document Document Document is critical if the regulators come knocking. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the critical elements found in the 2020 Update is the need to use the information you obtain, whether through risk assessment, root cause analysis, investigation, hotline report or any other manner to remediate the situation which allowed it to arise. Your company should establish a regular monitoring system to spot issues and address them. Effective monitoring means applying a consistent set of protocols, checks, and controls tailored to your company’s risks to detect and remediate compliance problems on an ongoing basis. To address this, your compliance team should be checking in routinely with local finance departments in your foreign offices to ask if they have noticed recent accounting irregularities. Regional directors should be required to keep tabs on potential improper activity in the countries in which they manage. These ongoing efforts demonstrate that your company is serious about compliance.

It is a function of the CCO to reinforce the vision and goals of the compliance function, where assessment and updating are critical to an ongoing best practices compliance program. If you follow this protocol, you will put a mechanism in place to demonstrate your company’s commitment to compliance by following through on intentions as set forth in your strategic plan. What should you do with this information? Put a strategic plan in place ready to implement your findings of continuous improvement, by using the following:

  • Review the goals of the strategic plan. This requires that you arrange a time for the CCO and team to review the goals of the Strategic Plan, which the CCO should lead to determine how this goal in the Plan measures up to its implementation in your company.
  • Design an execution plan. The KISS method (Keep it Simple Sir) is the best to move forward. This would suggest that for each compliance goal, there should be a simple and straight forward plan to ensure that the goal in question is being addressed.
  • Put accountabilities in place. In any plan of execution, there must be accountabilities attached to them. This requires the CCO or other senior compliance department representatives to put these in place and then mandate a report requirement on how the task assigned is being achieved.
  • Schedule the next review of the plan. There should be a regular review of the process. It allows any problems which may arise to be detected and corrected more quickly than if meetings are held at a less frequent basis.

Continuous monitoring is a key step but it is only the first step. It is not simply that you tested your compliance program but that you did something with the information you obtained to improve your program.

Three key takeaways:

  1. Innovation can come through a new way to think about and use data going forward.
  2. Have a plan in place to use the information garnered in your monitoring incorporated back into your compliance program.
  3. Always remember that Document Document Document is critical if the regulators come knocking.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 461 Day 23 | Assessing compliance internal controls One of the specific requirements laid out in the 2020 Update, is around internal controls and more specifically control testing. It stated: Control Testing – Has the company reviewed and audited its compliance program in the area relating to the misconduct? More generally, what testing of controls, collection and analysis of compliance data, and interviews of employees and third-parties does the company undertake? How are the results reported and action items tracked?    Fortunately, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) 2013 Internal Controls Framework considers assessing compliance internal controls. In “Internal Controls – Integrated Framework, Illustrative Tools for Assessing Effectiveness of a System of Internal Controls”, COSO laid out its views on assessing the effectiveness of internal controls. It noted that an effective system of internal controls provides “reasonable assurance of achievement of the entity’s objectives, relating to operations, reporting and compliance.” Moreover, there are two over-arching requirements that can only be met through such a structured protocol. First, each of the five components are present and functioning. Second, that the five components operate in an integrated fashion with each other. One of the most critical components of the COSO Framework is that it sets internal control standards against those which you can audit to assess the strength of your compliance internal controls.  Three key takeaways: An effective system of internal controls provides reasonable assurance of achievement of the company’s objectives, relating to operations, reporting and compliance. There are two over-arching requirements for effective internal controls. First, each of the five components are present and function. Second, are the five components operating together in an integrated approach. For an anti-corruption compliance program, you can use the Hallmarks of an Effective Compliance Program as your guide to test against. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 23 Jan 2021 18:00:00 -0000 Day 23 | Assessing compliance internal controls full Thomas Fox How can you assess internal controls? Find out in this episode of 31 Days to a More Effective Compliance Program One of the specific requirements laid out in the 2020 Update, is around internal controls and more specifically control testing. It stated: Control Testing – Has the company reviewed and audited its compliance program in the area relating to the misconduct? More generally, what testing of controls, collection and analysis of compliance data, and interviews of employees and third-parties does the company undertake? How are the results reported and action items tracked?    Fortunately, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) 2013 Internal Controls Framework considers assessing compliance internal controls. In “Internal Controls – Integrated Framework, Illustrative Tools for Assessing Effectiveness of a System of Internal Controls”, COSO laid out its views on assessing the effectiveness of internal controls. It noted that an effective system of internal controls provides “reasonable assurance of achievement of the entity’s objectives, relating to operations, reporting and compliance.” Moreover, there are two over-arching requirements that can only be met through such a structured protocol. First, each of the five components are present and functioning. Second, that the five components operate in an integrated fashion with each other. One of the most critical components of the COSO Framework is that it sets internal control standards against those which you can audit to assess the strength of your compliance internal controls.  Three key takeaways: An effective system of internal controls provides reasonable assurance of achievement of the company’s objectives, relating to operations, reporting and compliance. There are two over-arching requirements for effective internal controls. First, each of the five components are present and function. Second, are the five components operating together in an integrated approach. For an anti-corruption compliance program, you can use the Hallmarks of an Effective Compliance Program as your guide to test against. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the specific requirements laid out in the 2020 Update, is around internal controls and more specifically control testing. It stated:

Control Testing – Has the company reviewed and audited its compliance program in the area relating to the misconduct? More generally, what testing of controls, collection and analysis of compliance data, and interviews of employees and third-parties does the company undertake? How are the results reported and action items tracked?   

Fortunately, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) 2013 Internal Controls Framework considers assessing compliance internal controls. In “Internal Controls – Integrated Framework, Illustrative Tools for Assessing Effectiveness of a System of Internal Controls”, COSO laid out its views on assessing the effectiveness of internal controls. It noted that an effective system of internal controls provides “reasonable assurance of achievement of the entity’s objectives, relating to operations, reporting and compliance.” Moreover, there are two over-arching requirements that can only be met through such a structured protocol. First, each of the five components are present and functioning. Second, that the five components operate in an integrated fashion with each other. One of the most critical components of the COSO Framework is that it sets internal control standards against those which you can audit to assess the strength of your compliance internal controls. 

Three key takeaways:

  1. An effective system of internal controls provides reasonable assurance of achievement of the company’s objectives, relating to operations, reporting and compliance.
  2. There are two over-arching requirements for effective internal controls. First, each of the five components are present and function. Second, are the five components operating together in an integrated approach.
  3. For an anti-corruption compliance program, you can use the Hallmarks of an Effective Compliance Program as your guide to test against.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 521 no Day 22 | Internal reporting and triaging claims The call, email or tip comes into your office; an employee reports suspicious activity somewhere across the globe. That activity might well turn into a FCPA issue for your company. As the CCO, it will be up to you to begin the process which will determine, in many instances, how the company will respond going forward.  This scenario was driven home by the SEC in a 2015 FCPA enforcement action involving Mead Johnson Nutrition Company. In this enforcement action, the company performed two internal investigations into allegations that its Chinese business unit was engaged in conduct which violated the FCPA. Unfortunately, the first investigation, performed in 2011, did not turn up any evidence of FCPA violations. It was not until 2013, when the SEC made an inquiry to the company that it performed an adequate internal investigation which uncovered FCPA violations. Internal reporting. The 2020 FCPA Resource Guide has as clear and concise a statement about hotlines as any other requirement found in Hallmarks of an Effective Compliance Program. It states: "An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation." Triaging claims. Given the number of ways that information about violations or potential violations can be communicated to the government regulators, having a robust triage system is an important way that a company can determine what resources to bring to bear on a compliance problem. Jonathan Marks has articulated a five-stage triage process which allows for not only an early assessment of any allegations but also a manner to think through your investigative approach. Marks cautions you must have an experienced investigator or other seasoned professional making these determinations, if not a more well-rounded group or committee. Next, consider what will be the types of evidence to review going forward. Finally, before selecting a triage solution, understand what tools are available, including both forensic and human, to complete the investigation. Finally, after you ascertain you have an effective reporting mechanism through your hotline and demonstrate you have a robust and properly scoped investigation protocol, you must use the information you receive to remediate any issues which may arise. It is not enough merely to show that a hotline exists, you must present the data it produces. Three key takeaways: The DOJ and SEC put special emphasis on internal reporting lines. Test your hotline on a regular basis to make sure it is working. Have an investigation protocol in place before the call comes in so you will be ready to go and not required to scramble to create a protocol. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 22 Jan 2021 18:00:00 -0000 Day 22 | Internal reporting and triaging claims full Thomas Fox How should you think through a response to internal reporting. By triaging claims. The call, email or tip comes into your office; an employee reports suspicious activity somewhere across the globe. That activity might well turn into a FCPA issue for your company. As the CCO, it will be up to you to begin the process which will determine, in many instances, how the company will respond going forward.  This scenario was driven home by the SEC in a 2015 FCPA enforcement action involving Mead Johnson Nutrition Company. In this enforcement action, the company performed two internal investigations into allegations that its Chinese business unit was engaged in conduct which violated the FCPA. Unfortunately, the first investigation, performed in 2011, did not turn up any evidence of FCPA violations. It was not until 2013, when the SEC made an inquiry to the company that it performed an adequate internal investigation which uncovered FCPA violations. Internal reporting. The 2020 FCPA Resource Guide has as clear and concise a statement about hotlines as any other requirement found in Hallmarks of an Effective Compliance Program. It states: "An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation." Triaging claims. Given the number of ways that information about violations or potential violations can be communicated to the government regulators, having a robust triage system is an important way that a company can determine what resources to bring to bear on a compliance problem. Jonathan Marks has articulated a five-stage triage process which allows for not only an early assessment of any allegations but also a manner to think through your investigative approach. Marks cautions you must have an experienced investigator or other seasoned professional making these determinations, if not a more well-rounded group or committee. Next, consider what will be the types of evidence to review going forward. Finally, before selecting a triage solution, understand what tools are available, including both forensic and human, to complete the investigation. Finally, after you ascertain you have an effective reporting mechanism through your hotline and demonstrate you have a robust and properly scoped investigation protocol, you must use the information you receive to remediate any issues which may arise. It is not enough merely to show that a hotline exists, you must present the data it produces. Three key takeaways: The DOJ and SEC put special emphasis on internal reporting lines. Test your hotline on a regular basis to make sure it is working. Have an investigation protocol in place before the call comes in so you will be ready to go and not required to scramble to create a protocol. Learn more about your ad choices. Visit megaphone.fm/adchoices The call, email or tip comes into your office; an employee reports suspicious activity somewhere across the globe. That activity might well turn into a FCPA issue for your company. As the CCO, it will be up to you to begin the process which will determine, in many instances, how the company will respond going forward.

 This scenario was driven home by the SEC in a 2015 FCPA enforcement action involving Mead Johnson Nutrition Company. In this enforcement action, the company performed two internal investigations into allegations that its Chinese business unit was engaged in conduct which violated the FCPA. Unfortunately, the first investigation, performed in 2011, did not turn up any evidence of FCPA violations. It was not until 2013, when the SEC made an inquiry to the company that it performed an adequate internal investigation which uncovered FCPA violations.

Internal reporting. The 2020 FCPA Resource Guide has as clear and concise a statement about hotlines as any other requirement found in Hallmarks of an Effective Compliance Program. It states: "An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation."

Triaging claims. Given the number of ways that information about violations or potential violations can be communicated to the government regulators, having a robust triage system is an important way that a company can determine what resources to bring to bear on a compliance problem.

Jonathan Marks has articulated a five-stage triage process which allows for not only an early assessment of any allegations but also a manner to think through your investigative approach. Marks cautions you must have an experienced investigator or other seasoned professional making these determinations, if not a more well-rounded group or committee. Next, consider what will be the types of evidence to review going forward. Finally, before selecting a triage solution, understand what tools are available, including both forensic and human, to complete the investigation.

Finally, after you ascertain you have an effective reporting mechanism through your hotline and demonstrate you have a robust and properly scoped investigation protocol, you must use the information you receive to remediate any issues which may arise. It is not enough merely to show that a hotline exists, you must present the data it produces.

Three key takeaways:

  1. The DOJ and SEC put special emphasis on internal reporting lines.
  2. Test your hotline on a regular basis to make sure it is working.
  3. Have an investigation protocol in place before the call comes in so you will be ready to go and not required to scramble to create a protocol.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 457 no Day 21 | Continuous improvement in a compliance program The 2020 Update was very clear about the need for continuous improvement in any compliance program. It stated quite succinctly, “One hallmark of an effective compliance program is its capacity to improve and evolve. The actual implementation of controls in practice will necessarily reveal areas of risk and potential adjustment. A company’s business changes over time, as do the environments in which it operates, the nature of its customers, the laws that govern its actions, and the applicable industry standards. Accordingly, prosecutors should consider whether the company has engaged in meaningful efforts to review its compliance program and ensure that it is not stale.”   Continuous improvement through continuous monitoring or other similar techniques will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is in many ways a continuously evolving organism, just as your company is. You need to build in a way to keep pace with both market and regulatory changes to have a truly effective anti-corruption compliance program.  Three key takeaways: Your compliance program should be continually evolving. Monitoring and auditing are different, yet complimentary tools for continuous improvement. Culture assessment and monitoring are also now required as well. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 21 Jan 2021 18:00:00 -0000 Day 21 | Continuous improvement in a compliance program full Thomas Fox Why is continuous improvement a mainstay of every compliance program? Find out in 31 Days to a More Effective Compliance Program The 2020 Update was very clear about the need for continuous improvement in any compliance program. It stated quite succinctly, “One hallmark of an effective compliance program is its capacity to improve and evolve. The actual implementation of controls in practice will necessarily reveal areas of risk and potential adjustment. A company’s business changes over time, as do the environments in which it operates, the nature of its customers, the laws that govern its actions, and the applicable industry standards. Accordingly, prosecutors should consider whether the company has engaged in meaningful efforts to review its compliance program and ensure that it is not stale.”   Continuous improvement through continuous monitoring or other similar techniques will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is in many ways a continuously evolving organism, just as your company is. You need to build in a way to keep pace with both market and regulatory changes to have a truly effective anti-corruption compliance program.  Three key takeaways: Your compliance program should be continually evolving. Monitoring and auditing are different, yet complimentary tools for continuous improvement. Culture assessment and monitoring are also now required as well. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2020 Update was very clear about the need for continuous improvement in any compliance program. It stated quite succinctly, “One hallmark of an effective compliance program is its capacity to improve and evolve. The actual implementation of controls in practice will necessarily reveal areas of risk and potential adjustment. A company’s business changes over time, as do the environments in which it operates, the nature of its customers, the laws that govern its actions, and the applicable industry standards. Accordingly, prosecutors should consider whether the company has engaged in meaningful efforts to review its compliance program and ensure that it is not stale.”  

Continuous improvement through continuous monitoring or other similar techniques will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is in many ways a continuously evolving organism, just as your company is. You need to build in a way to keep pace with both market and regulatory changes to have a truly effective anti-corruption compliance program.

 Three key takeaways:

  1. Your compliance program should be continually evolving.
  2. Monitoring and auditing are different, yet complimentary tools for continuous improvement.
  3. Culture assessment and monitoring are also now required as well.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 457 no Day 20 | Responding to investigative findings There is nothing like an internal whistleblower report about a compliance violation, the finding of such an issue, or (even worse) a subpoena from the DOJ or notice letter from the SEC to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check.  You may find yourself in the position that you will have to have some very frank discussions about what to expect in terms of costs and time outlays. While much of these discussions will focus on the investigative process and those costs, these discussions will allow you to initiate the talk about remediation going forward and begin to explain why money must be budgeted for the remediation process. One of the things rarely considered is how the investigation triggers the remediation process and what the relationship is between the two. When issues arise warranting an investigation that would rise to the Board of Directors level and potentially require disclosure to the government, there is usually a flurry of attention and activity. Everyone wants to know what is going on. In an interview with Russ Berland, CCO at Aventiv Technologies, he noted, “for that short moment in time, you have everyone’s full attention.” Yet it can still be “a tricky place, because you get your fifteen minutes to really get everyone’s full attention, and from then on, you’re fighting with everybody else for their attention, like the normal things in business life.” Three key takeaways: A serious FCPA allegation gets the attention of the Board and senior management. Use this time to move the compliance program forward. Be aware of how your investigation can impact and even inform your remediation efforts. Be prepared to deal with the dreaded “where else” question. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 20 Jan 2021 18:00:00 -0000 Day 20 | Responding to investigative findings full Thomas Fox How should you respond to investigative findings? Through remediation. There is nothing like an internal whistleblower report about a compliance violation, the finding of such an issue, or (even worse) a subpoena from the DOJ or notice letter from the SEC to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check.  You may find yourself in the position that you will have to have some very frank discussions about what to expect in terms of costs and time outlays. While much of these discussions will focus on the investigative process and those costs, these discussions will allow you to initiate the talk about remediation going forward and begin to explain why money must be budgeted for the remediation process. One of the things rarely considered is how the investigation triggers the remediation process and what the relationship is between the two. When issues arise warranting an investigation that would rise to the Board of Directors level and potentially require disclosure to the government, there is usually a flurry of attention and activity. Everyone wants to know what is going on. In an interview with Russ Berland, CCO at Aventiv Technologies, he noted, “for that short moment in time, you have everyone’s full attention.” Yet it can still be “a tricky place, because you get your fifteen minutes to really get everyone’s full attention, and from then on, you’re fighting with everybody else for their attention, like the normal things in business life.” Three key takeaways: A serious FCPA allegation gets the attention of the Board and senior management. Use this time to move the compliance program forward. Be aware of how your investigation can impact and even inform your remediation efforts. Be prepared to deal with the dreaded “where else” question. Learn more about your ad choices. Visit megaphone.fm/adchoices There is nothing like an internal whistleblower report about a compliance violation, the finding of such an issue, or (even worse) a subpoena from the DOJ or notice letter from the SEC to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check.

 You may find yourself in the position that you will have to have some very frank discussions about what to expect in terms of costs and time outlays. While much of these discussions will focus on the investigative process and those costs, these discussions will allow you to initiate the talk about remediation going forward and begin to explain why money must be budgeted for the remediation process.

One of the things rarely considered is how the investigation triggers the remediation process and what the relationship is between the two. When issues arise warranting an investigation that would rise to the Board of Directors level and potentially require disclosure to the government, there is usually a flurry of attention and activity. Everyone wants to know what is going on. In an interview with Russ Berland, CCO at Aventiv Technologies, he noted, “for that short moment in time, you have everyone’s full attention.” Yet it can still be “a tricky place, because you get your fifteen minutes to really get everyone’s full attention, and from then on, you’re fighting with everybody else for their attention, like the normal things in business life.”

Three key takeaways:

  1. A serious FCPA allegation gets the attention of the Board and senior management. Use this time to move the compliance program forward.
  2. Be aware of how your investigation can impact and even inform your remediation efforts.
  3. Be prepared to deal with the dreaded “where else” question.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 462 Day 19 | The investigation protocol After the internal report comes in and you have properly triaged the matter, you need to scope out and investigate it, promptly, thoroughly and with competent personnel. In the 2020 Update, provided these series of questions about your internal investigations:   Properly Scoped Investigations by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation? How does the company ensure that investigations are properly scoped? What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct an investigation, and who makes that determination?  Investigation Response – Does the company apply timing metrics to ensure responsiveness? Does the company have a process for monitoring the outcome of investigations and ensuring accountability for the response to any findings or recommendations?  Resources and Tracking of Results – Are the reporting and investigating mechanisms sufficiently funded? How has the company collected, tracked, analyzed, and used information from its reporting mechanisms? Does the company periodically analyze the reports or investigation findings for patterns of misconduct or other red flags for compliance weaknesses? Does the company periodically test the effectiveness of the hotline, for example by tracking a report from start to finish? In a presentation Jay Martin, retired Chief Compliance Officer at Baker Hughes and now Senior Counsel at Willkie Farr & Gallagher LLP and Jacki Trevino, Senior Director, Advisory Services Group at SAI Global Limited, discussed the specifics of an investigation protocol. It consisted of 1) opening and categorizing the case; 2) planning the investigation; 3) executing the investigation plan; 4) determining appropriate follow-up; and 5) closing the case. If you follow this basic protocol, you should be able to work through most investigations, in a clear, concise and cost-effective manner. Furthermore, you should have a report at the end of the day which should stand up to later scrutiny if a regulator comes looking. Finally, you will be able to “Document, Document, and Document”, not only the steps you took but why and the outcome obtained. Three key takeaways: A written protocol, created before an investigation, is a key starting point. Create specific steps to follow so there will be full transparency and documentation going forward. Consistency in approach is critical. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 19 Jan 2021 06:00:00 -0000 Day 19 | The investigation protocol full Thomas Fox Why must you have an investigation protocol? Find out in this episode of 31 Days to a More Effective Compliance Program After the internal report comes in and you have properly triaged the matter, you need to scope out and investigate it, promptly, thoroughly and with competent personnel. In the 2020 Update, provided these series of questions about your internal investigations:   Properly Scoped Investigations by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation? How does the company ensure that investigations are properly scoped? What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct an investigation, and who makes that determination?  Investigation Response – Does the company apply timing metrics to ensure responsiveness? Does the company have a process for monitoring the outcome of investigations and ensuring accountability for the response to any findings or recommendations?  Resources and Tracking of Results – Are the reporting and investigating mechanisms sufficiently funded? How has the company collected, tracked, analyzed, and used information from its reporting mechanisms? Does the company periodically analyze the reports or investigation findings for patterns of misconduct or other red flags for compliance weaknesses? Does the company periodically test the effectiveness of the hotline, for example by tracking a report from start to finish? In a presentation Jay Martin, retired Chief Compliance Officer at Baker Hughes and now Senior Counsel at Willkie Farr & Gallagher LLP and Jacki Trevino, Senior Director, Advisory Services Group at SAI Global Limited, discussed the specifics of an investigation protocol. It consisted of 1) opening and categorizing the case; 2) planning the investigation; 3) executing the investigation plan; 4) determining appropriate follow-up; and 5) closing the case. If you follow this basic protocol, you should be able to work through most investigations, in a clear, concise and cost-effective manner. Furthermore, you should have a report at the end of the day which should stand up to later scrutiny if a regulator comes looking. Finally, you will be able to “Document, Document, and Document”, not only the steps you took but why and the outcome obtained. Three key takeaways: A written protocol, created before an investigation, is a key starting point. Create specific steps to follow so there will be full transparency and documentation going forward. Consistency in approach is critical. Learn more about your ad choices. Visit megaphone.fm/adchoices After the internal report comes in and you have properly triaged the matter, you need to scope out and investigate it, promptly, thoroughly and with competent personnel. In the 2020 Update, provided these series of questions about your internal investigations:  

Properly Scoped Investigations by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation? How does the company ensure that investigations are properly scoped? What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct an investigation, and who makes that determination?

 Investigation Response – Does the company apply timing metrics to ensure responsiveness? Does the company have a process for monitoring the outcome of investigations and ensuring accountability for the response to any findings or recommendations?

 Resources and Tracking of Results – Are the reporting and investigating mechanisms sufficiently funded? How has the company collected, tracked, analyzed, and used information from its reporting mechanisms? Does the company periodically analyze the reports or investigation findings for patterns of misconduct or other red flags for compliance weaknesses? Does the company periodically test the effectiveness of the hotline, for example by tracking a report from start to finish?

In a presentation Jay Martin, retired Chief Compliance Officer at Baker Hughes and now Senior Counsel at Willkie Farr & Gallagher LLP and Jacki Trevino, Senior Director, Advisory Services Group at SAI Global Limited, discussed the specifics of an investigation protocol. It consisted of 1) opening and categorizing the case; 2) planning the investigation; 3) executing the investigation plan; 4) determining appropriate follow-up; and 5) closing the case. If you follow this basic protocol, you should be able to work through most investigations, in a clear, concise and cost-effective manner. Furthermore, you should have a report at the end of the day which should stand up to later scrutiny if a regulator comes looking. Finally, you will be able to “Document, Document, and Document”, not only the steps you took but why and the outcome obtained.

Three key takeaways:

  1. A written protocol, created before an investigation, is a key starting point.
  2. Create specific steps to follow so there will be full transparency and documentation going forward.
  3. Consistency in approach is critical.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 458 no Day 18 | Levels of due diligence Due diligence is generally recognized in three levels: Level I, Level II and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward.  The 2020 Update stated, “A well-designed compliance program should apply risk-based due diligence to its third- party relationships. Although the need for, and degree of, appropriate due diligence may vary based on the size and nature of the company, transaction, and third party, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.” The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward. There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions into your program. The Level I, II and III trichotomy appears to have the greatest favor and one that you should be able to implement in a straightforward manner. But the key is that you must assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence.  Three key takeaways: A Level I due diligence should only be used where there is a low risk of corruption. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared. Level III due diligence is deep dive, boots on the ground investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 18 Jan 2021 18:00:00 -0000 Day 18 | Levels of due diligence full Thomas Fox What are the levels of due diligence and how to utilize them? Due diligence is generally recognized in three levels: Level I, Level II and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward.  The 2020 Update stated, “A well-designed compliance program should apply risk-based due diligence to its third- party relationships. Although the need for, and degree of, appropriate due diligence may vary based on the size and nature of the company, transaction, and third party, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.” The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward. There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions into your program. The Level I, II and III trichotomy appears to have the greatest favor and one that you should be able to implement in a straightforward manner. But the key is that you must assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence.  Three key takeaways: A Level I due diligence should only be used where there is a low risk of corruption. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared. Level III due diligence is deep dive, boots on the ground investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Due diligence is generally recognized in three levels: Level I, Level II and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward. 

The 2020 Update stated, “A well-designed compliance program should apply risk-based due diligence to its third- party relationships. Although the need for, and degree of, appropriate due diligence may vary based on the size and nature of the company, transaction, and third party, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.”

The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward.

There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions into your program. The Level I, II and III trichotomy appears to have the greatest favor and one that you should be able to implement in a straightforward manner. But the key is that you must assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence. 

Three key takeaways:

  1. A Level I due diligence should only be used where there is a low risk of corruption.
  2. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared.
  3. Level III due diligence is deep dive, boots on the ground investigation.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 451 no Day 17 | Managing your third parties The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the life cycle management of third parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation and compliance terms and conditions in contracts. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also the one where the rubber meets the road of operationalizingcompliance. It is also an area the DOJ specifically articulated in the 2020 Update that companies need to consider. Managing your third-parties is where the rubber meets the road in your overall third-party risk manage program. You must execute on this task. Even if you successfully navigate the first four steps in your third-party risk management program, those are in reality the easy steps. Managing the relationship is where the real work begins. Three key takeaways: Have a strategic approach to third-party risk management. Rank third parties based upon a variety of factors including compliance and business performance, length of relationship, benchmarking metrics and KPIs for ongoing monitoring and auditing. Managing the relationship is where the real work begins. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 17 Jan 2021 18:00:00 -0000 Day 17 | Managing your third parties full Thomas Fox Why is managing third-parties the most important step in the 3rd Party Risk Management Cycle? The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the life cycle management of third parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation and compliance terms and conditions in contracts. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also the one where the rubber meets the road of operationalizingcompliance. It is also an area the DOJ specifically articulated in the 2020 Update that companies need to consider. Managing your third-parties is where the rubber meets the road in your overall third-party risk manage program. You must execute on this task. Even if you successfully navigate the first four steps in your third-party risk management program, those are in reality the easy steps. Managing the relationship is where the real work begins. Three key takeaways: Have a strategic approach to third-party risk management. Rank third parties based upon a variety of factors including compliance and business performance, length of relationship, benchmarking metrics and KPIs for ongoing monitoring and auditing. Managing the relationship is where the real work begins. Learn more about your ad choices. Visit megaphone.fm/adchoices The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the life cycle management of third parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation and compliance terms and conditions in contracts. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also the one where the rubber meets the road of operationalizingcompliance. It is also an area the DOJ specifically articulated in the 2020 Update that companies need to consider.

Managing your third-parties is where the rubber meets the road in your overall third-party risk manage program. You must execute on this task. Even if you successfully navigate the first four steps in your third-party risk management program, those are in reality the easy steps. Managing the relationship is where the real work begins.

Three key takeaways:

  1. Have a strategic approach to third-party risk management.
  2. Rank third parties based upon a variety of factors including compliance and business performance, length of relationship, benchmarking metrics and KPIs for ongoing monitoring and auditing.
  3. Managing the relationship is where the real work begins.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 451 no Day 16 | The third-party risk management process As every compliance practitioner is well aware, third parties still present the highest risk under the FCPA. The 2020 Update devotes an entire prong to third-party management. It begins with the following:  Prosecutors should also assess whether the company knows the business rationale for needing the third party in the transaction, and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials. For example, a prosecutor should analyze whether the company has ensured that contract terms with third parties specifically describe the services to be performed, that the third party is actually performing the work, and that its compensation is commensurate with the work being provided in that industry and geographical region.   Prosecutors should further assess whether the company engaged in ongoing monitoring of the third-party relationships, be it through updated due diligence, training, audits, and/or annual compliance certifications by the third party. This clearly specifies that the DOJ expects an integrated approach that is operationalized throughout the company. This means you must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party risk management, which will fulfill the DOJ requirements as laid out in the 2020 FCPA Resource Guide and in the Hallmarks of an Effective Compliance Program. They five steps in the lifecycle of third-party management are:  Business Justification by the Business Sponsor; Questionnaire to Third-party; Due Diligence on Third-party; Compliance Terms and Conditions, including payment terms; and Management and Oversight of Third Parties After Contract Signing. Three key takeaways: Use the full 5-step process for third party management. Make sure you have business development involvement and buy-in. Operationalize all steps going forward by including business unit representatives. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 17 Jan 2021 16:10:41 -0000 Day 16 | The third-party risk management process full Thomas Fox What is the 5-step process for 3rd party risk management? Find out in today's 31 Days to a More Effective Compliance Program. As every compliance practitioner is well aware, third parties still present the highest risk under the FCPA. The 2020 Update devotes an entire prong to third-party management. It begins with the following:  Prosecutors should also assess whether the company knows the business rationale for needing the third party in the transaction, and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials. For example, a prosecutor should analyze whether the company has ensured that contract terms with third parties specifically describe the services to be performed, that the third party is actually performing the work, and that its compensation is commensurate with the work being provided in that industry and geographical region.   Prosecutors should further assess whether the company engaged in ongoing monitoring of the third-party relationships, be it through updated due diligence, training, audits, and/or annual compliance certifications by the third party. This clearly specifies that the DOJ expects an integrated approach that is operationalized throughout the company. This means you must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party risk management, which will fulfill the DOJ requirements as laid out in the 2020 FCPA Resource Guide and in the Hallmarks of an Effective Compliance Program. They five steps in the lifecycle of third-party management are:  Business Justification by the Business Sponsor; Questionnaire to Third-party; Due Diligence on Third-party; Compliance Terms and Conditions, including payment terms; and Management and Oversight of Third Parties After Contract Signing. Three key takeaways: Use the full 5-step process for third party management. Make sure you have business development involvement and buy-in. Operationalize all steps going forward by including business unit representatives. Learn more about your ad choices. Visit megaphone.fm/adchoices As every compliance practitioner is well aware, third parties still present the highest risk under the FCPA. The 2020 Update devotes an entire prong to third-party management. It begins with the following:

 Prosecutors should also assess whether the company knows the business rationale for needing the third party in the transaction, and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials. For example, a prosecutor should analyze whether the company has ensured that contract terms with third parties specifically describe the services to be performed, that the third party is actually performing the work, and that its compensation is commensurate with the work being provided in that industry and geographical region.   Prosecutors should further assess whether the company engaged in ongoing monitoring of the third-party relationships, be it through updated due diligence, training, audits, and/or annual compliance certifications by the third party.

This clearly specifies that the DOJ expects an integrated approach that is operationalized throughout the company. This means you must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party risk management, which will fulfill the DOJ requirements as laid out in the 2020 FCPA Resource Guide and in the Hallmarks of an Effective Compliance Program. They five steps in the lifecycle of third-party management are: 

  1. Business Justification by the Business Sponsor;
  2. Questionnaire to Third-party;
  3. Due Diligence on Third-party;
  4. Compliance Terms and Conditions, including payment terms; and
  5. Management and Oversight of Third Parties After Contract Signing.

Three key takeaways:

  1. Use the full 5-step process for third party management.
  2. Make sure you have business development involvement and buy-in.
  3. Operationalize all steps going forward by including business unit representatives.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 451 no Day 15 | How do you evaluate a risk assessment? After you complete your risk assessment, you must then translate it into a risk profile. If your estimate of where your bribery risk is greatest is wrong, it will be an effort to address it. As Ben Locwin explained in his  BioProcess International article, entitled “Quality Risk Assessment and Management Strategies for Biopharmaceutical Companies”:   Once we have assessed risks and determined a process that includes options to resolve and manage those risks whenever appropriate, then we can decide the level of resources with which to prioritize them. There always will be latent risks: those that we understand are there but that we cannot chase forever. But we need to make sure we have classified them correctly. With a good understanding of each of these, we are in a better position to speak about the quality of our businesses. William C. Athanas, in his Industry Week article, “Rethinking FCPA Compliance Strategies in a New Era of Enforcement”, posited that companies assume that FCPA violations follow a bell curve in which most employees are responsible for most of the violations. However, Athanas believed that the distribution pattern more closely follows a hockey-stick distribution, where virtually all violations are committed by just a few people. Athanas concluded by noting that is this limited group of employees, or what he terms the “shaft of the hockey-stick,” to which a company should devote the majority of its compliance resources. With a proper risk assessment, a company can then focus its compliance efforts such as intensive training sessions or detailed analysis of key financial transactions involving those employees with the greatest means and motive to commit a violation. The most significant risks with the greatest likelihood of occurring are deemed to be the priority risks. These become the focus of your most significant risk management efforts, couple with audit and monitoring going forward. A variety of tools can be used to continuously monitoring risk going forward. Consider providing employees with substantive training to guard against the most significant risks coming to pass and to keep the key messages fresh and top of mind. It is important to create a risk control summary that succinctly documents the nature of the risk and the actions taken to mitigate it. Finally, let this risk assessment and evaluation inform your compliance program, rather than letting the compliance program inform the risk assessment. Three key takeaways: Even after you complete your risk assessment, you must evaluate those risks for your company. The DOJ and SEC are looking for a well-reasoned approach on how you evaluate your risk. Create a risk matrix and rank your risks; then remediate and monitor as appropriate. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 15 Jan 2021 18:00:00 -0000 Day 15 | How do you evaluate a risk assessment? full Thomas Fox How do you evaluate a risk assessment? Find out in this episode of 31 Days to a More Effective Compliance Program. After you complete your risk assessment, you must then translate it into a risk profile. If your estimate of where your bribery risk is greatest is wrong, it will be an effort to address it. As Ben Locwin explained in his  BioProcess International article, entitled “Quality Risk Assessment and Management Strategies for Biopharmaceutical Companies”:   Once we have assessed risks and determined a process that includes options to resolve and manage those risks whenever appropriate, then we can decide the level of resources with which to prioritize them. There always will be latent risks: those that we understand are there but that we cannot chase forever. But we need to make sure we have classified them correctly. With a good understanding of each of these, we are in a better position to speak about the quality of our businesses. William C. Athanas, in his Industry Week article, “Rethinking FCPA Compliance Strategies in a New Era of Enforcement”, posited that companies assume that FCPA violations follow a bell curve in which most employees are responsible for most of the violations. However, Athanas believed that the distribution pattern more closely follows a hockey-stick distribution, where virtually all violations are committed by just a few people. Athanas concluded by noting that is this limited group of employees, or what he terms the “shaft of the hockey-stick,” to which a company should devote the majority of its compliance resources. With a proper risk assessment, a company can then focus its compliance efforts such as intensive training sessions or detailed analysis of key financial transactions involving those employees with the greatest means and motive to commit a violation. The most significant risks with the greatest likelihood of occurring are deemed to be the priority risks. These become the focus of your most significant risk management efforts, couple with audit and monitoring going forward. A variety of tools can be used to continuously monitoring risk going forward. Consider providing employees with substantive training to guard against the most significant risks coming to pass and to keep the key messages fresh and top of mind. It is important to create a risk control summary that succinctly documents the nature of the risk and the actions taken to mitigate it. Finally, let this risk assessment and evaluation inform your compliance program, rather than letting the compliance program inform the risk assessment. Three key takeaways: Even after you complete your risk assessment, you must evaluate those risks for your company. The DOJ and SEC are looking for a well-reasoned approach on how you evaluate your risk. Create a risk matrix and rank your risks; then remediate and monitor as appropriate. Learn more about your ad choices. Visit megaphone.fm/adchoices After you complete your risk assessment, you must then translate it into a risk profile. If your estimate of where your bribery risk is greatest is wrong, it will be an effort to address it. As Ben Locwin explained in his  BioProcess International article, entitled “Quality Risk Assessment and Management Strategies for Biopharmaceutical Companies”: 

 Once we have assessed risks and determined a process that includes options to resolve and manage those risks whenever appropriate, then we can decide the level of resources with which to prioritize them. There always will be latent risks: those that we understand are there but that we cannot chase forever. But we need to make sure we have classified them correctly. With a good understanding of each of these, we are in a better position to speak about the quality of our businesses.

William C. Athanas, in his Industry Week article, “Rethinking FCPA Compliance Strategies in a New Era of Enforcement”, posited that companies assume that FCPA violations follow a bell curve in which most employees are responsible for most of the violations. However, Athanas believed that the distribution pattern more closely follows a hockey-stick distribution, where virtually all violations are committed by just a few people. Athanas concluded by noting that is this limited group of employees, or what he terms the “shaft of the hockey-stick,” to which a company should devote the majority of its compliance resources. With a proper risk assessment, a company can then focus its compliance efforts such as intensive training sessions or detailed analysis of key financial transactions involving those employees with the greatest means and motive to commit a violation.

The most significant risks with the greatest likelihood of occurring are deemed to be the priority risks. These become the focus of your most significant risk management efforts, couple with audit and monitoring going forward. A variety of tools can be used to continuously monitoring risk going forward. Consider providing employees with substantive training to guard against the most significant risks coming to pass and to keep the key messages fresh and top of mind. It is important to create a risk control summary that succinctly documents the nature of the risk and the actions taken to mitigate it. Finally, let this risk assessment and evaluation inform your compliance program, rather than letting the compliance program inform the risk assessment.

Three key takeaways:

  1. Even after you complete your risk assessment, you must evaluate those risks for your company.
  2. The DOJ and SEC are looking for a well-reasoned approach on how you evaluate your risk.
  3. Create a risk matrix and rank your risks; then remediate and monitor as appropriate.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 451 no Day 14 | Risk Assessments One cannot really say enough about risk assessments in the context of anti-corruption programs. This is because every corporate compliance program should be based upon a risk assessment, to understand your organization’s business from the commercial perspective, how your organization has identified, assessed, and defined its risk profile and, finally, the degree to which the program devotes appropriate scrutiny and resources to this range of risks. Yet the 2020 Update added a new emphasis that Risk Assessments should not be done not less than annually.  As far back as 1999, in the Metcalf & Eddy enforcement action, the DOJ has said that risk assessments that measure the likelihood and severity of possible FCPA violations should direct your resources to manage these risks. The 2012 FCPA Guidance stated it succinctly when it said, “Assessment of risk is fundamental to developing a strong compliance program and is another factor DOJ and SEC evaluate when assessing a company’s compliance program.” There are a number of ways you can slice and dice your basic inquiry. As with almost all FCPA compliance, it is important that your protocol be well thought out. If you use one, some or all of the above as your basic inquiries for your risk analysis, it should be acceptable for your starting point.  Three key takeaways: Since at least 1999, the DOJ has pointed to the risk assessment as the start of an effective compliance program. The DOJ will now consider both your risk assessment methodology for identifying risks and gathered evidence. You should base your compliance program on your risk assessment. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 14 Jan 2021 18:00:00 -0000 Day 14 | Risk Assessments full Thomas Fox Risk assessments are the cornerstone of any compliance program. One cannot really say enough about risk assessments in the context of anti-corruption programs. This is because every corporate compliance program should be based upon a risk assessment, to understand your organization’s business from the commercial perspective, how your organization has identified, assessed, and defined its risk profile and, finally, the degree to which the program devotes appropriate scrutiny and resources to this range of risks. Yet the 2020 Update added a new emphasis that Risk Assessments should not be done not less than annually.  As far back as 1999, in the Metcalf & Eddy enforcement action, the DOJ has said that risk assessments that measure the likelihood and severity of possible FCPA violations should direct your resources to manage these risks. The 2012 FCPA Guidance stated it succinctly when it said, “Assessment of risk is fundamental to developing a strong compliance program and is another factor DOJ and SEC evaluate when assessing a company’s compliance program.” There are a number of ways you can slice and dice your basic inquiry. As with almost all FCPA compliance, it is important that your protocol be well thought out. If you use one, some or all of the above as your basic inquiries for your risk analysis, it should be acceptable for your starting point.  Three key takeaways: Since at least 1999, the DOJ has pointed to the risk assessment as the start of an effective compliance program. The DOJ will now consider both your risk assessment methodology for identifying risks and gathered evidence. You should base your compliance program on your risk assessment. Learn more about your ad choices. Visit megaphone.fm/adchoices One cannot really say enough about risk assessments in the context of anti-corruption programs. This is because every corporate compliance program should be based upon a risk assessment, to understand your organization’s business from the commercial perspective, how your organization has identified, assessed, and defined its risk profile and, finally, the degree to which the program devotes appropriate scrutiny and resources to this range of risks. Yet the 2020 Update added a new emphasis that Risk Assessments should not be done not less than annually.

 As far back as 1999, in the Metcalf & Eddy enforcement action, the DOJ has said that risk assessments that measure the likelihood and severity of possible FCPA violations should direct your resources to manage these risks. The 2012 FCPA Guidance stated it succinctly when it said, “Assessment of risk is fundamental to developing a strong compliance program and is another factor DOJ and SEC evaluate when assessing a company’s compliance program.”

There are a number of ways you can slice and dice your basic inquiry. As with almost all FCPA compliance, it is important that your protocol be well thought out. If you use one, some or all of the above as your basic inquiries for your risk analysis, it should be acceptable for your starting point. 

Three key takeaways:

  1. Since at least 1999, the DOJ has pointed to the risk assessment as the start of an effective compliance program.
  2. The DOJ will now consider both your risk assessment methodology for identifying risks and gathered evidence.
  3. You should base your compliance program on your risk assessment.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 464 no Day 13 | Institutional Justice and Fairness Companies have finally come to realize that institutional justice and fairness are perhaps the most basic tenet of any successful workplace. If employees believe they will be treated fairly, it will engender a level of trust that can work to not simply motivate employees but lead to a more successful workplace and, at the end of the day, a more profitable company. This encompasses the entire lifecycle of the employment relationship, from hiring through separation. It works in areas as seeming disparate as compensation and incentives, discipline, promotion and internal reporting.  On this final point, Kyle Welch and Stephen Stubben, in their 2019 paper entitled “Evidence on the Use and Efficacy of Internal Whistleblowing Systems”, noted that a robust whistleblower reporting system speaks to a functioning and ethical corporate culture. Employees who can report issues, in a fair manner, without fear of retaliation are more empowered to make the company run more efficiently and more profitably. Yet an equally interesting finding was where there was robust internal reporting, employees were more likely to speak up to improve overall business processes, thereby making the company more profitable. An often-overlooked role of any CCO or compliance professional is to help provide employees with institutional justice. If your compliance function is seen to be fair in the way it treats employees, in areas as varied as financial incentives, to promotions, to appropriate and consistent discipline meted out across the globe; employees are more likely to inform the compliance department when something goes array. If employees believe they will be treated fairly, it will go a long way to more fully operationalizing your compliance program. Three key takeaways: The DOJ and SEC have long called for appropriate and consistent application of both incentives and discipline. The Fair Process Doctrine will help set institutional justice as the norm in your organization. Inconsistent application of discipline will destroy your compliance program credibility. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 13 Jan 2021 18:00:00 -0000 Day 13 | Institutional Justice and Fairness full Thomas Fox Instituional justice is the bulwark of any corporate culture and compliance program. Companies have finally come to realize that institutional justice and fairness are perhaps the most basic tenet of any successful workplace. If employees believe they will be treated fairly, it will engender a level of trust that can work to not simply motivate employees but lead to a more successful workplace and, at the end of the day, a more profitable company. This encompasses the entire lifecycle of the employment relationship, from hiring through separation. It works in areas as seeming disparate as compensation and incentives, discipline, promotion and internal reporting.  On this final point, Kyle Welch and Stephen Stubben, in their 2019 paper entitled “Evidence on the Use and Efficacy of Internal Whistleblowing Systems”, noted that a robust whistleblower reporting system speaks to a functioning and ethical corporate culture. Employees who can report issues, in a fair manner, without fear of retaliation are more empowered to make the company run more efficiently and more profitably. Yet an equally interesting finding was where there was robust internal reporting, employees were more likely to speak up to improve overall business processes, thereby making the company more profitable. An often-overlooked role of any CCO or compliance professional is to help provide employees with institutional justice. If your compliance function is seen to be fair in the way it treats employees, in areas as varied as financial incentives, to promotions, to appropriate and consistent discipline meted out across the globe; employees are more likely to inform the compliance department when something goes array. If employees believe they will be treated fairly, it will go a long way to more fully operationalizing your compliance program. Three key takeaways: The DOJ and SEC have long called for appropriate and consistent application of both incentives and discipline. The Fair Process Doctrine will help set institutional justice as the norm in your organization. Inconsistent application of discipline will destroy your compliance program credibility. Learn more about your ad choices. Visit megaphone.fm/adchoices Companies have finally come to realize that institutional justice and fairness are perhaps the most basic tenet of any successful workplace. If employees believe they will be treated fairly, it will engender a level of trust that can work to not simply motivate employees but lead to a more successful workplace and, at the end of the day, a more profitable company. This encompasses the entire lifecycle of the employment relationship, from hiring through separation. It works in areas as seeming disparate as compensation and incentives, discipline, promotion and internal reporting.

 On this final point, Kyle Welch and Stephen Stubben, in their 2019 paper entitled “Evidence on the Use and Efficacy of Internal Whistleblowing Systems”, noted that a robust whistleblower reporting system speaks to a functioning and ethical corporate culture. Employees who can report issues, in a fair manner, without fear of retaliation are more empowered to make the company run more efficiently and more profitably. Yet an equally interesting finding was where there was robust internal reporting, employees were more likely to speak up to improve overall business processes, thereby making the company more profitable.

An often-overlooked role of any CCO or compliance professional is to help provide employees with institutional justice. If your compliance function is seen to be fair in the way it treats employees, in areas as varied as financial incentives, to promotions, to appropriate and consistent discipline meted out across the globe; employees are more likely to inform the compliance department when something goes array. If employees believe they will be treated fairly, it will go a long way to more fully operationalizing your compliance program.

Three key takeaways:

  1. The DOJ and SEC have long called for appropriate and consistent application of both incentives and discipline.
  2. The Fair Process Doctrine will help set institutional justice as the norm in your organization.
  3. Inconsistent application of discipline will destroy your compliance program credibility.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 464 Day 12 | Financial Incentives for Compliance One of the areas that many companies have not paid as much attention to in their compliance programs is compensation. However, the DOJ and SEC have long made clear that they view monetary structure for compensation, rewarding those employees who do business in compliance with their employer’s compliance program, as one of the ways to reinforce the compliance program and the message of compliance. As far back as 2004, then SEC Director of Enforcement Stephen M. Cutler noted that integrity, ethics and compliance needed to be part of promotion, compensation and evaluation processes: “At the end of the day, the most effective way to communicate that “doing the right thing” is a priority, is to reward it.”  The 2020 FCPA Resources Guide stated the “DOJ and SEC recognize that positive incentives can also drive compliant behavior. These incentives can take many forms such as personnel evaluations and promotions, rewards for improving and developing a company’s compliance program, and rewards for ethics and compliance leadership.” Obviously, the power of a compensation plan is to motivate employees to not only to sell more but to act in ways that support your company’s business model and overall culture and values. For the compliance practitioner, one of the biggest reasons is to first change a company’s culture to make compliance more important, and then integrate it into the DNA of your organization. But you must be able to evolve in your thinking and professionalism to recognize the opportunities to change and then adapt your incentive program to make the doing of compliance part of your company’s everyday business process.  Three key takeaways: The DOJ and SEC have long advocated compensation as a way to motivate employees into ethical and compliant behaviors Keep the compliance aspects of your compensation structure simple and easy for your employees to understand Have full transparency in the framework of your compensation structure Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 12 Jan 2021 18:01:00 -0000 Day 12 | Financial Incentives for Compliance full Thomas Fox One of the areas that many companies have not paid as much attention to in their compliance programs is compensation. Find out why you should on this episode of 31 Days to a More Effective Compliance Program. One of the areas that many companies have not paid as much attention to in their compliance programs is compensation. However, the DOJ and SEC have long made clear that they view monetary structure for compensation, rewarding those employees who do business in compliance with their employer’s compliance program, as one of the ways to reinforce the compliance program and the message of compliance. As far back as 2004, then SEC Director of Enforcement Stephen M. Cutler noted that integrity, ethics and compliance needed to be part of promotion, compensation and evaluation processes: “At the end of the day, the most effective way to communicate that “doing the right thing” is a priority, is to reward it.”  The 2020 FCPA Resources Guide stated the “DOJ and SEC recognize that positive incentives can also drive compliant behavior. These incentives can take many forms such as personnel evaluations and promotions, rewards for improving and developing a company’s compliance program, and rewards for ethics and compliance leadership.” Obviously, the power of a compensation plan is to motivate employees to not only to sell more but to act in ways that support your company’s business model and overall culture and values. For the compliance practitioner, one of the biggest reasons is to first change a company’s culture to make compliance more important, and then integrate it into the DNA of your organization. But you must be able to evolve in your thinking and professionalism to recognize the opportunities to change and then adapt your incentive program to make the doing of compliance part of your company’s everyday business process.  Three key takeaways: The DOJ and SEC have long advocated compensation as a way to motivate employees into ethical and compliant behaviors Keep the compliance aspects of your compensation structure simple and easy for your employees to understand Have full transparency in the framework of your compensation structure Learn more about your ad choices. Visit megaphone.fm/adchoices One of the areas that many companies have not paid as much attention to in their compliance programs is compensation. However, the DOJ and SEC have long made clear that they view monetary structure for compensation, rewarding those employees who do business in compliance with their employer’s compliance program, as one of the ways to reinforce the compliance program and the message of compliance. As far back as 2004, then SEC Director of Enforcement Stephen M. Cutler noted that integrity, ethics and compliance needed to be part of promotion, compensation and evaluation processes: “At the end of the day, the most effective way to communicate that “doing the right thing” is a priority, is to reward it.”

 The 2020 FCPA Resources Guide stated the “DOJ and SEC recognize that positive incentives can also drive compliant behavior. These incentives can take many forms such as personnel evaluations and promotions, rewards for improving and developing a company’s compliance program, and rewards for ethics and compliance leadership.”

Obviously, the power of a compensation plan is to motivate employees to not only to sell more but to act in ways that support your company’s business model and overall culture and values. For the compliance practitioner, one of the biggest reasons is to first change a company’s culture to make compliance more important, and then integrate it into the DNA of your organization. But you must be able to evolve in your thinking and professionalism to recognize the opportunities to change and then adapt your incentive program to make the doing of compliance part of your company’s everyday business process. 

Three key takeaways:

  1. The DOJ and SEC have long advocated compensation as a way to motivate employees into ethical and compliant behaviors
  2. Keep the compliance aspects of your compensation structure simple and easy for your employees to understand
  3. Have full transparency in the framework of your compensation structure

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 452 no Day 11 | What is Effective Compliance Training? One of the key goals of any compliance program is to train employees in awareness and understanding of the FCPA; your specific company compliance program; and to create and foster a culture of compliance. While it seems axiomatic that compliance training is a mainstay of any best practices compliance program, the conversation around training has evolved over the years.  The importance of determining effectiveness of your compliance program has been enshrined by the DOJ. The 2020 Update confirmed that the DOJ wants to see evidence of the effectiveness of your compliance program. This is something that many CCOs and compliance professionals still struggle to determine. Both the simple guidelines suggested herein, the more robust assessment and results provide you with a start to fulfill the precepts set out by the DOJ, as you will eventually need to demonstrate the effectiveness of your compliance training going forward. Three key takeaways: How and why have you tailored your compliance training? The DOJ has mandated demonstrating the effectiveness of compliance training How is your training presented: both in languages and media? Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 11 Jan 2021 18:00:00 -0000 Day 11 | What is Effective Compliance Training? full Thomas Fox How do you determine the effectiveness of your compliance training? One of the key goals of any compliance program is to train employees in awareness and understanding of the FCPA; your specific company compliance program; and to create and foster a culture of compliance. While it seems axiomatic that compliance training is a mainstay of any best practices compliance program, the conversation around training has evolved over the years.  The importance of determining effectiveness of your compliance program has been enshrined by the DOJ. The 2020 Update confirmed that the DOJ wants to see evidence of the effectiveness of your compliance program. This is something that many CCOs and compliance professionals still struggle to determine. Both the simple guidelines suggested herein, the more robust assessment and results provide you with a start to fulfill the precepts set out by the DOJ, as you will eventually need to demonstrate the effectiveness of your compliance training going forward. Three key takeaways: How and why have you tailored your compliance training? The DOJ has mandated demonstrating the effectiveness of compliance training How is your training presented: both in languages and media? Learn more about your ad choices. Visit megaphone.fm/adchoices One of the key goals of any compliance program is to train employees in awareness and understanding of the FCPA; your specific company compliance program; and to create and foster a culture of compliance. While it seems axiomatic that compliance training is a mainstay of any best practices compliance program, the conversation around training has evolved over the years. 

The importance of determining effectiveness of your compliance program has been enshrined by the DOJ. The 2020 Update confirmed that the DOJ wants to see evidence of the effectiveness of your compliance program. This is something that many CCOs and compliance professionals still struggle to determine. Both the simple guidelines suggested herein, the more robust assessment and results provide you with a start to fulfill the precepts set out by the DOJ, as you will eventually need to demonstrate the effectiveness of your compliance training going forward.

Three key takeaways:

  1. How and why have you tailored your compliance training?
  2. The DOJ has mandated demonstrating the effectiveness of compliance training
  3. How is your training presented: both in languages and media?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 448 no Day 10 | The Use of Social Media in Compliance What is the message of compliance inside of a corporation and how it is distributed? In a compliance program, the largest portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communications are free or available at very low cost. Why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward?  Louis Sapirman, Vice President and Chief Ethics & Compliance Officer for Panasonic Corporation of North America – Panasonic USA, often talks about the integration of social media into compliance. You should start with the tech-savvy nature of the today’s workforce. It is not simply about having a younger workforce but a workforce whose primary tool for communication is social media. If your company is in the services business, it probably means your employee base is using technological tools to deliver business solutions. Finally, consider the data-driven nature of business today so using technological tools to deliver products and solutions is something your company most probably does now. Finally, never forget the social part of social media. Social media is a more holistic, multiple-sided communication. Not only are you setting out expectations but also these tools allow you to receive back communications from your employees. The D&B experience around the name change for its Code of Conduct is but one example. You can also see that if you have several concerns expressed it could alert you earlier to begin some detection and move towards prevention in your compliance program. Three key takeaways: Incorporation of social media into your compliance communications can pay big dividends Focus on the ‘social’ part of social media Use internal corporate social media to facilitate a 360-degree conversation Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 10 Jan 2021 18:00:00 -0000 Day 10 | The Use of Social Media in Compliance full Thomas Fox Social media presents the compliance professional excellent mechanisms to communicate the message of compliance going forward. What is the message of compliance inside of a corporation and how it is distributed? In a compliance program, the largest portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communications are free or available at very low cost. Why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward?  Louis Sapirman, Vice President and Chief Ethics & Compliance Officer for Panasonic Corporation of North America – Panasonic USA, often talks about the integration of social media into compliance. You should start with the tech-savvy nature of the today’s workforce. It is not simply about having a younger workforce but a workforce whose primary tool for communication is social media. If your company is in the services business, it probably means your employee base is using technological tools to deliver business solutions. Finally, consider the data-driven nature of business today so using technological tools to deliver products and solutions is something your company most probably does now. Finally, never forget the social part of social media. Social media is a more holistic, multiple-sided communication. Not only are you setting out expectations but also these tools allow you to receive back communications from your employees. The D&B experience around the name change for its Code of Conduct is but one example. You can also see that if you have several concerns expressed it could alert you earlier to begin some detection and move towards prevention in your compliance program. Three key takeaways: Incorporation of social media into your compliance communications can pay big dividends Focus on the ‘social’ part of social media Use internal corporate social media to facilitate a 360-degree conversation Learn more about your ad choices. Visit megaphone.fm/adchoices What is the message of compliance inside of a corporation and how it is distributed? In a compliance program, the largest portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communications are free or available at very low cost. Why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward? 

Louis Sapirman, Vice President and Chief Ethics & Compliance Officer for Panasonic Corporation of North America – Panasonic USA, often talks about the integration of social media into compliance. You should start with the tech-savvy nature of the today’s workforce. It is not simply about having a younger workforce but a workforce whose primary tool for communication is social media. If your company is in the services business, it probably means your employee base is using technological tools to deliver business solutions. Finally, consider the data-driven nature of business today so using technological tools to deliver products and solutions is something your company most probably does now.

Finally, never forget the social part of social media. Social media is a more holistic, multiple-sided communication. Not only are you setting out expectations but also these tools allow you to receive back communications from your employees. The D&B experience around the name change for its Code of Conduct is but one example. You can also see that if you have several concerns expressed it could alert you earlier to begin some detection and move towards prevention in your compliance program.

Three key takeaways:

  1. Incorporation of social media into your compliance communications can pay big dividends
  2. Focus on the ‘social’ part of social media
  3. Use internal corporate social media to facilitate a 360-degree conversation

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 497 no Day 9 | 360 Degrees of Compliance Communications A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is in touch with and visible to your employees at all times. It is about creating a distinctive brand philosophy of compliance which is centered on your consumers. In other words, it helps a compliance practitioner to anticipate all the aspects of your employees needs around compliance. This is especially true when compliance is either perceived as something that comes out of the home office or is perceived as the “Land of No.” A 360-degree view of compliance gives you the opportunity to build a new brand image for your compliance program. This is important as the 2020 Update mandates that for a compliance program to be effective, it must be understood by a wide variety of stakeholders.  Communications is often thought of as a two-way street, upward and downward, inbound and outbound, or side-to-side. However, it is better to think of it as a 360-degree effort. You simply can no longer effectively communicate in just two ways. You now communicate in a more holistic manner, and in multiple ways. If you are just thinking about communications in the classic form, you are missing something that is happening around you. The best example I can provide to you is a story told to me by Louis Sapirman, Vice President and Chief Ethics and Compliance Officer at Panasonic Corporation of North America – Panasonic USA. This story happened to him in Argentina when he was the CCO at Dun & Bradstreet (D&B). Argentina has an interesting form of illegal conduct, which is an open black market for the changing of currency. Sapirman was with a colleague who was one of the leaders from the company’s South American operations and they went into a convenience store. The person who was going to sell him the product suggested that he go just around the corner and change money on the black market where he could get a much better exchange rate, almost a 100 percent difference in the exchange rate; he declined to do so. Sapirman paid and received the established bank rate in the small transaction. He had not considered role modeling that compliance. About six months later one of his team members was in Mexico speaking to the leader of the D&B operation there. The non-compliance function employee said that he was the person who had been with Sapirman. He recounted the story of doing the right thing, when literally no one was watching. That is the power of 360-degrees in communication.  Three key takeaways: Remember the definition of 360-degrees of communication. It is an effort that moves the compliance identity into a holistic approach so compliance is in touch and visible to your employees at all times What is your objective? What are you trying to do with your 360-degrees of communications and how are you using that mechanism to deliver the objectives of your compliance program? Evaluate. You need to evaluate three factors: 1) has the message been delivered; 2) has it been heard; and 3) is it being implemented? Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 09 Jan 2021 18:10:33 -0000 Day 9 | 360 Degrees of Compliance Communications full Thomas Fox A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is in touch with and visible to your employees at all times. A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is in touch with and visible to your employees at all times. It is about creating a distinctive brand philosophy of compliance which is centered on your consumers. In other words, it helps a compliance practitioner to anticipate all the aspects of your employees needs around compliance. This is especially true when compliance is either perceived as something that comes out of the home office or is perceived as the “Land of No.” A 360-degree view of compliance gives you the opportunity to build a new brand image for your compliance program. This is important as the 2020 Update mandates that for a compliance program to be effective, it must be understood by a wide variety of stakeholders.  Communications is often thought of as a two-way street, upward and downward, inbound and outbound, or side-to-side. However, it is better to think of it as a 360-degree effort. You simply can no longer effectively communicate in just two ways. You now communicate in a more holistic manner, and in multiple ways. If you are just thinking about communications in the classic form, you are missing something that is happening around you. The best example I can provide to you is a story told to me by Louis Sapirman, Vice President and Chief Ethics and Compliance Officer at Panasonic Corporation of North America – Panasonic USA. This story happened to him in Argentina when he was the CCO at Dun & Bradstreet (D&B). Argentina has an interesting form of illegal conduct, which is an open black market for the changing of currency. Sapirman was with a colleague who was one of the leaders from the company’s South American operations and they went into a convenience store. The person who was going to sell him the product suggested that he go just around the corner and change money on the black market where he could get a much better exchange rate, almost a 100 percent difference in the exchange rate; he declined to do so. Sapirman paid and received the established bank rate in the small transaction. He had not considered role modeling that compliance. About six months later one of his team members was in Mexico speaking to the leader of the D&B operation there. The non-compliance function employee said that he was the person who had been with Sapirman. He recounted the story of doing the right thing, when literally no one was watching. That is the power of 360-degrees in communication.  Three key takeaways: Remember the definition of 360-degrees of communication. It is an effort that moves the compliance identity into a holistic approach so compliance is in touch and visible to your employees at all times What is your objective? What are you trying to do with your 360-degrees of communications and how are you using that mechanism to deliver the objectives of your compliance program? Evaluate. You need to evaluate three factors: 1) has the message been delivered; 2) has it been heard; and 3) is it being implemented? Learn more about your ad choices. Visit megaphone.fm/adchoices A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is in touch with and visible to your employees at all times. It is about creating a distinctive brand philosophy of compliance which is centered on your consumers. In other words, it helps a compliance practitioner to anticipate all the aspects of your employees needs around compliance. This is especially true when compliance is either perceived as something that comes out of the home office or is perceived as the “Land of No.” A 360-degree view of compliance gives you the opportunity to build a new brand image for your compliance program. This is important as the 2020 Update mandates that for a compliance program to be effective, it must be understood by a wide variety of stakeholders. 

Communications is often thought of as a two-way street, upward and downward, inbound and outbound, or side-to-side. However, it is better to think of it as a 360-degree effort. You simply can no longer effectively communicate in just two ways. You now communicate in a more holistic manner, and in multiple ways. If you are just thinking about communications in the classic form, you are missing something that is happening around you.

The best example I can provide to you is a story told to me by Louis Sapirman, Vice President and Chief Ethics and Compliance Officer at Panasonic Corporation of North America – Panasonic USA. This story happened to him in Argentina when he was the CCO at Dun & Bradstreet (D&B). Argentina has an interesting form of illegal conduct, which is an open black market for the changing of currency. Sapirman was with a colleague who was one of the leaders from the company’s South American operations and they went into a convenience store. The person who was going to sell him the product suggested that he go just around the corner and change money on the black market where he could get a much better exchange rate, almost a 100 percent difference in the exchange rate; he declined to do so. Sapirman paid and received the established bank rate in the small transaction.

He had not considered role modeling that compliance. About six months later one of his team members was in Mexico speaking to the leader of the D&B operation there. The non-compliance function employee said that he was the person who had been with Sapirman. He recounted the story of doing the right thing, when literally no one was watching. That is the power of 360-degrees in communication. 

Three key takeaways:

  1. Remember the definition of 360-degrees of communication. It is an effort that moves the compliance identity into a holistic approach so compliance is in touch and visible to your employees at all times
  2. What is your objective? What are you trying to do with your 360-degrees of communications and how are you using that mechanism to deliver the objectives of your compliance program?
  3. Evaluate. You need to evaluate three factors: 1) has the message been delivered; 2) has it been heard; and 3) is it being implemented?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 482 no Day 8 | Internal Controls and Compliance What are internal controls? The best definition I have come across is from Jonathan Marks who defined internal controls as:  An internal control is an action or process of interlocking activities designed to support the policies and procedures detailing the specific preventative, detective, corrective, directive and corroborative actions required to achieve the desired process outcomes or the objectives(s). This, along with continuous auditing, continuous monitoring and training reasonably assures:  The achievement of the process objectives linked to the organization’s objectives; Operational effectiveness and efficiency; Reliable (complete and accurate) books and records (financial reporting); Compliance with laws, regulations and policies; and  The reduction of risk-fraud, waste and abuse, which,    Aids in the decline of process and policy variation, leading to more predictive outcomes. The DOJ and SEC, in the 2020 FCPA Resource Guide, stated: Internal controls over financial reporting are the processes used by compa­nies to provide reasonable assurances regarding the reliabil­ity of financial reporting and the preparation of financial statements. They include various components, such as: a control environment that covers the tone set by the organi­zation regarding integrity and ethics; risk assessments; con­trol activities that cover policies and procedures designed to ensure that management directives are carried out (e.g., approvals, authorizations, reconciliations, and segregation of duties); information and communication; and monitoring. … The design of a company’s internal controls must take into account the operational realities and risks attendant to the company’s business, such as: the nature of its products or services; how the products or services get to market; the nature of its work force; the degree of regulation; the extent of its government interaction; and the degree to which it has operations in countries with a high risk of corruption. This was supplemented in the 2020 Update, with a pair of pointed questions: whether a company has made significant investigation into its internal controls and have they been tested, then remediated based upon the testing? The bottom line is that internal controls are just good financial controls. The internal controls that detail requirements for third-party representatives in the compliance context will help to detect fraud, which could well lead to bribery and corruption. As an exercise, map your existing internal controls to the Ten Hallmarks of an Effective Compliance Program or some other well-known anti-corruption regime to see where gaps may exist. This will help you to determine whether adequate compliance internal controls are present in your company. From there you can move to see if they are working in practice. Three key takeaways: Effective internal controls are required under the FCPA Internal controls are a critical part of any best practices compliance program There are four significant controls for the compliance practitioner to implement initially. (a) Delegation of authority (DOA); (b) Maintenance of the vendor master file; (c) Contracts with third parties; and (d) Movement of cash/currency. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 08 Jan 2021 18:00:00 -0000 Day 8 | Internal Controls and Compliance full Thomas Fox What are internal controls and what is their place in a best practices compliance program.? What are internal controls? The best definition I have come across is from Jonathan Marks who defined internal controls as:  An internal control is an action or process of interlocking activities designed to support the policies and procedures detailing the specific preventative, detective, corrective, directive and corroborative actions required to achieve the desired process outcomes or the objectives(s). This, along with continuous auditing, continuous monitoring and training reasonably assures:  The achievement of the process objectives linked to the organization’s objectives; Operational effectiveness and efficiency; Reliable (complete and accurate) books and records (financial reporting); Compliance with laws, regulations and policies; and  The reduction of risk-fraud, waste and abuse, which,    Aids in the decline of process and policy variation, leading to more predictive outcomes. The DOJ and SEC, in the 2020 FCPA Resource Guide, stated: Internal controls over financial reporting are the processes used by compa­nies to provide reasonable assurances regarding the reliabil­ity of financial reporting and the preparation of financial statements. They include various components, such as: a control environment that covers the tone set by the organi­zation regarding integrity and ethics; risk assessments; con­trol activities that cover policies and procedures designed to ensure that management directives are carried out (e.g., approvals, authorizations, reconciliations, and segregation of duties); information and communication; and monitoring. … The design of a company’s internal controls must take into account the operational realities and risks attendant to the company’s business, such as: the nature of its products or services; how the products or services get to market; the nature of its work force; the degree of regulation; the extent of its government interaction; and the degree to which it has operations in countries with a high risk of corruption. This was supplemented in the 2020 Update, with a pair of pointed questions: whether a company has made significant investigation into its internal controls and have they been tested, then remediated based upon the testing? The bottom line is that internal controls are just good financial controls. The internal controls that detail requirements for third-party representatives in the compliance context will help to detect fraud, which could well lead to bribery and corruption. As an exercise, map your existing internal controls to the Ten Hallmarks of an Effective Compliance Program or some other well-known anti-corruption regime to see where gaps may exist. This will help you to determine whether adequate compliance internal controls are present in your company. From there you can move to see if they are working in practice. Three key takeaways: Effective internal controls are required under the FCPA Internal controls are a critical part of any best practices compliance program There are four significant controls for the compliance practitioner to implement initially. (a) Delegation of authority (DOA); (b) Maintenance of the vendor master file; (c) Contracts with third parties; and (d) Movement of cash/currency. Learn more about your ad choices. Visit megaphone.fm/adchoices What are internal controls? The best definition I have come across is from Jonathan Marks who defined internal controls as: 

An internal control is an action or process of interlocking activities designed to support the policies and procedures detailing the specific preventative, detective, corrective, directive and corroborative actions required to achieve the desired process outcomes or the objectives(s). This, along with continuous auditing, continuous monitoring and training reasonably assures: 

  • The achievement of the process objectives linked to the organization’s objectives;
  • Operational effectiveness and efficiency;
  • Reliable (complete and accurate) books and records (financial reporting);
  • Compliance with laws, regulations and policies; and 
  • The reduction of risk-fraud, waste and abuse, which,

   Aids in the decline of process and policy variation, leading to more predictive outcomes.

The DOJ and SEC, in the 2020 FCPA Resource Guide, stated:

Internal controls over financial reporting are the processes used by compa­nies to provide reasonable assurances regarding the reliabil­ity of financial reporting and the preparation of financial statements. They include various components, such as: a control environment that covers the tone set by the organi­zation regarding integrity and ethics; risk assessments; con­trol activities that cover policies and procedures designed to ensure that management directives are carried out (e.g., approvals, authorizations, reconciliations, and segregation of duties); information and communication; and monitoring. … The design of a company’s internal controls must take into account the operational realities and risks attendant to the company’s business, such as: the nature of its products or services; how the products or services get to market; the nature of its work force; the degree of regulation; the extent of its government interaction; and the degree to which it has operations in countries with a high risk of corruption.

This was supplemented in the 2020 Update, with a pair of pointed questions: whether a company has made significant investigation into its internal controls and have they been tested, then remediated based upon the testing?

The bottom line is that internal controls are just good financial controls. The internal controls that detail requirements for third-party representatives in the compliance context will help to detect fraud, which could well lead to bribery and corruption. As an exercise, map your existing internal controls to the Ten Hallmarks of an Effective Compliance Program or some other well-known anti-corruption regime to see where gaps may exist. This will help you to determine whether adequate compliance internal controls are present in your company. From there you can move to see if they are working in practice.

Three key takeaways:

  1. Effective internal controls are required under the FCPA
  2. Internal controls are a critical part of any best practices compliance program
  3. There are four significant controls for the compliance practitioner to implement initially. (a) Delegation of authority (DOA); (b) Maintenance of the vendor master file; (c) Contracts with third parties; and (d) Movement of cash/currency.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 482 no Day 7 | Policies and Procedures There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2020 Update made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as part of its risk assessment process.” This statement made clear that the regulators will take a strong view against a company that does not have well thought out and articulated policies and procedures against bribery and corruption; all of which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital layer of communication and acts as an internal control. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to policies and procedures in anti-corruption compliance.  The specific written policies and procedures required for a best practices compliance program are well known and long established. According to the 2020 FCPA Resources Guide, some of the risks companies should keep in mind include the nature and extent of transactions with foreign governments (including payments to foreign officials); use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments. Policies help form the basis of expectations for standards of conduct in your company. Procedures are the documents that implement these standards of conduct. The 2020 FCPA Resource Guide ends its section on policies with the following, “Regardless of the specific policies and procedures implemented, these standards should apply to personnel at all levels of the company.” It is important that compliance policies and procedures are applied fairly and consistently across the organization. Institutional fairness demands that if compliance policies and procedures are not applied consistently, there is a greater chance that an employee dismissed for breaching a policy could successfully claim he or she was unfairly terminated. Moreover, inconsistent application of your policies and procedures will destroy the credibility of your compliance program. This last point cannot be over-emphasized. If an employee is going to be terminated for fudging their expense accounts in Brazil, you had best make sure that same conduct lands your top producer in the U.S. with the same quality of discipline. Three key takeaways: Written compliance policies and procedures, together the Code of Conduct, form the backbone of your compliance program. The DOJ and SEC expect a well-thought out and articulated set of compliance policies and procedures and that they be adequately communicated throughout your organization. Institutional fairness for the application of policies and procedures demands consistent application across the globe. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 07 Jan 2021 18:00:00 -0000 Day 7 | Policies and Procedures full 7 Thomas Fox There are numerous reasons to put some serious work into your compliance policies and procedures. There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2020 Update made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as part of its risk assessment process.” This statement made clear that the regulators will take a strong view against a company that does not have well thought out and articulated policies and procedures against bribery and corruption; all of which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital layer of communication and acts as an internal control. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to policies and procedures in anti-corruption compliance.  The specific written policies and procedures required for a best practices compliance program are well known and long established. According to the 2020 FCPA Resources Guide, some of the risks companies should keep in mind include the nature and extent of transactions with foreign governments (including payments to foreign officials); use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments. Policies help form the basis of expectations for standards of conduct in your company. Procedures are the documents that implement these standards of conduct. The 2020 FCPA Resource Guide ends its section on policies with the following, “Regardless of the specific policies and procedures implemented, these standards should apply to personnel at all levels of the company.” It is important that compliance policies and procedures are applied fairly and consistently across the organization. Institutional fairness demands that if compliance policies and procedures are not applied consistently, there is a greater chance that an employee dismissed for breaching a policy could successfully claim he or she was unfairly terminated. Moreover, inconsistent application of your policies and procedures will destroy the credibility of your compliance program. This last point cannot be over-emphasized. If an employee is going to be terminated for fudging their expense accounts in Brazil, you had best make sure that same conduct lands your top producer in the U.S. with the same quality of discipline. Three key takeaways: Written compliance policies and procedures, together the Code of Conduct, form the backbone of your compliance program. The DOJ and SEC expect a well-thought out and articulated set of compliance policies and procedures and that they be adequately communicated throughout your organization. Institutional fairness for the application of policies and procedures demands consistent application across the globe. Learn more about your ad choices. Visit megaphone.fm/adchoices There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2020 Update made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as part of its risk assessment process.” This statement made clear that the regulators will take a strong view against a company that does not have well thought out and articulated policies and procedures against bribery and corruption; all of which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital layer of communication and acts as an internal control. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to policies and procedures in anti-corruption compliance.

 The specific written policies and procedures required for a best practices compliance program are well known and long established. According to the 2020 FCPA Resources Guide, some of the risks companies should keep in mind include the nature and extent of transactions with foreign governments (including payments to foreign officials); use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments. Policies help form the basis of expectations for standards of conduct in your company. Procedures are the documents that implement these standards of conduct.

The 2020 FCPA Resource Guide ends its section on policies with the following, “Regardless of the specific policies and procedures implemented, these standards should apply to personnel at all levels of the company.” It is important that compliance policies and procedures are applied fairly and consistently across the organization. Institutional fairness demands that if compliance policies and procedures are not applied consistently, there is a greater chance that an employee dismissed for breaching a policy could successfully claim he or she was unfairly terminated. Moreover, inconsistent application of your policies and procedures will destroy the credibility of your compliance program. This last point cannot be over-emphasized. If an employee is going to be terminated for fudging their expense accounts in Brazil, you had best make sure that same conduct lands your top producer in the U.S. with the same quality of discipline.

Three key takeaways:

  1. Written compliance policies and procedures, together the Code of Conduct, form the backbone of your compliance program.
  2. The DOJ and SEC expect a well-thought out and articulated set of compliance policies and procedures and that they be adequately communicated throughout your organization.
  3. Institutional fairness for the application of policies and procedures demands consistent application across the globe.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 482 no Day 6 | The Code of Conduct What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in regulator’s face during an enforcement action as proof of ethical overall behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal in the creation of your company’s Code of Conduct?  The three most important things about your compliance program are “Document, Document, and Document.” The same is true in communicating your company’s Code of Conduct. You need to do more than simply put it on your website and tell folks it is there, available and that they should read it. You need to document that all employees, or anyone else that your Code of Conduct is applicable to, has received, read, and understands it. The DOJ expects each company to begin its compliance program with a very publicly announced, very robust Code of Conduct. If your company does not have one, you need to implement one forthwith. However, your Code of Conduct is not a static document to be put on a shelf and never reviewed again. For just as your compliance program is a living entity; it should be constantly evolving, the same is true for your Code of Conduct. If your company has not reviewed or assessed your Code of Conduct for five years, do so in short order, as much has changed in the compliance world. All of this has become much more clear in the age of Coronavirus. Some of the questions you should begin with include: When was the last time your Code of Conduct was revised? Have there been changes to your company’s business model since the last revision to the Code of Conduct? Have there been changes to relevant laws relating to a topic covered in your company’s Code of Conduct? Are any provisions of the Code of Conduct outdated? What is the budget to revise your Code of Conduct? Three key takeaways: Every formulation of a best practices compliance program starts with a written Code of Conduct. The substance of your Code of Conduct should be tailored to the company’s culture, and to its industry and corporate identity. “Document, Document, and Document” your training and communication efforts. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 06 Jan 2021 18:00:00 -0000 Day 6 | The Code of Conduct full Thomas Fox What is the value of having a Code of Conduct? What should be the goal in the creation of your company’s Code of Conduct? What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in regulator’s face during an enforcement action as proof of ethical overall behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal in the creation of your company’s Code of Conduct?  The three most important things about your compliance program are “Document, Document, and Document.” The same is true in communicating your company’s Code of Conduct. You need to do more than simply put it on your website and tell folks it is there, available and that they should read it. You need to document that all employees, or anyone else that your Code of Conduct is applicable to, has received, read, and understands it. The DOJ expects each company to begin its compliance program with a very publicly announced, very robust Code of Conduct. If your company does not have one, you need to implement one forthwith. However, your Code of Conduct is not a static document to be put on a shelf and never reviewed again. For just as your compliance program is a living entity; it should be constantly evolving, the same is true for your Code of Conduct. If your company has not reviewed or assessed your Code of Conduct for five years, do so in short order, as much has changed in the compliance world. All of this has become much more clear in the age of Coronavirus. Some of the questions you should begin with include: When was the last time your Code of Conduct was revised? Have there been changes to your company’s business model since the last revision to the Code of Conduct? Have there been changes to relevant laws relating to a topic covered in your company’s Code of Conduct? Are any provisions of the Code of Conduct outdated? What is the budget to revise your Code of Conduct? Three key takeaways: Every formulation of a best practices compliance program starts with a written Code of Conduct. The substance of your Code of Conduct should be tailored to the company’s culture, and to its industry and corporate identity. “Document, Document, and Document” your training and communication efforts. Learn more about your ad choices. Visit megaphone.fm/adchoices What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in regulator’s face during an enforcement action as proof of ethical overall behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal in the creation of your company’s Code of Conduct?

 The three most important things about your compliance program are “Document, Document, and Document.” The same is true in communicating your company’s Code of Conduct. You need to do more than simply put it on your website and tell folks it is there, available and that they should read it. You need to document that all employees, or anyone else that your Code of Conduct is applicable to, has received, read, and understands it. The DOJ expects each company to begin its compliance program with a very publicly announced, very robust Code of Conduct. If your company does not have one, you need to implement one forthwith.

However, your Code of Conduct is not a static document to be put on a shelf and never reviewed again. For just as your compliance program is a living entity; it should be constantly evolving, the same is true for your Code of Conduct. If your company has not reviewed or assessed your Code of Conduct for five years, do so in short order, as much has changed in the compliance world. All of this has become much more clear in the age of Coronavirus. Some of the questions you should begin with include:

  • When was the last time your Code of Conduct was revised?
  • Have there been changes to your company’s business model since the last revision to the Code of Conduct?
  • Have there been changes to relevant laws relating to a topic covered in your company’s Code of Conduct?
  • Are any provisions of the Code of Conduct outdated?
  • What is the budget to revise your Code of Conduct?

Three key takeaways:

  1. Every formulation of a best practices compliance program starts with a written Code of Conduct.
  2. The substance of your Code of Conduct should be tailored to the company’s culture, and to its industry and corporate identity.
  3. “Document, Document, and Document” your training and communication efforts.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 504 no Day 5 | The Board and Operationalizing Compliance In addition to a company’s senior management, there is a Board of Directors at the top. Yet the role of the Board is different than that of senior management. For the Board of Directors, the 2020 Update stated: Oversight – What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions? What types of information have the board of directors and senior management examined in their exercise of oversight in the area in which the misconduct occurred? Having a Board member with specific compliance expertise or heading a Compliance Committee can provide a level of oversight and commitment to achieving this goal. The DOJ enshrined this requirement in the FCPA Corporate Enforcement Policy. This means that when your company is evaluated by the DOJ, under the factors set out in the 2020 Update and FCPA Corporate Enforcement Policy, to retrospectively determine if your company had a best practices compliance program in place at the time of any violation, you need to have not only the structure of the Board-level Compliance Committee but also the specific subject matter expertise (SME) on the Board and on that committee. Another arm of the US government has recognized the need for such expertise at the Board level. In 2015, the Office of Inspector General (OIG), in a publication entitled “Practical Guidance for Health Care Governing Boards”, called for greater compliance expertise at the Board level. The OIG said that a Board can raise its level of substantive expertise with respect to regulatory and compliance matters by adding to the Board a compliance member. The presence of a such a compliance professional with SME “on the board sends a strong message about the organization’s commitment to compliance, provides a valuable resource to other board members and helps the board better fulfill its oversight obligations.” All of this means that every Board of Directors needs a true compliance expert. Almost every Board has a former Chief Financial Officer (CFO), former head of Internal Audit or persons with a similar background, and often times these are also the Audit Committee members of the Board. Such a background brings a level of sophistication, training and SME that can help all companies with their financial reporting and other finance-based issues. So why is there not such SME at the Board level from the compliance profession?  Three key takeaways: The 2020 Update requires active Board of Director engagement and oversight around compliance Board communication on compliance is a two-way street; both inbound and outbound Does the Board of Directors have a compliance expert? Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 05 Jan 2021 18:00:00 -0000 Day 5 | The Board and Operationalizing Compliance full Thomas Fox What is the role of the Board in operationalizing compliance? In addition to a company’s senior management, there is a Board of Directors at the top. Yet the role of the Board is different than that of senior management. For the Board of Directors, the 2020 Update stated: Oversight – What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions? What types of information have the board of directors and senior management examined in their exercise of oversight in the area in which the misconduct occurred? Having a Board member with specific compliance expertise or heading a Compliance Committee can provide a level of oversight and commitment to achieving this goal. The DOJ enshrined this requirement in the FCPA Corporate Enforcement Policy. This means that when your company is evaluated by the DOJ, under the factors set out in the 2020 Update and FCPA Corporate Enforcement Policy, to retrospectively determine if your company had a best practices compliance program in place at the time of any violation, you need to have not only the structure of the Board-level Compliance Committee but also the specific subject matter expertise (SME) on the Board and on that committee. Another arm of the US government has recognized the need for such expertise at the Board level. In 2015, the Office of Inspector General (OIG), in a publication entitled “Practical Guidance for Health Care Governing Boards”, called for greater compliance expertise at the Board level. The OIG said that a Board can raise its level of substantive expertise with respect to regulatory and compliance matters by adding to the Board a compliance member. The presence of a such a compliance professional with SME “on the board sends a strong message about the organization’s commitment to compliance, provides a valuable resource to other board members and helps the board better fulfill its oversight obligations.” All of this means that every Board of Directors needs a true compliance expert. Almost every Board has a former Chief Financial Officer (CFO), former head of Internal Audit or persons with a similar background, and often times these are also the Audit Committee members of the Board. Such a background brings a level of sophistication, training and SME that can help all companies with their financial reporting and other finance-based issues. So why is there not such SME at the Board level from the compliance profession?  Three key takeaways: The 2020 Update requires active Board of Director engagement and oversight around compliance Board communication on compliance is a two-way street; both inbound and outbound Does the Board of Directors have a compliance expert? Learn more about your ad choices. Visit megaphone.fm/adchoices In addition to a company’s senior management, there is a Board of Directors at the top. Yet the role of the Board is different than that of senior management. For the Board of Directors, the 2020 Update stated:

Oversight – What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions? What types of information have the board of directors and senior management examined in their exercise of oversight in the area in which the misconduct occurred?

Having a Board member with specific compliance expertise or heading a Compliance Committee can provide a level of oversight and commitment to achieving this goal. The DOJ enshrined this requirement in the FCPA Corporate Enforcement Policy. This means that when your company is evaluated by the DOJ, under the factors set out in the 2020 Update and FCPA Corporate Enforcement Policy, to retrospectively determine if your company had a best practices compliance program in place at the time of any violation, you need to have not only the structure of the Board-level Compliance Committee but also the specific subject matter expertise (SME) on the Board and on that committee.

Another arm of the US government has recognized the need for such expertise at the Board level. In 2015, the Office of Inspector General (OIG), in a publication entitled “Practical Guidance for Health Care Governing Boards”, called for greater compliance expertise at the Board level. The OIG said that a Board can raise its level of substantive expertise with respect to regulatory and compliance matters by adding to the Board a compliance member. The presence of a such a compliance professional with SME “on the board sends a strong message about the organization’s commitment to compliance, provides a valuable resource to other board members and helps the board better fulfill its oversight obligations.”

All of this means that every Board of Directors needs a true compliance expert. Almost every Board has a former Chief Financial Officer (CFO), former head of Internal Audit or persons with a similar background, and often times these are also the Audit Committee members of the Board. Such a background brings a level of sophistication, training and SME that can help all companies with their financial reporting and other finance-based issues. So why is there not such SME at the Board level from the compliance profession?

 Three key takeaways:

  1. The 2020 Update requires active Board of Director engagement and oversight around compliance
  2. Board communication on compliance is a two-way street; both inbound and outbound
  3. Does the Board of Directors have a compliance expert?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 497 no Day 4 | Moving Compliance Tone Down Through An Organization Mike Volkov, in a blog post entitled “Mood in the Middle Versus Tone at the Top”, said, “Even when a company does all the right things at the senior management level, the real issue is whether or not that culture has embedded itself in middle and lower management. A company’s culture is reflected in the values and beliefs that exist throughout the company.” To fully operationalize your compliance program, you must articulate the message of ethical values and doing business in compliance and then drive that message from the top down, throughout your organization.  The 2020 Update made clear a company must have more than simply good ‘Tone-at-the-Top’; it must move down through the organization from senior management to middle management and into its lower ranks. It stated, “Beyond compliance structures, policies, and procedures, it is important for a company to create and foster a culture of ethics and compliance with the law at all levels of the company. The effectiveness of a compliance program requires a high-level commitment by company leadership to implement a culture of compliance from the middle and the top.” By engaging employees at this level, you can find out not only what the employees think about the company compliance program but use their collective experience to help design a better and more effective compliance program. Employees want to do business in an ethical manner. Giving employees the chance to engage in business the right way, as opposed to cheating, will win their hearts and minds almost all the time. By using this protocol, you can not only find out the effect of your compliance program on the employees at the bottom, but you can affect them as well. Employees often look to their direct supervisor to determine what the tone of an organization is and will be going forward. Many employees of large, multi-national organizations may never have direct contact with the CEO or even senior management. By moving the values of compliance through an organization into the middle, you will be in a much better position to inculcate these values and operationalizing compliance with them. Three key takeaways: Tone at the top - direct supervisors become the most important influence on people in the company Give your middle managers a Tool Kit around compliance so they can fully operationalize compliance Organizational justice is an additional way to help operationalize compliance Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 04 Jan 2021 18:00:00 -0000 Day 4 | Moving Compliance Tone Down Through An Organization full Thomas Fox How can you move compliance tone down through an organization? Mike Volkov, in a blog post entitled “Mood in the Middle Versus Tone at the Top”, said, “Even when a company does all the right things at the senior management level, the real issue is whether or not that culture has embedded itself in middle and lower management. A company’s culture is reflected in the values and beliefs that exist throughout the company.” To fully operationalize your compliance program, you must articulate the message of ethical values and doing business in compliance and then drive that message from the top down, throughout your organization.  The 2020 Update made clear a company must have more than simply good ‘Tone-at-the-Top’; it must move down through the organization from senior management to middle management and into its lower ranks. It stated, “Beyond compliance structures, policies, and procedures, it is important for a company to create and foster a culture of ethics and compliance with the law at all levels of the company. The effectiveness of a compliance program requires a high-level commitment by company leadership to implement a culture of compliance from the middle and the top.” By engaging employees at this level, you can find out not only what the employees think about the company compliance program but use their collective experience to help design a better and more effective compliance program. Employees want to do business in an ethical manner. Giving employees the chance to engage in business the right way, as opposed to cheating, will win their hearts and minds almost all the time. By using this protocol, you can not only find out the effect of your compliance program on the employees at the bottom, but you can affect them as well. Employees often look to their direct supervisor to determine what the tone of an organization is and will be going forward. Many employees of large, multi-national organizations may never have direct contact with the CEO or even senior management. By moving the values of compliance through an organization into the middle, you will be in a much better position to inculcate these values and operationalizing compliance with them. Three key takeaways: Tone at the top - direct supervisors become the most important influence on people in the company Give your middle managers a Tool Kit around compliance so they can fully operationalize compliance Organizational justice is an additional way to help operationalize compliance Learn more about your ad choices. Visit megaphone.fm/adchoices Mike Volkov, in a blog post entitled “Mood in the Middle Versus Tone at the Top”, said, “Even when a company does all the right things at the senior management level, the real issue is whether or not that culture has embedded itself in middle and lower management. A company’s culture is reflected in the values and beliefs that exist throughout the company.” To fully operationalize your compliance program, you must articulate the message of ethical values and doing business in compliance and then drive that message from the top down, throughout your organization.

 The 2020 Update made clear a company must have more than simply good ‘Tone-at-the-Top’; it must move down through the organization from senior management to middle management and into its lower ranks. It stated, “Beyond compliance structures, policies, and procedures, it is important for a company to create and foster a culture of ethics and compliance with the law at all levels of the company. The effectiveness of a compliance program requires a high-level commitment by company leadership to implement a culture of compliance from the middle and the top.”

By engaging employees at this level, you can find out not only what the employees think about the company compliance program but use their collective experience to help design a better and more effective compliance program. Employees want to do business in an ethical manner. Giving employees the chance to engage in business the right way, as opposed to cheating, will win their hearts and minds almost all the time. By using this protocol, you can not only find out the effect of your compliance program on the employees at the bottom, but you can affect them as well.

Employees often look to their direct supervisor to determine what the tone of an organization is and will be going forward. Many employees of large, multi-national organizations may never have direct contact with the CEO or even senior management. By moving the values of compliance through an organization into the middle, you will be in a much better position to inculcate these values and operationalizing compliance with them.

Three key takeaways:

  1. Tone at the top - direct supervisors become the most important influence on people in the company
  2. Give your middle managers a Tool Kit around compliance so they can fully operationalize compliance
  3. Organizational justice is an additional way to help operationalize compliance

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 497 no Day 3 | Leadership’s Conduct At The Top Obviously, in every compliance program, the ethical tone of a company and accountability all starts at the top and, most specifically, senior management. The 2020 Guidance stated, “Beyond compliance structures, policies, and procedures, it is important for a company to create and foster a culture of ethics and compliance with the law at all levels of the company. The effectiveness of a compliance program requires a high-level commitment by company leadership to implement a culture of compliance from the middle and the top.” This requirement is more than simply the ubiquitous “tone-at-the-top,” as it focuses on the conduct of senior management. The DOJ wants to see a company’s senior leadership actually doing compliance. The DOJ asks if company leadership has, through their words and concrete actions, brought the right message of doing business ethically and in compliance to the organization. How does senior management model its behavior on a company’s values and finally, how is such conduct monitored in an organization? Senior management must share these same values through operationalizing compliance going forward. Lynn Paine, in her seminal article “Managing for Organizational Integrity”, laid out five factors, which can be used as guideposts to not only to set the right tone from senior management on doing business ethically and in compliance, it can lay the groundwork for senior management to model appropriate behavior and then have it monitored by the company going forward. The guiding values of a company must make sense and be clearly communicated by senior management in a variety of settings, to the entire company workforce. The company’s leader must be personally committed and willing to take action on the values. This means that management must not simply ‘overlook’ the transgressions of top producers. A company’s systems and structures must support its guiding principles and these internal systems and structures cannot be over-ridden by senior management without both justification and Board approval. A company’s values must be integrated into normal channels of management decision-making and reflected in the company’s critical decisions. Sometimes a company must turn down business if there are too many red flags present or by engaging in such behavior the company’s value and ethics will be violated. Managers must be empowered to make ethically sound decisions on a day-to-day basis. This means senior management must fully support and back-up such decisions. I once had a Chief Executive Officer (CEO), observe the following, “You want me to be the ambassador for compliance.” I immediately said yes, that is exactly what I need you to do. A CEO, as an “Ambassador of Compliance”, can fully model the conduct that senior management engage in going forward. Another area a CEO can forcefully engage an entire company is through a powerful video message about doing business the right way and in compliance. A great example was a CenterPoint Energy video put out in 2015 after the Volkswagen (VW) emissions-testing scandal became public. The video featured Scott Prochazka, CenterPoint Energy President and CEO. He used the VW scandal to proactively address culture and values at the company and used the entire scenario as an opportunity to promote integrity in the workplace. But more than simply a one-time video, the company followed up with an additional resource, entitled “Manager’s Toolkit - What does Integrity mean to you?”, which managers used to facilitate discussions and ongoing communications with employees around the company’s ethics and compliance programs. Finally, the cost for the video was quite reasonable as it was produced internally. Three key takeaways: Senior management must actually do compliance; walk-the-walk, not simply talk-the-talk. Use your CEO to talk about current events and how those ethical failures are lessons to be learned for your organization. CEO as Compliance Ambassador. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 03 Jan 2021 18:00:00 -0000 Day 3 | Leadership’s Conduct At The Top full 3 Thomas Fox This requirement is more than simply the ubiquitous “tone-at-the-top,” as it focuses on the conduct of senior management. Obviously, in every compliance program, the ethical tone of a company and accountability all starts at the top and, most specifically, senior management. The 2020 Guidance stated, “Beyond compliance structures, policies, and procedures, it is important for a company to create and foster a culture of ethics and compliance with the law at all levels of the company. The effectiveness of a compliance program requires a high-level commitment by company leadership to implement a culture of compliance from the middle and the top.” This requirement is more than simply the ubiquitous “tone-at-the-top,” as it focuses on the conduct of senior management. The DOJ wants to see a company’s senior leadership actually doing compliance. The DOJ asks if company leadership has, through their words and concrete actions, brought the right message of doing business ethically and in compliance to the organization. How does senior management model its behavior on a company’s values and finally, how is such conduct monitored in an organization? Senior management must share these same values through operationalizing compliance going forward. Lynn Paine, in her seminal article “Managing for Organizational Integrity”, laid out five factors, which can be used as guideposts to not only to set the right tone from senior management on doing business ethically and in compliance, it can lay the groundwork for senior management to model appropriate behavior and then have it monitored by the company going forward. The guiding values of a company must make sense and be clearly communicated by senior management in a variety of settings, to the entire company workforce. The company’s leader must be personally committed and willing to take action on the values. This means that management must not simply ‘overlook’ the transgressions of top producers. A company’s systems and structures must support its guiding principles and these internal systems and structures cannot be over-ridden by senior management without both justification and Board approval. A company’s values must be integrated into normal channels of management decision-making and reflected in the company’s critical decisions. Sometimes a company must turn down business if there are too many red flags present or by engaging in such behavior the company’s value and ethics will be violated. Managers must be empowered to make ethically sound decisions on a day-to-day basis. This means senior management must fully support and back-up such decisions. I once had a Chief Executive Officer (CEO), observe the following, “You want me to be the ambassador for compliance.” I immediately said yes, that is exactly what I need you to do. A CEO, as an “Ambassador of Compliance”, can fully model the conduct that senior management engage in going forward. Another area a CEO can forcefully engage an entire company is through a powerful video message about doing business the right way and in compliance. A great example was a CenterPoint Energy video put out in 2015 after the Volkswagen (VW) emissions-testing scandal became public. The video featured Scott Prochazka, CenterPoint Energy President and CEO. He used the VW scandal to proactively address culture and values at the company and used the entire scenario as an opportunity to promote integrity in the workplace. But more than simply a one-time video, the company followed up with an additional resource, entitled “Manager’s Toolkit - What does Integrity mean to you?”, which managers used to facilitate discussions and ongoing communications with employees around the company’s ethics and compliance programs. Finally, the cost for the video was quite reasonable as it was produced internally. Three key takeaways: Senior management must actually do compliance; walk-the-walk, not simply talk-the-talk. Use your CEO to talk about current events and how those ethical failures are lessons to be learned for your organization. CEO as Compliance Ambassador. Learn more about your ad choices. Visit megaphone.fm/adchoices Obviously, in every compliance program, the ethical tone of a company and accountability all starts at the top and, most specifically, senior management. The 2020 Guidance stated, “Beyond compliance structures, policies, and procedures, it is important for a company to create and foster a culture of ethics and compliance with the law at all levels of the company. The effectiveness of a compliance program requires a high-level commitment by company leadership to implement a culture of compliance from the middle and the top.” This requirement is more than simply the ubiquitous “tone-at-the-top,” as it focuses on the conduct of senior management. The DOJ wants to see a company’s senior leadership actually doing compliance. The DOJ asks if company leadership has, through their words and concrete actions, brought the right message of doing business ethically and in compliance to the organization. How does senior management model its behavior on a company’s values and finally, how is such conduct monitored in an organization?

Senior management must share these same values through operationalizing compliance going forward. Lynn Paine, in her seminal article “Managing for Organizational Integrity”, laid out five factors, which can be used as guideposts to not only to set the right tone from senior management on doing business ethically and in compliance, it can lay the groundwork for senior management to model appropriate behavior and then have it monitored by the company going forward.

  1. The guiding values of a company must make sense and be clearly communicated by senior management in a variety of settings, to the entire company workforce.
  2. The company’s leader must be personally committed and willing to take action on the values. This means that management must not simply ‘overlook’ the transgressions of top producers.
  3. A company’s systems and structures must support its guiding principles and these internal systems and structures cannot be over-ridden by senior management without both justification and Board approval.
  4. A company’s values must be integrated into normal channels of management decision-making and reflected in the company’s critical decisions. Sometimes a company must turn down business if there are too many red flags present or by engaging in such behavior the company’s value and ethics will be violated.
  5. Managers must be empowered to make ethically sound decisions on a day-to-day basis. This means senior management must fully support and back-up such decisions.

I once had a Chief Executive Officer (CEO), observe the following, “You want me to be the ambassador for compliance.” I immediately said yes, that is exactly what I need you to do. A CEO, as an “Ambassador of Compliance”, can fully model the conduct that senior management engage in going forward. Another area a CEO can forcefully engage an entire company is through a powerful video message about doing business the right way and in compliance. A great example was a CenterPoint Energy video put out in 2015 after the Volkswagen (VW) emissions-testing scandal became public. The video featured Scott Prochazka, CenterPoint Energy President and CEO. He used the VW scandal to proactively address culture and values at the company and used the entire scenario as an opportunity to promote integrity in the workplace. But more than simply a one-time video, the company followed up with an additional resource, entitled “Manager’s Toolkit - What does Integrity mean to you?”, which managers used to facilitate discussions and ongoing communications with employees around the company’s ethics and compliance programs. Finally, the cost for the video was quite reasonable as it was produced internally.

Three key takeaways:

  1. Senior management must actually do compliance; walk-the-walk, not simply talk-the-talk.
  2. Use your CEO to talk about current events and how those ethical failures are lessons to be learned for your organization.
  3. CEO as Compliance Ambassador.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 497 no Day 2 | Continuous Monitoring and Continuous Improvement I want to next focus specifically on the tactical steps of moving towards both continuous monitoring and continuous improvement of your compliance program. These twin concepts are perhaps the biggest modifications in the 2020 Update. The changes began in Section 1- Risk Assessments. The question-by-question analysis begins with “Is the periodic review limited to a “snapshot” in time or based upon continuous access to operational data and information across functions?” Do you have access to continuous and real time transactional data at your organization? How about across silos within your organization. Most likely the answer to both is “no”. This means you no longer have a best practices compliance program at this point in time. How can you garner such information?  While there is only one question in the Lessons Learned section, it is a compound question. It not only inquiries about data you may have obtained through your own work but also from other company’s in your industry operating in the same geo-region. Without commenting on the potential anti-trust aspects of this issue, if there is public source information available to you (and there always is), how are you using this information in your compliance regime. But this can be simply having your fully operationalized employee base keeping their eyes and ears open at trade show or any other gatherings of industry employee. The next area for continuous monitoring and continuous improvement was in an area of compliance which is not normally associated with those concepts, Policies and Procedures. The final area in the 2020 Update for consideration is appropriate called Continuous Improvement, Periodic Testing and Review and is found in the subsection monikered Evolving Updates. It reads: How often has the company updated its risk assessments and reviewed its compliance policies, procedures, and practices? Has the company undertaken a gap analysis to determine if particular areas of risk are not sufficiently addressed in its policies, controls, or training? What steps has the company taken to determine whether policies/procedures/practices make sense for particular business segments/subsidiaries? Does the company review and adapt its compliance program based upon lessons learned from its own misconduct and/or that of other companies facing similar risks? Similar to the language under Risk Assessment, this compound question considers the adaptation of a compliance program from your own lessons learned but also from other companies. The distinction now is that phrase is “other companies facing similar risks”? Think about how this language would apply to any company operating in China, West Africa or any other high-risk region in the globe. I would interpret this to mean every Chief Compliance Officer (CCO) and compliance practitioner needs to stay abreast of international anti-corruption enforcement actions where your company may be doing business. Three key takeaways: What is your process for continuous monitoring? What is your process for continuous Improvement? What source of information do you use that are outside your organization? Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 02 Jan 2021 18:02:00 -0000 Day 2 | Continuous Monitoring and Continuous Improvement full Thomas Fox Some of the biggest changes from the past year were around continuous monitoring and continuous improvement. I want to next focus specifically on the tactical steps of moving towards both continuous monitoring and continuous improvement of your compliance program. These twin concepts are perhaps the biggest modifications in the 2020 Update. The changes began in Section 1- Risk Assessments. The question-by-question analysis begins with “Is the periodic review limited to a “snapshot” in time or based upon continuous access to operational data and information across functions?” Do you have access to continuous and real time transactional data at your organization? How about across silos within your organization. Most likely the answer to both is “no”. This means you no longer have a best practices compliance program at this point in time. How can you garner such information?  While there is only one question in the Lessons Learned section, it is a compound question. It not only inquiries about data you may have obtained through your own work but also from other company’s in your industry operating in the same geo-region. Without commenting on the potential anti-trust aspects of this issue, if there is public source information available to you (and there always is), how are you using this information in your compliance regime. But this can be simply having your fully operationalized employee base keeping their eyes and ears open at trade show or any other gatherings of industry employee. The next area for continuous monitoring and continuous improvement was in an area of compliance which is not normally associated with those concepts, Policies and Procedures. The final area in the 2020 Update for consideration is appropriate called Continuous Improvement, Periodic Testing and Review and is found in the subsection monikered Evolving Updates. It reads: How often has the company updated its risk assessments and reviewed its compliance policies, procedures, and practices? Has the company undertaken a gap analysis to determine if particular areas of risk are not sufficiently addressed in its policies, controls, or training? What steps has the company taken to determine whether policies/procedures/practices make sense for particular business segments/subsidiaries? Does the company review and adapt its compliance program based upon lessons learned from its own misconduct and/or that of other companies facing similar risks? Similar to the language under Risk Assessment, this compound question considers the adaptation of a compliance program from your own lessons learned but also from other companies. The distinction now is that phrase is “other companies facing similar risks”? Think about how this language would apply to any company operating in China, West Africa or any other high-risk region in the globe. I would interpret this to mean every Chief Compliance Officer (CCO) and compliance practitioner needs to stay abreast of international anti-corruption enforcement actions where your company may be doing business. Three key takeaways: What is your process for continuous monitoring? What is your process for continuous Improvement? What source of information do you use that are outside your organization? Learn more about your ad choices. Visit megaphone.fm/adchoices I want to next focus specifically on the tactical steps of moving towards both continuous monitoring and continuous improvement of your compliance program. These twin concepts are perhaps the biggest modifications in the 2020 Update. The changes began in Section 1- Risk Assessments. The question-by-question analysis begins with “Is the periodic review limited to a “snapshot” in time or based upon continuous access to operational data and information across functions?” Do you have access to continuous and real time transactional data at your organization? How about across silos within your organization. Most likely the answer to both is “no”. This means you no longer have a best practices compliance program at this point in time. How can you garner such information?

 While there is only one question in the Lessons Learned section, it is a compound question. It not only inquiries about data you may have obtained through your own work but also from other company’s in your industry operating in the same geo-region. Without commenting on the potential anti-trust aspects of this issue, if there is public source information available to you (and there always is), how are you using this information in your compliance regime. But this can be simply having your fully operationalized employee base keeping their eyes and ears open at trade show or any other gatherings of industry employee.

The next area for continuous monitoring and continuous improvement was in an area of compliance which is not normally associated with those concepts, Policies and Procedures. The final area in the 2020 Update for consideration is appropriate called Continuous Improvement, Periodic Testing and Review and is found in the subsection monikered Evolving Updates. It reads:

How often has the company updated its risk assessments and reviewed its compliance policies, procedures, and practices? Has the company undertaken a gap analysis to determine if particular areas of risk are not sufficiently addressed in its policies, controls, or training? What steps has the company taken to determine whether policies/procedures/practices make sense for particular business segments/subsidiaries? Does the company review and adapt its compliance program based upon lessons learned from its own misconduct and/or that of other companies facing similar risks?

Similar to the language under Risk Assessment, this compound question considers the adaptation of a compliance program from your own lessons learned but also from other companies. The distinction now is that phrase is “other companies facing similar risks”? Think about how this language would apply to any company operating in China, West Africa or any other high-risk region in the globe. I would interpret this to mean every Chief Compliance Officer (CCO) and compliance practitioner needs to stay abreast of international anti-corruption enforcement actions where your company may be doing business.

Three key takeaways:

  1. What is your process for continuous monitoring?
  2. What is your process for continuous Improvement?
  3. What source of information do you use that are outside your organization?


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 497 no Day 1 | What 2020 Brought To Compliance Programs 2020 was a very significant year for every compliance practitioner and compliance program. Not only was it the year with the single highest anti-bribery fine ever and highest annual amount of FCPA penalties. There were several significant enforcement actions, involving corporations coupled with a large number of individual prosecutions. Yet, perhaps most significantly, there were two noteworthy releases of information by the federal government which directly impacted compliance professionals. In June, the Department of Justice (DOJ) released its 2020 Update to the Evaluation of Corporate Compliance Programs - Guidance Document (2020 Evaluation) was released. It should be mandatory reading for every Chief Compliance Officer (CCO), compliance practitioner and professional or any other person interested in the latest thinking of the DOJ on what constitutes a best practices compliance program. The second release was the DOJ and Securities and Exchange Commission (SEC) released the updated A RESOURCE GUIDE TO THE U.S. FOREIGN CORRUPT PRACTICES ACT SECOND EDITION (2020 FCPA Resource Guide). This was a most welcomed update to the seminal and original FCPA Resource Guide, released in 2012 and widely recognized as the single best volume on the FCPA. Some of the key changes for the compliance professional include the following.  The first change to note is the expanded definition to the questions “Is it [a corporate compliance program] being applied in good faith” with the addition of the queries, “In other words, is the program adequately resourced and empowered to function effectively?” This language comes from the 2020 Update. This change clearly reflects the need for a company to do far more than have a paper compliance program in place which presaged many of the changes brought forward in the 2020 Update. However, the biggest change is the addition of a new Hallmark, entitled “Investigation, Analysis, and Remediation of Misconduct.  There are many interesting aspects to this new Hallmark, not the least that it begins with “The truest measure of an effective compliance program is how it responds to misconduct.”  The 2020 Resource Guide is a most welcomed document from the DOJ and SEC. It brings forward the top FCPA and compliance resource from the past decade into this decade. The 2020 Update continues the DOJ communication to the compliance community about its expectations for a best practices compliance program.  Three Key Takeaways The 2020 Update brings business intelligence to compliance. The key theme is continuous monitoring and continuous improvement. The 2020 FCPA Resource Guide emphasized the importance of root cause analysis. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 01 Jan 2021 18:00:00 -0000 Day 1 | What 2020 Brought To Compliance Programs full Thomas Fox In this episode of 31 Days to a More Effective Compliance Program, I highlight what 2020 Brought To Compliance Programs. 2020 was a very significant year for every compliance practitioner and compliance program. Not only was it the year with the single highest anti-bribery fine ever and highest annual amount of FCPA penalties. There were several significant enforcement actions, involving corporations coupled with a large number of individual prosecutions. Yet, perhaps most significantly, there were two noteworthy releases of information by the federal government which directly impacted compliance professionals. In June, the Department of Justice (DOJ) released its 2020 Update to the Evaluation of Corporate Compliance Programs - Guidance Document (2020 Evaluation) was released. It should be mandatory reading for every Chief Compliance Officer (CCO), compliance practitioner and professional or any other person interested in the latest thinking of the DOJ on what constitutes a best practices compliance program. The second release was the DOJ and Securities and Exchange Commission (SEC) released the updated A RESOURCE GUIDE TO THE U.S. FOREIGN CORRUPT PRACTICES ACT SECOND EDITION (2020 FCPA Resource Guide). This was a most welcomed update to the seminal and original FCPA Resource Guide, released in 2012 and widely recognized as the single best volume on the FCPA. Some of the key changes for the compliance professional include the following.  The first change to note is the expanded definition to the questions “Is it [a corporate compliance program] being applied in good faith” with the addition of the queries, “In other words, is the program adequately resourced and empowered to function effectively?” This language comes from the 2020 Update. This change clearly reflects the need for a company to do far more than have a paper compliance program in place which presaged many of the changes brought forward in the 2020 Update. However, the biggest change is the addition of a new Hallmark, entitled “Investigation, Analysis, and Remediation of Misconduct.  There are many interesting aspects to this new Hallmark, not the least that it begins with “The truest measure of an effective compliance program is how it responds to misconduct.”  The 2020 Resource Guide is a most welcomed document from the DOJ and SEC. It brings forward the top FCPA and compliance resource from the past decade into this decade. The 2020 Update continues the DOJ communication to the compliance community about its expectations for a best practices compliance program.  Three Key Takeaways The 2020 Update brings business intelligence to compliance. The key theme is continuous monitoring and continuous improvement. The 2020 FCPA Resource Guide emphasized the importance of root cause analysis. Learn more about your ad choices. Visit megaphone.fm/adchoices 2020 was a very significant year for every compliance practitioner and compliance program. Not only was it the year with the single highest anti-bribery fine ever and highest annual amount of FCPA penalties. There were several significant enforcement actions, involving corporations coupled with a large number of individual prosecutions. Yet, perhaps most significantly, there were two noteworthy releases of information by the federal government which directly impacted compliance professionals.

In June, the Department of Justice (DOJ) released its 2020 Update to the Evaluation of Corporate Compliance Programs - Guidance Document (2020 Evaluation) was released. It should be mandatory reading for every Chief Compliance Officer (CCO), compliance practitioner and professional or any other person interested in the latest thinking of the DOJ on what constitutes a best practices compliance program.

The second release was the DOJ and Securities and Exchange Commission (SEC) released the updated A RESOURCE GUIDE TO THE U.S. FOREIGN CORRUPT PRACTICES ACT SECOND EDITION (2020 FCPA Resource Guide). This was a most welcomed update to the seminal and original FCPA Resource Guide, released in 2012 and widely recognized as the single best volume on the FCPA. Some of the key changes for the compliance professional include the following. 

The first change to note is the expanded definition to the questions “Is it [a corporate compliance program] being applied in good faith” with the addition of the queries, “In other words, is the program adequately resourced and empowered to function effectively?” This language comes from the 2020 Update. This change clearly reflects the need for a company to do far more than have a paper compliance program in place which presaged many of the changes brought forward in the 2020 Update.

However, the biggest change is the addition of a new Hallmark, entitled “Investigation, Analysis, and Remediation of Misconduct.  There are many interesting aspects to this new Hallmark, not the least that it begins with “The truest measure of an effective compliance program is how it responds to misconduct.” 

The 2020 Resource Guide is a most welcomed document from the DOJ and SEC. It brings forward the top FCPA and compliance resource from the past decade into this decade. The 2020 Update continues the DOJ communication to the compliance community about its expectations for a best practices compliance program. 

Three Key Takeaways

  1. The 2020 Update brings business intelligence to compliance.
  2. The key theme is continuous monitoring and continuous improvement.
  3. The 2020 FCPA Resource Guide emphasized the importance of root cause analysis.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 603 no Compliance training from the movies If there is one truism from the practices of law which translates to the practice of compliance it is that you are only limited by your own imagination. This holds true in the 360-degree realm of communication in compliance, as communications obviously comes in many forms. Many compliance practitioners will well remember the 2012 Morgan Stanley declination. In this first declination made public, the DOJ recognized Morgan Stanley for emailing out 35 compliance reminders to Garth Peterson over seven years. Think about the power of 360-degrees of communications in the context of compliance reminders. Now imagine the power of short ethics and compliance video training clips going out over the same period of time and the effect it would have both on your employees and the regulators.  Marc Havener, founder and CEO of Resonate Pictures, Inc., created a series of video shorts for a consulting company on compliance and ethics. Rather than the traditional legal approach of telling employees about the corporate policy on compliance, they wanted to tell a story about compliance through the art of movie-based storytelling that wove messaging into characters to tell a story. I have urged compliance practitioners to bring more storytelling into their compliance messaging. If you put the employee in the shoes of the person they’re watching, they will remember it, because they will see how it applies to their lives. Havener noted the training experience will last “exponentially longer than if you just go over a written policy or show a PowerPoint”. He called it “expanding your classroom”. The next time they see George Clooney they’re going to remember the training, the next time they watch that movie that you showed a clip from they’re going to be reminded of the training and so it becomes a great drift method of training.” Three key takeaways: Storytelling is another form of communication. Movie clips in compliance training can provide useful touchstones that employees can relate to for compliance lessons. The Morgan Stanley declination gave credit for annual compliance reminders. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 30 Dec 2020 18:00:00 -0000 Compliance training from the movies full Thomas Fox How can movies be a great compliance training tool? Find out in today's episode of 31 Days to a More Effective Compliance Program. If there is one truism from the practices of law which translates to the practice of compliance it is that you are only limited by your own imagination. This holds true in the 360-degree realm of communication in compliance, as communications obviously comes in many forms. Many compliance practitioners will well remember the 2012 Morgan Stanley declination. In this first declination made public, the DOJ recognized Morgan Stanley for emailing out 35 compliance reminders to Garth Peterson over seven years. Think about the power of 360-degrees of communications in the context of compliance reminders. Now imagine the power of short ethics and compliance video training clips going out over the same period of time and the effect it would have both on your employees and the regulators.  Marc Havener, founder and CEO of Resonate Pictures, Inc., created a series of video shorts for a consulting company on compliance and ethics. Rather than the traditional legal approach of telling employees about the corporate policy on compliance, they wanted to tell a story about compliance through the art of movie-based storytelling that wove messaging into characters to tell a story. I have urged compliance practitioners to bring more storytelling into their compliance messaging. If you put the employee in the shoes of the person they’re watching, they will remember it, because they will see how it applies to their lives. Havener noted the training experience will last “exponentially longer than if you just go over a written policy or show a PowerPoint”. He called it “expanding your classroom”. The next time they see George Clooney they’re going to remember the training, the next time they watch that movie that you showed a clip from they’re going to be reminded of the training and so it becomes a great drift method of training.” Three key takeaways: Storytelling is another form of communication. Movie clips in compliance training can provide useful touchstones that employees can relate to for compliance lessons. The Morgan Stanley declination gave credit for annual compliance reminders. Learn more about your ad choices. Visit megaphone.fm/adchoices If there is one truism from the practices of law which translates to the practice of compliance it is that you are only limited by your own imagination. This holds true in the 360-degree realm of communication in compliance, as communications obviously comes in many forms. Many compliance practitioners will well remember the 2012 Morgan Stanley declination. In this first declination made public, the DOJ recognized Morgan Stanley for emailing out 35 compliance reminders to Garth Peterson over seven years. Think about the power of 360-degrees of communications in the context of compliance reminders. Now imagine the power of short ethics and compliance video training clips going out over the same period of time and the effect it would have both on your employees and the regulators. 

Marc Havener, founder and CEO of Resonate Pictures, Inc., created a series of video shorts for a consulting company on compliance and ethics. Rather than the traditional legal approach of telling employees about the corporate policy on compliance, they wanted to tell a story about compliance through the art of movie-based storytelling that wove messaging into characters to tell a story.

I have urged compliance practitioners to bring more storytelling into their compliance messaging. If you put the employee in the shoes of the person they’re watching, they will remember it, because they will see how it applies to their lives. Havener noted the training experience will last “exponentially longer than if you just go over a written policy or show a PowerPoint”. He called it “expanding your classroom”. The next time they see George Clooney they’re going to remember the training, the next time they watch that movie that you showed a clip from they’re going to be reminded of the training and so it becomes a great drift method of training.”

Three key takeaways:

  1. Storytelling is another form of communication.
  2. Movie clips in compliance training can provide useful touchstones that employees can relate to for compliance lessons.
  3. The Morgan Stanley declination gave credit for annual compliance reminders.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 531 no Measuring Compliance Training Effectiveness Since at least 2017, the DOJ has emphasized the need for a determination of compliance training effectiveness. In the 2020 Update, it stated under the section entitled, “Form/Content/Effectiveness of Training” the following questions, How has the company measured the effectiveness of the training? Have employees been tested on what they have learned? How has the company addressed employees who fail all or a portion of the testing? Has the company evaluated the extent to which the training has an impact on employee behavior or operations? The importance of determining effectiveness of your compliance program was enshrined by the DOJ in its 2020 Evaluation. The 2020 Evaluation demonstrates the DOJ wants to see evidence of the effectiveness of your compliance program. This is something that many CCOs and compliance professionals still struggle to determine. Both the simple guidelines suggested herein, the more robust assessment and results provide you with a start to fulfill the precepts set out in the 2020 Evaluation, but you will eventually need to demonstrate the effectiveness of your compliance training going forward. Three key takeaways: You must demonstrate you have measured the effectiveness of your compliance training. The DOJ is clearly moving into requiring a demonstration of effectiveness of compliance training. You should be moving towards a model of demonstrating compliance training ROI to validate full operationalization of your compliance training.  Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 29 Dec 2020 18:00:00 -0000 Measuring Compliance Training Effectiveness full Thomas Fox Since at least 2017, the DOJ has emphasized the need for a determination of compliance training effectiveness. Find out how to do so in today's 31 Days to a More Effective Compliance Program. Since at least 2017, the DOJ has emphasized the need for a determination of compliance training effectiveness. In the 2020 Update, it stated under the section entitled, “Form/Content/Effectiveness of Training” the following questions, How has the company measured the effectiveness of the training? Have employees been tested on what they have learned? How has the company addressed employees who fail all or a portion of the testing? Has the company evaluated the extent to which the training has an impact on employee behavior or operations? The importance of determining effectiveness of your compliance program was enshrined by the DOJ in its 2020 Evaluation. The 2020 Evaluation demonstrates the DOJ wants to see evidence of the effectiveness of your compliance program. This is something that many CCOs and compliance professionals still struggle to determine. Both the simple guidelines suggested herein, the more robust assessment and results provide you with a start to fulfill the precepts set out in the 2020 Evaluation, but you will eventually need to demonstrate the effectiveness of your compliance training going forward. Three key takeaways: You must demonstrate you have measured the effectiveness of your compliance training. The DOJ is clearly moving into requiring a demonstration of effectiveness of compliance training. You should be moving towards a model of demonstrating compliance training ROI to validate full operationalization of your compliance training.  Learn more about your ad choices. Visit megaphone.fm/adchoices Since at least 2017, the DOJ has emphasized the need for a determination of compliance training effectiveness. In the 2020 Update, it stated under the section entitled, “Form/Content/Effectiveness of Training” the following questions, How has the company measured the effectiveness of the training? Have employees been tested on what they have learned? How has the company addressed employees who fail all or a portion of the testing? Has the company evaluated the extent to which the training has an impact on employee behavior or operations?

The importance of determining effectiveness of your compliance program was enshrined by the DOJ in its 2020 Evaluation. The 2020 Evaluation demonstrates the DOJ wants to see evidence of the effectiveness of your compliance program. This is something that many CCOs and compliance professionals still struggle to determine. Both the simple guidelines suggested herein, the more robust assessment and results provide you with a start to fulfill the precepts set out in the 2020 Evaluation, but you will eventually need to demonstrate the effectiveness of your compliance training going forward.

Three key takeaways:

  1. You must demonstrate you have measured the effectiveness of your compliance training.
  2. The DOJ is clearly moving into requiring a demonstration of effectiveness of compliance training.
  3. You should be moving towards a model of demonstrating compliance training ROI to validate full operationalization of your compliance training. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 531 no Compliance Training Frequency What should be your organization’s compliance training frequency? How does the amount of training can positively or negatively impact an overall training strategy? Unfortunately, these questions were not answered by the 2020 Update or the 2020 FCPA Resource Guide. Still every company should have a “well-designed compliance program is appropriately tailored training and communications.”  Often compliance professionals think that compliance training needs to be conducted very frequently, even if it means repeating the same training courses every year. However, Shawn Rogers analogizes compliance training to an automobile’s windshield wiper system in a discussion of how frequently compliance training should be administered. He went on to explain that “it would not make any sense to run your wipers constantly, even when it is not raining. First, it would be extremely annoying to the passengers. And second, eventually it would wear out both the wiper blades and the wiper motor. It would simply be nonsensical.” Requiring overly repetitive training is like running your windshield wipers in clear weather. The learners are going to be annoyed, the training will be viewed as a waste of time and energy and finally your employees will not take training as seriously when it is really needed to address a specific situation as the compliance training will be viewed literally and figuratively as a “check-the-box” exercise. While new employees should be required to take more detailed courses during their first year so that they are exposed to the key risks in detail, after that, full-length courses can be staggered in a three-year interval so you can keep the courses updated and to avoid over-training. In the interim, you can move towards a less frequent repetition of lengthy training courses and more frequent refresher or reminder training modules that keep the risk top-of-mind without assuming that lengthy courses need to be repeated every year. Once again this fits the 2020 Update prescription that “companies have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit, or other risk management functions.” Rogers concluded “It is a very common sense and defensible approach to compliance training.”  Three key takeaways:  Have a well-reasoned approach to training frequency. Lengthier more full-bodied training can be given once every three years or so. Shorter more frequent compliance refreshers or reminders can be used to keep the risk top-of-mind. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 28 Dec 2020 18:00:00 -0000 Compliance Training Frequency full Thomas Fox What should be your organization’s compliance training frequency? Find out more in today's 31 Days to a More Effective Compliance Program. What should be your organization’s compliance training frequency? How does the amount of training can positively or negatively impact an overall training strategy? Unfortunately, these questions were not answered by the 2020 Update or the 2020 FCPA Resource Guide. Still every company should have a “well-designed compliance program is appropriately tailored training and communications.”  Often compliance professionals think that compliance training needs to be conducted very frequently, even if it means repeating the same training courses every year. However, Shawn Rogers analogizes compliance training to an automobile’s windshield wiper system in a discussion of how frequently compliance training should be administered. He went on to explain that “it would not make any sense to run your wipers constantly, even when it is not raining. First, it would be extremely annoying to the passengers. And second, eventually it would wear out both the wiper blades and the wiper motor. It would simply be nonsensical.” Requiring overly repetitive training is like running your windshield wipers in clear weather. The learners are going to be annoyed, the training will be viewed as a waste of time and energy and finally your employees will not take training as seriously when it is really needed to address a specific situation as the compliance training will be viewed literally and figuratively as a “check-the-box” exercise. While new employees should be required to take more detailed courses during their first year so that they are exposed to the key risks in detail, after that, full-length courses can be staggered in a three-year interval so you can keep the courses updated and to avoid over-training. In the interim, you can move towards a less frequent repetition of lengthy training courses and more frequent refresher or reminder training modules that keep the risk top-of-mind without assuming that lengthy courses need to be repeated every year. Once again this fits the 2020 Update prescription that “companies have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit, or other risk management functions.” Rogers concluded “It is a very common sense and defensible approach to compliance training.”  Three key takeaways:  Have a well-reasoned approach to training frequency. Lengthier more full-bodied training can be given once every three years or so. Shorter more frequent compliance refreshers or reminders can be used to keep the risk top-of-mind. Learn more about your ad choices. Visit megaphone.fm/adchoices What should be your organization’s compliance training frequency? How does the amount of training can positively or negatively impact an overall training strategy? Unfortunately, these questions were not answered by the 2020 Update or the 2020 FCPA Resource Guide. Still every company should have a “well-designed compliance program is appropriately tailored training and communications.”

 Often compliance professionals think that compliance training needs to be conducted very frequently, even if it means repeating the same training courses every year. However, Shawn Rogers analogizes compliance training to an automobile’s windshield wiper system in a discussion of how frequently compliance training should be administered. He went on to explain that “it would not make any sense to run your wipers constantly, even when it is not raining. First, it would be extremely annoying to the passengers. And second, eventually it would wear out both the wiper blades and the wiper motor. It would simply be nonsensical.” Requiring overly repetitive training is like running your windshield wipers in clear weather. The learners are going to be annoyed, the training will be viewed as a waste of time and energy and finally your employees will not take training as seriously when it is really needed to address a specific situation as the compliance training will be viewed literally and figuratively as a “check-the-box” exercise.

While new employees should be required to take more detailed courses during their first year so that they are exposed to the key risks in detail, after that, full-length courses can be staggered in a three-year interval so you can keep the courses updated and to avoid over-training. In the interim, you can move towards a less frequent repetition of lengthy training courses and more frequent refresher or reminder training modules that keep the risk top-of-mind without assuming that lengthy courses need to be repeated every year. Once again this fits the 2020 Update prescription that “companies have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit, or other risk management functions.” Rogers concluded “It is a very common sense and defensible approach to compliance training.”

 Three key takeaways: 

  1. Have a well-reasoned approach to training frequency.
  2. Lengthier more full-bodied training can be given once every three years or so.
  3. Shorter more frequent compliance refreshers or reminders can be used to keep the risk top-of-mind.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 534 no Why You Should Have a Compliance Training Governance Committee One issue not often considered by compliance professionals around compliance training is that of compliance training governance. Yet a multinational organization subject to the FCPA faces many legal and regulatory risks and often many of those risks are "owned" by organizations that are outside of the compliance function. How can your organization, create a comprehensive compliance training program that covers its complete risk profile?  In the age of Coronavirus, any multinational organization will have a broad risk portfolio which are typically owned across the organization. Consider compliance risk, fraud risk, reputational risk, financial accounting risk and discrimination risk. These are but a small sample of risk many of the risks will not be "owned" by the corporate compliance function. This presents a real challenge when you are trying to create a comprehensive compliance training program covering all of legal, regulatory, compliance and reputational risks faced by a company. Shawn Rogers suggests that one approach “is to establish a corporate Compliance Training Governance Committee that looks at the company's overall risk profile and builds a cross-functional and comprehensive multi-year training plan that effectively addresses all of the risks in a company's risk portfolio.”  A Compliance Training Governance Committee will allow your organization to effectively establish a multi-year training plan, help in the vendor selection and engage in course creation. Rogers said that “One of the biggest benefits has been the predictability that it brings to the compliance training program. Every stakeholder from a risk-owning organization knows exactly when their function will have their course deployed over the three-year calendar. They can plan resources, they have a long lead-time to develop the courses and during their off-years they can do communications campaigns and events to keep their risk top-of-mind.”  Three key takeaways:  Why your organization should create a Compliance Training Governance Committee. Who should be on the Compliance Training Governance Committee? How should the Compliance Training Governance Committee work going forward? Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 23 Dec 2020 18:00:00 -0000 Why You Should Have a Compliance Training Governance Committee full Thomas Fox A Compliance Training Governance Committee can help create a comprehensive compliance training program that covers your complete risk profile. One issue not often considered by compliance professionals around compliance training is that of compliance training governance. Yet a multinational organization subject to the FCPA faces many legal and regulatory risks and often many of those risks are "owned" by organizations that are outside of the compliance function. How can your organization, create a comprehensive compliance training program that covers its complete risk profile?  In the age of Coronavirus, any multinational organization will have a broad risk portfolio which are typically owned across the organization. Consider compliance risk, fraud risk, reputational risk, financial accounting risk and discrimination risk. These are but a small sample of risk many of the risks will not be "owned" by the corporate compliance function. This presents a real challenge when you are trying to create a comprehensive compliance training program covering all of legal, regulatory, compliance and reputational risks faced by a company. Shawn Rogers suggests that one approach “is to establish a corporate Compliance Training Governance Committee that looks at the company's overall risk profile and builds a cross-functional and comprehensive multi-year training plan that effectively addresses all of the risks in a company's risk portfolio.”  A Compliance Training Governance Committee will allow your organization to effectively establish a multi-year training plan, help in the vendor selection and engage in course creation. Rogers said that “One of the biggest benefits has been the predictability that it brings to the compliance training program. Every stakeholder from a risk-owning organization knows exactly when their function will have their course deployed over the three-year calendar. They can plan resources, they have a long lead-time to develop the courses and during their off-years they can do communications campaigns and events to keep their risk top-of-mind.”  Three key takeaways:  Why your organization should create a Compliance Training Governance Committee. Who should be on the Compliance Training Governance Committee? How should the Compliance Training Governance Committee work going forward? Learn more about your ad choices. Visit megaphone.fm/adchoices One issue not often considered by compliance professionals around compliance training is that of compliance training governance. Yet a multinational organization subject to the FCPA faces many legal and regulatory risks and often many of those risks are "owned" by organizations that are outside of the compliance function. How can your organization, create a comprehensive compliance training program that covers its complete risk profile? 

In the age of Coronavirus, any multinational organization will have a broad risk portfolio which are typically owned across the organization. Consider compliance risk, fraud risk, reputational risk, financial accounting risk and discrimination risk. These are but a small sample of risk many of the risks will not be "owned" by the corporate compliance function. This presents a real challenge when you are trying to create a comprehensive compliance training program covering all of legal, regulatory, compliance and reputational risks faced by a company. Shawn Rogers suggests that one approach “is to establish a corporate Compliance Training Governance Committee that looks at the company's overall risk profile and builds a cross-functional and comprehensive multi-year training plan that effectively addresses all of the risks in a company's risk portfolio.” 

A Compliance Training Governance Committee will allow your organization to effectively establish a multi-year training plan, help in the vendor selection and engage in course creation. Rogers said that “One of the biggest benefits has been the predictability that it brings to the compliance training program. Every stakeholder from a risk-owning organization knows exactly when their function will have their course deployed over the three-year calendar. They can plan resources, they have a long lead-time to develop the courses and during their off-years they can do communications campaigns and events to keep their risk top-of-mind.” 

Three key takeaways: 

  1. Why your organization should create a Compliance Training Governance Committee.
  2. Who should be on the Compliance Training Governance Committee?
  3. How should the Compliance Training Governance Committee work going forward?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 534 no Ten Compliance Training Program Design Objectives Shawn Rogers, Senior Director, Global Training & Awareness, Walmart has developed ten design objectives for establishing your compliance program training design objectives. You should consider doing the same for your organization. It may well be that your organization may value other objectives. What the government has told us since the original FCPA Resource Guide back in 2012 is that it expects a well thoughout approach. If you consider your design objectives early in the planning phase, it will not only meet this requirement but also become a roadmap for your program implementation easier. Finally, in this new era, you will have the ability to pivot more quickly as new compliance risks emerge.  Three key takeaways:  What are your design objectives? They should be dynamic, not static. You should use them as touchpoints going forward. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 22 Dec 2020 18:00:00 -0000 Ten Compliance Training Program Design Objectives full Thomas Fox Shawn Rogers has developed ten design objectives for establishing your compliance program training design objectives. You should consider doing the same for your organization. Shawn Rogers, Senior Director, Global Training & Awareness, Walmart has developed ten design objectives for establishing your compliance program training design objectives. You should consider doing the same for your organization. It may well be that your organization may value other objectives. What the government has told us since the original FCPA Resource Guide back in 2012 is that it expects a well thoughout approach. If you consider your design objectives early in the planning phase, it will not only meet this requirement but also become a roadmap for your program implementation easier. Finally, in this new era, you will have the ability to pivot more quickly as new compliance risks emerge.  Three key takeaways:  What are your design objectives? They should be dynamic, not static. You should use them as touchpoints going forward. Learn more about your ad choices. Visit megaphone.fm/adchoices Shawn Rogers, Senior Director, Global Training & Awareness, Walmart has developed ten design objectives for establishing your compliance program training design objectives. You should consider doing the same for your organization.

It may well be that your organization may value other objectives. What the government has told us since the original FCPA Resource Guide back in 2012 is that it expects a well thoughout approach. If you consider your design objectives early in the planning phase, it will not only meet this requirement but also become a roadmap for your program implementation easier. Finally, in this new era, you will have the ability to pivot more quickly as new compliance risks emerge.

 Three key takeaways: 

  1. What are your design objectives?
  2. They should be dynamic, not static.
  3. You should use them as touchpoints going forward.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 555 no Envisioning Your Compliance Training Program How can you begin to think through a best practices compliance training program? I put that question to Shawn Rogers, Senior Director, Global Training & Awareness, Walmart. Rogers advised that you ‘envision’ what your training would like as a first step. He stated, “A common mistake is jumping right to the question is which courses you want and how to deploy them. However, there are several things you need to think about before you start building the program.”  You should develop some principles on what your compliance training will look like. A key way to start is by reference to the Training and Communications section of the 2020 Update, which stated, “Prosecutors should assess the steps taken by the company to ensure that policies and procedures have been integrated into the organization, including through periodic training and certification for all directors, officers, relevant employees, and, where appropriate, agents and business partners. Prosecutors should also assess whether the company has relayed information in a manner tailored to the audience’s size, sophistication, or subject matter expertise. Some companies, for instance, give employees practical advice or case studies to address real-life scenarios, and/or guidance on how to obtain ethics advice on a case-by-case basis as needs arise.” Some of these principals include the following, What are the Guiding Principles of your compliance training? What are you trying to communicate? Is it a broad set of values you want to communicate to every employee about what your organization stands for? As noted in the 2020 Update, a company should “should examine whether the compliance program is being disseminated to, and understood by, employees in practice in order to decide whether the compliance program is “truly effective.”  Three key takeaways:  The 2020 Update has a strong emphasis on compliance training. Create a set of Principles for your compliance training programs. You should always use the Principle of your compliance training program in making decisions going forward. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 21 Dec 2020 18:00:00 -0000 Envisioning Your Compliance Training Program full Thomas Fox How can you begin to think through a best practices compliance training program? To begin you ‘envision’ what your training would like as a first step. How can you begin to think through a best practices compliance training program? I put that question to Shawn Rogers, Senior Director, Global Training & Awareness, Walmart. Rogers advised that you ‘envision’ what your training would like as a first step. He stated, “A common mistake is jumping right to the question is which courses you want and how to deploy them. However, there are several things you need to think about before you start building the program.”  You should develop some principles on what your compliance training will look like. A key way to start is by reference to the Training and Communications section of the 2020 Update, which stated, “Prosecutors should assess the steps taken by the company to ensure that policies and procedures have been integrated into the organization, including through periodic training and certification for all directors, officers, relevant employees, and, where appropriate, agents and business partners. Prosecutors should also assess whether the company has relayed information in a manner tailored to the audience’s size, sophistication, or subject matter expertise. Some companies, for instance, give employees practical advice or case studies to address real-life scenarios, and/or guidance on how to obtain ethics advice on a case-by-case basis as needs arise.” Some of these principals include the following, What are the Guiding Principles of your compliance training? What are you trying to communicate? Is it a broad set of values you want to communicate to every employee about what your organization stands for? As noted in the 2020 Update, a company should “should examine whether the compliance program is being disseminated to, and understood by, employees in practice in order to decide whether the compliance program is “truly effective.”  Three key takeaways:  The 2020 Update has a strong emphasis on compliance training. Create a set of Principles for your compliance training programs. You should always use the Principle of your compliance training program in making decisions going forward. Learn more about your ad choices. Visit megaphone.fm/adchoices How can you begin to think through a best practices compliance training program? I put that question to Shawn Rogers, Senior Director, Global Training & Awareness, Walmart. Rogers advised that you ‘envision’ what your training would like as a first step. He stated, “A common mistake is jumping right to the question is which courses you want and how to deploy them. However, there are several things you need to think about before you start building the program.”

 You should develop some principles on what your compliance training will look like. A key way to start is by reference to the Training and Communications section of the 2020 Update, which stated, “Prosecutors should assess the steps taken by the company to ensure that policies and procedures have been integrated into the organization, including through periodic training and certification for all directors, officers, relevant employees, and, where appropriate, agents and business partners. Prosecutors should also assess whether the company has relayed information in a manner tailored to the audience’s size, sophistication, or subject matter expertise. Some companies, for instance, give employees practical advice or case studies to address real-life scenarios, and/or guidance on how to obtain ethics advice on a case-by-case basis as needs arise.” Some of these principals include the following,

What are the Guiding Principles of your compliance training? What are you trying to communicate? Is it a broad set of values you want to communicate to every employee about what your organization stands for? As noted in the 2020 Update, a company should “should examine whether the compliance program is being disseminated to, and understood by, employees in practice in order to decide whether the compliance program is “truly effective.” 

Three key takeaways: 

  1. The 2020 Update has a strong emphasis on compliance training.
  2. Create a set of Principles for your compliance training programs.
  3. You should always use the Principle of your compliance training program in making decisions going forward.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 534 no Twitter and 360-degrees of communication One of the ways that CCOs and compliance practitioners can better use 360-degrees of communication is through Twitter. In a  MIT Sloan Management Review article, entitled “How Twitter Users Can Generate Better Ideas”, authors Salvatore Parise, Eoin Whelan and Steve Todd found “employees with a diverse Twitter network – one that exposes them to people and ideas they don’t already know – tend to generate better ideas.” Their research led them to three interesting findings: 1) Employees who used Twitter had better ideas than those who did not do so; 2) There was a link between the amount of diversity in employees’ twitter networks and the quality of their ideas; and 3) Twitter users who combined idea scouting and idea connecting were the most innovative. Their research certainly confirms the experience of Louis Sapirman, during his time as CCO at Dun & Bradstreet.  The key concept for the compliance profession is the roles of Idea Scout and Idea Connector. An “idea scout is an employee who looks outside the organization to bring in new ideas. An idea connector, is someone who can assimilate the external ideas and find opportunities within the organization to implement these new concepts.” It is the ability to identify, assimilate and exploit new compliance ideas, which makes this concept so powerful. However, to improve your compliance innovation, “you need to maintain a diverse network while also developing your assimilation and exploitation skills.” Twitter can be powerful tool for the compliance practitioner. It is one of the only tools that can work both inbound for you to obtain information and insight and in an outbound manner as well; where you are able to communicate with your compliance customer base, your employees. You should work to incorporate one or more of the techniques to help you burn compliance into the DNA fabric of your organization. Three key takeaways: Twitter can be powerful tool for the compliance practitioner. Data mine twitter for not only best practices but see what the regulators may be saying. Curiosity may have killed the cat, but it makes for a far better and more effective compliance practitioner. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 18 Dec 2020 18:00:00 -0000 Twitter and 360-degrees of communication full Thomas Fox Twitter can be powerful tool for the compliance practitioner. One of the ways that CCOs and compliance practitioners can better use 360-degrees of communication is through Twitter. In a  MIT Sloan Management Review article, entitled “How Twitter Users Can Generate Better Ideas”, authors Salvatore Parise, Eoin Whelan and Steve Todd found “employees with a diverse Twitter network – one that exposes them to people and ideas they don’t already know – tend to generate better ideas.” Their research led them to three interesting findings: 1) Employees who used Twitter had better ideas than those who did not do so; 2) There was a link between the amount of diversity in employees’ twitter networks and the quality of their ideas; and 3) Twitter users who combined idea scouting and idea connecting were the most innovative. Their research certainly confirms the experience of Louis Sapirman, during his time as CCO at Dun & Bradstreet.  The key concept for the compliance profession is the roles of Idea Scout and Idea Connector. An “idea scout is an employee who looks outside the organization to bring in new ideas. An idea connector, is someone who can assimilate the external ideas and find opportunities within the organization to implement these new concepts.” It is the ability to identify, assimilate and exploit new compliance ideas, which makes this concept so powerful. However, to improve your compliance innovation, “you need to maintain a diverse network while also developing your assimilation and exploitation skills.” Twitter can be powerful tool for the compliance practitioner. It is one of the only tools that can work both inbound for you to obtain information and insight and in an outbound manner as well; where you are able to communicate with your compliance customer base, your employees. You should work to incorporate one or more of the techniques to help you burn compliance into the DNA fabric of your organization. Three key takeaways: Twitter can be powerful tool for the compliance practitioner. Data mine twitter for not only best practices but see what the regulators may be saying. Curiosity may have killed the cat, but it makes for a far better and more effective compliance practitioner. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the ways that CCOs and compliance practitioners can better use 360-degrees of communication is through Twitter. In a  MIT Sloan Management Review article, entitled “How Twitter Users Can Generate Better Ideas”, authors Salvatore Parise, Eoin Whelan and Steve Todd found “employees with a diverse Twitter network – one that exposes them to people and ideas they don’t already know – tend to generate better ideas.” Their research led them to three interesting findings: 1) Employees who used Twitter had better ideas than those who did not do so; 2) There was a link between the amount of diversity in employees’ twitter networks and the quality of their ideas; and 3) Twitter users who combined idea scouting and idea connecting were the most innovative. Their research certainly confirms the experience of Louis Sapirman, during his time as CCO at Dun & Bradstreet. 

The key concept for the compliance profession is the roles of Idea Scout and Idea Connector. An “idea scout is an employee who looks outside the organization to bring in new ideas. An idea connector, is someone who can assimilate the external ideas and find opportunities within the organization to implement these new concepts.” It is the ability to identify, assimilate and exploit new compliance ideas, which makes this concept so powerful. However, to improve your compliance innovation, “you need to maintain a diverse network while also developing your assimilation and exploitation skills.”

Twitter can be powerful tool for the compliance practitioner. It is one of the only tools that can work both inbound for you to obtain information and insight and in an outbound manner as well; where you are able to communicate with your compliance customer base, your employees. You should work to incorporate one or more of the techniques to help you burn compliance into the DNA fabric of your organization.

Three key takeaways:

  1. Twitter can be powerful tool for the compliance practitioner.
  2. Data mine twitter for not only best practices but see what the regulators may be saying.
  3. Curiosity may have killed the cat, but it makes for a far better and more effective compliance practitioner.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 537 no Asking questions to boost your compliance program Other than the skill of listening, asking questions is about as important to the compliance practitioner as any other that can be employed. Yet, equally critical is to ask the right question, which is an issue explored Brian Grazer and Charles Fishman in their book, entitled “A Curious Mind: The Secret to a Bigger Life”.  Grazer is a well-known and successful Hollywood director who has directed such movies as Splash, A Beautiful Mind and Cinderella Man. He believes that much of the success he has achieved is because he asks lots of questions and “Questions are a great management tool.” This is because “Asking questions elicits information” and it also “creates the space for people to raise issues they are worried about that a boss, or colleagues, may not know about.” By asking questions, you allow “people to tell a different story than the one you’re expecting.” Finally, and perhaps most significantly, “asking questions means people have to make their case for the way they want a decision to go.” You too can use this simple and straight-forward technique to improve not only your leadership qualities in the compliance function. The reason that asking questions is so much better than simply giving orders is that you have a vast talented workforce you can tap into it help you do business in compliance. But the how of doing a business process that is, or should be, burned into your company can be facilitated by possibilities that are out there in your employees’ minds. 360-degrees of communications allows you to create an atmosphere where nobody is afraid to ask a question. Perhaps equally importantly no one is afraid to answer a question. Three key takeaways: Asking questions is a great technique to elicit information. Asking questions creates the authority in people to come up with ideas, coupled with the responsibility for moving things forward. Create an atmosphere where no employee is afraid to ask or answer a question. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 17 Dec 2020 18:00:00 -0000 Asking questions to boost your compliance program full Thomas Fox Asking questions does more than elicit information; it also creates the space for people to raise issues. Other than the skill of listening, asking questions is about as important to the compliance practitioner as any other that can be employed. Yet, equally critical is to ask the right question, which is an issue explored Brian Grazer and Charles Fishman in their book, entitled “A Curious Mind: The Secret to a Bigger Life”.  Grazer is a well-known and successful Hollywood director who has directed such movies as Splash, A Beautiful Mind and Cinderella Man. He believes that much of the success he has achieved is because he asks lots of questions and “Questions are a great management tool.” This is because “Asking questions elicits information” and it also “creates the space for people to raise issues they are worried about that a boss, or colleagues, may not know about.” By asking questions, you allow “people to tell a different story than the one you’re expecting.” Finally, and perhaps most significantly, “asking questions means people have to make their case for the way they want a decision to go.” You too can use this simple and straight-forward technique to improve not only your leadership qualities in the compliance function. The reason that asking questions is so much better than simply giving orders is that you have a vast talented workforce you can tap into it help you do business in compliance. But the how of doing a business process that is, or should be, burned into your company can be facilitated by possibilities that are out there in your employees’ minds. 360-degrees of communications allows you to create an atmosphere where nobody is afraid to ask a question. Perhaps equally importantly no one is afraid to answer a question. Three key takeaways: Asking questions is a great technique to elicit information. Asking questions creates the authority in people to come up with ideas, coupled with the responsibility for moving things forward. Create an atmosphere where no employee is afraid to ask or answer a question. Learn more about your ad choices. Visit megaphone.fm/adchoices Other than the skill of listening, asking questions is about as important to the compliance practitioner as any other that can be employed. Yet, equally critical is to ask the right question, which is an issue explored Brian Grazer and Charles Fishman in their book, entitled “A Curious Mind: The Secret to a Bigger Life”. 

Grazer is a well-known and successful Hollywood director who has directed such movies as Splash, A Beautiful Mind and Cinderella Man. He believes that much of the success he has achieved is because he asks lots of questions and “Questions are a great management tool.” This is because “Asking questions elicits information” and it also “creates the space for people to raise issues they are worried about that a boss, or colleagues, may not know about.” By asking questions, you allow “people to tell a different story than the one you’re expecting.” Finally, and perhaps most significantly, “asking questions means people have to make their case for the way they want a decision to go.”

You too can use this simple and straight-forward technique to improve not only your leadership qualities in the compliance function. The reason that asking questions is so much better than simply giving orders is that you have a vast talented workforce you can tap into it help you do business in compliance. But the how of doing a business process that is, or should be, burned into your company can be facilitated by possibilities that are out there in your employees’ minds. 360-degrees of communications allows you to create an atmosphere where nobody is afraid to ask a question. Perhaps equally importantly no one is afraid to answer a question.

Three key takeaways:

  1. Asking questions is a great technique to elicit information.
  2. Asking questions creates the authority in people to come up with ideas, coupled with the responsibility for moving things forward.
  3. Create an atmosphere where no employee is afraid to ask or answer a question.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 533 no Communicating across cultural boundaries A 360-degree approach to communications entails looking at all forms of interactions as a way to interconnect. This means both verbal and non-verbal and in clues and hints. This concept can be particularly helpful in relating to and with cultures outside the U.S. as one of the most critical issues to a compliance function is breaking through a company’s internal cultural boundaries. In a  Harvard Business Review article, entitled “Getting to Si, Ja, Oui, Hai and Da”, Erin Meyer explained that “managers often discover that perfectly rational deals fall apart when their [business] counterparts make what seem to be unreasonable demands or don’t respect their commitments.” She laid out a five-point solution that I have adapted for the CCO or compliance practitioner in communicating a compliance program across a multi-national organization. In its 2020 Update, the DOJ specified that when it comes to compliance training, a company must offer compliance training in the form and language appropriate for the audience. Initially look for as many cultural bridges as you can find as it will help you understand what your international audience is communicating to you, in both verbal and non-verbal formats, during a wide variety of activities familiar to any compliance professional such as training, investigations or simple meetings where the compliance perspective must be articulated in any business setting. If you fail to have an understanding or even a person who can navigate these signs for you, here are five steps to help you out: 1) Adapt the way you express disagreement; 2) Know when to bottle it up and let it all pour out; 3) Learn how the other culture builds trust; 4) Avoid yes or no questions; and 5) Be careful about putting it in writing. Three key takeaways: Communications in compliance must be largely drawn around trust. Look for as many cultural bridges as you can find as it will help you understand what your international audience is communicating to you. One of the things most critical issues to a compliance function is breaking through a company’s internal cultural boundaries. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 16 Dec 2020 18:00:00 -0000 Communicating across cultural boundaries full Thomas Fox How can a 360-degree approach help in relating to and with cultures outside the US? Find out in today's 31 Days to a More Effective Compliance Program. A 360-degree approach to communications entails looking at all forms of interactions as a way to interconnect. This means both verbal and non-verbal and in clues and hints. This concept can be particularly helpful in relating to and with cultures outside the U.S. as one of the most critical issues to a compliance function is breaking through a company’s internal cultural boundaries. In a  Harvard Business Review article, entitled “Getting to Si, Ja, Oui, Hai and Da”, Erin Meyer explained that “managers often discover that perfectly rational deals fall apart when their [business] counterparts make what seem to be unreasonable demands or don’t respect their commitments.” She laid out a five-point solution that I have adapted for the CCO or compliance practitioner in communicating a compliance program across a multi-national organization. In its 2020 Update, the DOJ specified that when it comes to compliance training, a company must offer compliance training in the form and language appropriate for the audience. Initially look for as many cultural bridges as you can find as it will help you understand what your international audience is communicating to you, in both verbal and non-verbal formats, during a wide variety of activities familiar to any compliance professional such as training, investigations or simple meetings where the compliance perspective must be articulated in any business setting. If you fail to have an understanding or even a person who can navigate these signs for you, here are five steps to help you out: 1) Adapt the way you express disagreement; 2) Know when to bottle it up and let it all pour out; 3) Learn how the other culture builds trust; 4) Avoid yes or no questions; and 5) Be careful about putting it in writing. Three key takeaways: Communications in compliance must be largely drawn around trust. Look for as many cultural bridges as you can find as it will help you understand what your international audience is communicating to you. One of the things most critical issues to a compliance function is breaking through a company’s internal cultural boundaries. Learn more about your ad choices. Visit megaphone.fm/adchoices A 360-degree approach to communications entails looking at all forms of interactions as a way to interconnect. This means both verbal and non-verbal and in clues and hints. This concept can be particularly helpful in relating to and with cultures outside the U.S. as one of the most critical issues to a compliance function is breaking through a company’s internal cultural boundaries. In a  Harvard Business Review article, entitled “Getting to Si, Ja, Oui, Hai and Da”, Erin Meyer explained that “managers often discover that perfectly rational deals fall apart when their [business] counterparts make what seem to be unreasonable demands or don’t respect their commitments.” She laid out a five-point solution that I have adapted for the CCO or compliance practitioner in communicating a compliance program across a multi-national organization. In its 2020 Update, the DOJ specified that when it comes to compliance training, a company must offer compliance training in the form and language appropriate for the audience.

Initially look for as many cultural bridges as you can find as it will help you understand what your international audience is communicating to you, in both verbal and non-verbal formats, during a wide variety of activities familiar to any compliance professional such as training, investigations or simple meetings where the compliance perspective must be articulated in any business setting. If you fail to have an understanding or even a person who can navigate these signs for you, here are five steps to help you out: 1) Adapt the way you express disagreement; 2) Know when to bottle it up and let it all pour out; 3) Learn how the other culture builds trust; 4) Avoid yes or no questions; and 5) Be careful about putting it in writing.

Three key takeaways:

  1. Communications in compliance must be largely drawn around trust.
  2. Look for as many cultural bridges as you can find as it will help you understand what your international audience is communicating to you.
  3. One of the things most critical issues to a compliance function is breaking through a company’s internal cultural boundaries.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 533 no Multiplying the influence of compliance What if you could multiply the impact and effectiveness of your compliance program throughout your company? That would be a great boon to any compliance practitioner and compliance program. It is also something that is very possible by considering a 360-degree view of communications in compliance using multipliers.  Liz Wiseman is the co-author with Greg McKeown of “Multipliers: How the Best Leaders Make Everyone Smarter”, a book about the various types of leaders. They focus two different types of leaders, Diminishers and Multipliers. Multipliers are leaders who encourage growth and creativity from their workers, while Diminishers are those who hinder and otherwise keep their employees’ productivity at a minimum. Now imagine applying this leadership technique as you are trying to more fully operationalize your compliance program. If you take this approach of leading by asking questions, you not only guide the functional unit but you get greater buy-in to the entire concept and process as it becomes their process. The non-compliance team may design it and have ownership over it. Wiseman concluded by challenging each of us to multiply our influence to make those we work with and work even better. You can use these skills to more fully operationalize your compliance program. If you do so, you will not only fulfill the requirements of the DOJ, as laid out in the Evaluation, but you will integrate compliance into the DNA of your company by making it a part of the way you conduct your business. Three key takeaways: Multipliers are leaders who encourage growth and creativity from their workers. Diminishers are those who hinder and otherwise keep their employees’ productivity at a minimum. Multiply the influence of the compliance function both inside and outside the company in this manner. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 15 Dec 2020 18:00:00 -0000 Multiplying the influence of compliance full Thomas Fox What if you could multiply the impact and effectiveness of your compliance program throughout your company? Find out how in today's 31 Days to a More Effective Compliance Program What if you could multiply the impact and effectiveness of your compliance program throughout your company? That would be a great boon to any compliance practitioner and compliance program. It is also something that is very possible by considering a 360-degree view of communications in compliance using multipliers.  Liz Wiseman is the co-author with Greg McKeown of “Multipliers: How the Best Leaders Make Everyone Smarter”, a book about the various types of leaders. They focus two different types of leaders, Diminishers and Multipliers. Multipliers are leaders who encourage growth and creativity from their workers, while Diminishers are those who hinder and otherwise keep their employees’ productivity at a minimum. Now imagine applying this leadership technique as you are trying to more fully operationalize your compliance program. If you take this approach of leading by asking questions, you not only guide the functional unit but you get greater buy-in to the entire concept and process as it becomes their process. The non-compliance team may design it and have ownership over it. Wiseman concluded by challenging each of us to multiply our influence to make those we work with and work even better. You can use these skills to more fully operationalize your compliance program. If you do so, you will not only fulfill the requirements of the DOJ, as laid out in the Evaluation, but you will integrate compliance into the DNA of your company by making it a part of the way you conduct your business. Three key takeaways: Multipliers are leaders who encourage growth and creativity from their workers. Diminishers are those who hinder and otherwise keep their employees’ productivity at a minimum. Multiply the influence of the compliance function both inside and outside the company in this manner. Learn more about your ad choices. Visit megaphone.fm/adchoices What if you could multiply the impact and effectiveness of your compliance program throughout your company? That would be a great boon to any compliance practitioner and compliance program. It is also something that is very possible by considering a 360-degree view of communications in compliance using multipliers. 

Liz Wiseman is the co-author with Greg McKeown of “Multipliers: How the Best Leaders Make Everyone Smarter”, a book about the various types of leaders. They focus two different types of leaders, Diminishers and Multipliers. Multipliers are leaders who encourage growth and creativity from their workers, while Diminishers are those who hinder and otherwise keep their employees’ productivity at a minimum.

Now imagine applying this leadership technique as you are trying to more fully operationalize your compliance program. If you take this approach of leading by asking questions, you not only guide the functional unit but you get greater buy-in to the entire concept and process as it becomes their process. The non-compliance team may design it and have ownership over it.

Wiseman concluded by challenging each of us to multiply our influence to make those we work with and work even better. You can use these skills to more fully operationalize your compliance program. If you do so, you will not only fulfill the requirements of the DOJ, as laid out in the Evaluation, but you will integrate compliance into the DNA of your company by making it a part of the way you conduct your business.

Three key takeaways:

  1. Multipliers are leaders who encourage growth and creativity from their workers.
  2. Diminishers are those who hinder and otherwise keep their employees’ productivity at a minimum.
  3. Multiply the influence of the compliance function both inside and outside the company in this manner.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 618 no Communication through persuasion Such small gestures can make a difference. I recently read a biography of Dale Carnegie by Steven Watts, entitled “Self-Help Messiah: Dale Carnegie and Success in Modern America”, penned by Ian Frazier. Carnegie is of course well known for his seminal work “How to Win Friends and Influence People” first published in 1936. I was somewhat surprised to learn that the text was largely drawn up as transcripts to lectures Carnegie was giving in New York City in the mid-1903s. Carnegie’s main thesis was to provide concrete steps on how ordinary people could help master the art of persuasion. While it has been some time since I read this book, what I recall is that to influence people, one has to listen to them. For me, the book was about how to become a better listener.  I cannot say enough about this skill for a CCO. If you hear any long-term CCO speak about their job, they will tell you it is largely about listening to people; whether those people are employees, senior management or the Chief Executive Officer (CEO) and Board members. By listening to others you not only hear, and hopefully will come to understand their concerns, but you allow them to come to decisions themselves and you are not in the position of telling them what to do. It is a skill that has served many CCOs very well for many years. Three key takeaways: A little can mean a lot. One of the primary keys to influencing people is to listen to them. A CCO can enhance their communications by using the six principals of persuasion. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 14 Dec 2020 18:00:00 -0000 Communication through persuasion full Thomas Fox How can you communicate through persuasion? Find out in today's 31 Days to a More Effective Compliance Program Such small gestures can make a difference. I recently read a biography of Dale Carnegie by Steven Watts, entitled “Self-Help Messiah: Dale Carnegie and Success in Modern America”, penned by Ian Frazier. Carnegie is of course well known for his seminal work “How to Win Friends and Influence People” first published in 1936. I was somewhat surprised to learn that the text was largely drawn up as transcripts to lectures Carnegie was giving in New York City in the mid-1903s. Carnegie’s main thesis was to provide concrete steps on how ordinary people could help master the art of persuasion. While it has been some time since I read this book, what I recall is that to influence people, one has to listen to them. For me, the book was about how to become a better listener.  I cannot say enough about this skill for a CCO. If you hear any long-term CCO speak about their job, they will tell you it is largely about listening to people; whether those people are employees, senior management or the Chief Executive Officer (CEO) and Board members. By listening to others you not only hear, and hopefully will come to understand their concerns, but you allow them to come to decisions themselves and you are not in the position of telling them what to do. It is a skill that has served many CCOs very well for many years. Three key takeaways: A little can mean a lot. One of the primary keys to influencing people is to listen to them. A CCO can enhance their communications by using the six principals of persuasion. Learn more about your ad choices. Visit megaphone.fm/adchoices Such small gestures can make a difference. I recently read a biography of Dale Carnegie by Steven Watts, entitled “Self-Help Messiah: Dale Carnegie and Success in Modern America”, penned by Ian Frazier. Carnegie is of course well known for his seminal work “How to Win Friends and Influence People” first published in 1936. I was somewhat surprised to learn that the text was largely drawn up as transcripts to lectures Carnegie was giving in New York City in the mid-1903s. Carnegie’s main thesis was to provide concrete steps on how ordinary people could help master the art of persuasion. While it has been some time since I read this book, what I recall is that to influence people, one has to listen to them. For me, the book was about how to become a better listener. 

I cannot say enough about this skill for a CCO. If you hear any long-term CCO speak about their job, they will tell you it is largely about listening to people; whether those people are employees, senior management or the Chief Executive Officer (CEO) and Board members. By listening to others you not only hear, and hopefully will come to understand their concerns, but you allow them to come to decisions themselves and you are not in the position of telling them what to do. It is a skill that has served many CCOs very well for many years.

Three key takeaways:

  1. A little can mean a lot.
  2. One of the primary keys to influencing people is to listen to them.
  3. A CCO can enhance their communications by using the six principals of persuasion.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 540 no Using communications to foster your compliance brand Our next lesson on compliance communications comes from best-selling authors James Patterson and David Baldacci and it about your brand. I had always thought of your brand as the image customers have of your business. It should be strategic and intentional. For a corporate compliance function, it might mean something along the lines of doing business ethically and in compliance. It could mean creating an effective compliance program that enhances business efficiency that drives greater profitability. It could mean driving an ethical culture to the very heart of your business.  However, Patterson and Baldacci discussed brand in a manner which was very different than the way I think about brand and branding. They said your brand is not an image but is about your relationship with your stakeholders. For an author, that means your readers. For these writers, it means that you deliver what your readers expect and if you are going to go in a different direction, it is important to let your readers know that you are doing something different so that if you pick up a Baldacci or a Patterson, the book will be something other than the thriller or murder mystery you are expecting. While there are other groups you may well have a relationship with as a compliance professional, looking at this from the perspective of Baldacci and Patterson you begin to see the corporate compliance brand and your own personal brand in a very different light. It is one which I think can help you to be both more effective as a compliance professional and lead to more professional opportunities for you as well. Three key takeaways: How do you define your compliance brand? What is your relationship with your stakeholders? As a CCO or compliance professional you can draw lessons from a wide variety of disciplines. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 11 Dec 2020 06:01:00 -0000 Using communications to foster your compliance brand full Thomas Fox Always remember, your brand is not an image but is about your relationship with your stakeholders. Our next lesson on compliance communications comes from best-selling authors James Patterson and David Baldacci and it about your brand. I had always thought of your brand as the image customers have of your business. It should be strategic and intentional. For a corporate compliance function, it might mean something along the lines of doing business ethically and in compliance. It could mean creating an effective compliance program that enhances business efficiency that drives greater profitability. It could mean driving an ethical culture to the very heart of your business.  However, Patterson and Baldacci discussed brand in a manner which was very different than the way I think about brand and branding. They said your brand is not an image but is about your relationship with your stakeholders. For an author, that means your readers. For these writers, it means that you deliver what your readers expect and if you are going to go in a different direction, it is important to let your readers know that you are doing something different so that if you pick up a Baldacci or a Patterson, the book will be something other than the thriller or murder mystery you are expecting. While there are other groups you may well have a relationship with as a compliance professional, looking at this from the perspective of Baldacci and Patterson you begin to see the corporate compliance brand and your own personal brand in a very different light. It is one which I think can help you to be both more effective as a compliance professional and lead to more professional opportunities for you as well. Three key takeaways: How do you define your compliance brand? What is your relationship with your stakeholders? As a CCO or compliance professional you can draw lessons from a wide variety of disciplines. Learn more about your ad choices. Visit megaphone.fm/adchoices Our next lesson on compliance communications comes from best-selling authors James Patterson and David Baldacci and it about your brand. I had always thought of your brand as the image customers have of your business. It should be strategic and intentional. For a corporate compliance function, it might mean something along the lines of doing business ethically and in compliance. It could mean creating an effective compliance program that enhances business efficiency that drives greater profitability. It could mean driving an ethical culture to the very heart of your business. 

However, Patterson and Baldacci discussed brand in a manner which was very different than the way I think about brand and branding. They said your brand is not an image but is about your relationship with your stakeholders. For an author, that means your readers. For these writers, it means that you deliver what your readers expect and if you are going to go in a different direction, it is important to let your readers know that you are doing something different so that if you pick up a Baldacci or a Patterson, the book will be something other than the thriller or murder mystery you are expecting.

While there are other groups you may well have a relationship with as a compliance professional, looking at this from the perspective of Baldacci and Patterson you begin to see the corporate compliance brand and your own personal brand in a very different light. It is one which I think can help you to be both more effective as a compliance professional and lead to more professional opportunities for you as well.

Three key takeaways:

  1. How do you define your compliance brand?
  2. What is your relationship with your stakeholders?
  3. As a CCO or compliance professional you can draw lessons from a wide variety of disciplines.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 540 no Using Communications to Drive a Speak Up Culture How often have you thought about the role of communications in your entire hotline reporting system? I do not mean posters giving the hotline number, promising anonymity and non-retaliation. I mean using compliance communications to create a social environment where employees feel comfortable speaking up to ask questions and report concerns and they know the options for doing that.  Why do many compliance professionals find it so difficult to use compliance communications to help move the ball forward on driving a speak up culture? It begins because many conflate such communications with training. Training tends to be viewed as something that happens once per year or on a similar cadence. Yet even the DOJ has seen through the fallacy of this argument in its 2020 Update to the Evaluation of Corporate Compliance Programs when it stated, “companies have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit, or other risk management functions.” The 2020 Update also leads to the following questions, what resources have been available to employees to provide guidance relating to raising an issue? And, has your company assessed whether its employees know when to seek advice and whether they would be willing to speak up? Can you answer these to satisfaction of the DOJ? If not, you may have a gap in your speak up communications program. The bottom line to all is that in compliance, you are only limited by your imagination. When you overlay creativity on your imagination, you can create something very special. And you can use compliance communications to drive a speak up culture.  Three key takeaways: How can communications improve a speak up culture? Use communications to foster trust. A speak up culture only works when paired with a ‘listen-up’ culture. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 10 Dec 2020 18:01:00 -0000 Using Communications to Drive a Speak Up Culture full Thomas Fox How often have you thought about the role of communications in your entire hotline reporting system? How often have you thought about the role of communications in your entire hotline reporting system? I do not mean posters giving the hotline number, promising anonymity and non-retaliation. I mean using compliance communications to create a social environment where employees feel comfortable speaking up to ask questions and report concerns and they know the options for doing that.  Why do many compliance professionals find it so difficult to use compliance communications to help move the ball forward on driving a speak up culture? It begins because many conflate such communications with training. Training tends to be viewed as something that happens once per year or on a similar cadence. Yet even the DOJ has seen through the fallacy of this argument in its 2020 Update to the Evaluation of Corporate Compliance Programs when it stated, “companies have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit, or other risk management functions.” The 2020 Update also leads to the following questions, what resources have been available to employees to provide guidance relating to raising an issue? And, has your company assessed whether its employees know when to seek advice and whether they would be willing to speak up? Can you answer these to satisfaction of the DOJ? If not, you may have a gap in your speak up communications program. The bottom line to all is that in compliance, you are only limited by your imagination. When you overlay creativity on your imagination, you can create something very special. And you can use compliance communications to drive a speak up culture.  Three key takeaways: How can communications improve a speak up culture? Use communications to foster trust. A speak up culture only works when paired with a ‘listen-up’ culture. Learn more about your ad choices. Visit megaphone.fm/adchoices How often have you thought about the role of communications in your entire hotline reporting system? I do not mean posters giving the hotline number, promising anonymity and non-retaliation. I mean using compliance communications to create a social environment where employees feel comfortable speaking up to ask questions and report concerns and they know the options for doing that.

 Why do many compliance professionals find it so difficult to use compliance communications to help move the ball forward on driving a speak up culture? It begins because many conflate such communications with training. Training tends to be viewed as something that happens once per year or on a similar cadence. Yet even the DOJ has seen through the fallacy of this argument in its 2020 Update to the Evaluation of Corporate Compliance Programs when it stated, “companies have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit, or other risk management functions.” The 2020 Update also leads to the following questions, what resources have been available to employees to provide guidance relating to raising an issue? And, has your company assessed whether its employees know when to seek advice and whether they would be willing to speak up? Can you answer these to satisfaction of the DOJ? If not, you may have a gap in your speak up communications program.

The bottom line to all is that in compliance, you are only limited by your imagination. When you overlay creativity on your imagination, you can create something very special. And you can use compliance communications to drive a speak up culture.

 Three key takeaways:

  1. How can communications improve a speak up culture?
  2. Use communications to foster trust.
  3. A speak up culture only works when paired with a ‘listen-up’ culture.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 540 no Using 360 Degree of Compliance to Tell a Story The 360-degree approach to compliance works with all the stakeholders in a compliance program, even the “Document, Document, and Document” stakeholders; i.e., the regulators. By using innovative techniques, one law firm came up with mechanism to present verifiable evidence to regulators, using the basic techniques of social media in operationalizing compliance as a solution to a difficult compliance issue around, of all things, honey. This example shows how creative thinking by a lawyer, in the field of import compliance, led to the development of a software application, using some of the concepts of social media. Once again demonstrating the maxim that compliance practitioners (and lawyers) are only limited by their imagination, the use of this software tool demonstrates the power of what a 360-degree view can bring to your compliance program. Three Key Takeaways Use the tools of social media to help tell your story of compliance. You are only limited by your imagination. Converging text, pictures and data can be a powerful tool in compliance. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 09 Dec 2020 18:00:00 -0000 Using 360 Degree of Compliance to Tell a Story full Thomas Fox The 360-degree approach to compliance works with all the stakeholders in a compliance program, even the “Document, Document, and Document” stakeholders; i.e., the regulators. The 360-degree approach to compliance works with all the stakeholders in a compliance program, even the “Document, Document, and Document” stakeholders; i.e., the regulators. By using innovative techniques, one law firm came up with mechanism to present verifiable evidence to regulators, using the basic techniques of social media in operationalizing compliance as a solution to a difficult compliance issue around, of all things, honey. This example shows how creative thinking by a lawyer, in the field of import compliance, led to the development of a software application, using some of the concepts of social media. Once again demonstrating the maxim that compliance practitioners (and lawyers) are only limited by their imagination, the use of this software tool demonstrates the power of what a 360-degree view can bring to your compliance program. Three Key Takeaways Use the tools of social media to help tell your story of compliance. You are only limited by your imagination. Converging text, pictures and data can be a powerful tool in compliance. Learn more about your ad choices. Visit megaphone.fm/adchoices The 360-degree approach to compliance works with all the stakeholders in a compliance program, even the “Document, Document, and Document” stakeholders; i.e., the regulators. By using innovative techniques, one law firm came up with mechanism to present verifiable evidence to regulators, using the basic techniques of social media in operationalizing compliance as a solution to a difficult compliance issue around, of all things, honey. This example shows how creative thinking by a lawyer, in the field of import compliance, led to the development of a software application, using some of the concepts of social media. Once again demonstrating the maxim that compliance practitioners (and lawyers) are only limited by their imagination, the use of this software tool demonstrates the power of what a 360-degree view can bring to your compliance program.

Three Key Takeaways

  1. Use the tools of social media to help tell your story of compliance.
  2. You are only limited by your imagination.
  3. Converging text, pictures and data can be a powerful tool in compliance.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 697 no Compliance and the clash of cultures One of the more difficult things to predict in the mergers and acquisition context is how the cultures of the two entities will merge. Further, while many mergers claim to be a ‘merger of equals’ the reality is far different as there is always one corporate winner that continues to exist and one corporate loser that simply ceases to exist. This is true across industries and countries; witness the debacle of DaimlerChrysler, the disaster of the HP acquisition of Autonomy or the slow downhill slide of United Airlines, Inc. after its merger with Continental Airlines.    In the compliance space this clash of cultures is often seen. One company may have a robust compliance program, with a commitment from top management to have a best practices compliance program. The other company may put profits before compliance. Whichever company comes out the winner in the merger, it can certainly mean not only conflict but if the winning entity is not seen as valuing compliance, it may mean investigations and possibly even violations going forward. Learning how your employees in other countries will approach decision-making and leadership will give you, as the CCO, insight into how they will approach compliance. It will require you to get out into the field to talk with folks. If your company grows organically or through M&A or the JV route, it will need to understand how your new employees will not only think through issues but how they will relate to instructions from the home office in America. Three key takeaways: Culture clash through a merger can be extremely negative for a company. What are the cultures of leadership in your organization? Learning how your employees approach decision making can provide insight into how the will approach compliance. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 08 Dec 2020 18:00:00 -0000 Compliance and the clash of cultures full Thomas Fox How can communications help overcome the clash of cultures in compliance? One of the more difficult things to predict in the mergers and acquisition context is how the cultures of the two entities will merge. Further, while many mergers claim to be a ‘merger of equals’ the reality is far different as there is always one corporate winner that continues to exist and one corporate loser that simply ceases to exist. This is true across industries and countries; witness the debacle of DaimlerChrysler, the disaster of the HP acquisition of Autonomy or the slow downhill slide of United Airlines, Inc. after its merger with Continental Airlines.    In the compliance space this clash of cultures is often seen. One company may have a robust compliance program, with a commitment from top management to have a best practices compliance program. The other company may put profits before compliance. Whichever company comes out the winner in the merger, it can certainly mean not only conflict but if the winning entity is not seen as valuing compliance, it may mean investigations and possibly even violations going forward. Learning how your employees in other countries will approach decision-making and leadership will give you, as the CCO, insight into how they will approach compliance. It will require you to get out into the field to talk with folks. If your company grows organically or through M&A or the JV route, it will need to understand how your new employees will not only think through issues but how they will relate to instructions from the home office in America. Three key takeaways: Culture clash through a merger can be extremely negative for a company. What are the cultures of leadership in your organization? Learning how your employees approach decision making can provide insight into how the will approach compliance. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the more difficult things to predict in the mergers and acquisition context is how the cultures of the two entities will merge. Further, while many mergers claim to be a ‘merger of equals’ the reality is far different as there is always one corporate winner that continues to exist and one corporate loser that simply ceases to exist. This is true across industries and countries; witness the debacle of DaimlerChrysler, the disaster of the HP acquisition of Autonomy or the slow downhill slide of United Airlines, Inc. after its merger with Continental Airlines.   

In the compliance space this clash of cultures is often seen. One company may have a robust compliance program, with a commitment from top management to have a best practices compliance program. The other company may put profits before compliance. Whichever company comes out the winner in the merger, it can certainly mean not only conflict but if the winning entity is not seen as valuing compliance, it may mean investigations and possibly even violations going forward.

Learning how your employees in other countries will approach decision-making and leadership will give you, as the CCO, insight into how they will approach compliance. It will require you to get out into the field to talk with folks. If your company grows organically or through M&A or the JV route, it will need to understand how your new employees will not only think through issues but how they will relate to instructions from the home office in America.

Three key takeaways:

  1. Culture clash through a merger can be extremely negative for a company.
  2. What are the cultures of leadership in your organization?
  3. Learning how your employees approach decision making can provide insight into how the will approach compliance.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 908 no Sharing to 360-degrees of communication Why do people share information? The answer to that question has important implications for every compliance practitioner and compliance program. Sharing is a primary method to communicate and connect. In any far-flung international corporation, this is always a challenge, particularly for disciplines which can be viewed as home office overhead at best; the Land of No at worst. Work to hone your message through social media. Part of this is based on experimenting on what message to send and how to send it. Another aspect was based upon the Wave (of all things); its development and coming to fruition in the early 1980s. It took some time for it to become popular but once it was communicated to enough disparate communications, it took off, literally. “It’s the same thing with social media. On social media, we think something will go viral because the art is beautiful or the science is full of deep analytics, but at the end of the day it really takes time to build the community.”  This means that you will need to work to hone your message but also continue to plug away to send that message out. The Morgan Stanley declination will always be instructional as one of the stated reasons the DOJ did not prosecute the company as they sent out 35 compliance reminders to its workforce, over seven years. Social media can be used in the same cost-effective way, to not only get the message of compliance out but also to receive information and communications back from your customer base, the company employees.  Three key takeaways: What makes your employees want to share information? Facilitate mechanisms which allow sharing with the compliance function. The Morgan Stanley declination still resonates. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 07 Dec 2020 18:00:00 -0000 Sharing to 360-degrees of communication full Thomas Fox Why do people share information? The answer to that question has important implications for every compliance practitioner and compliance program. Why do people share information? The answer to that question has important implications for every compliance practitioner and compliance program. Sharing is a primary method to communicate and connect. In any far-flung international corporation, this is always a challenge, particularly for disciplines which can be viewed as home office overhead at best; the Land of No at worst. Work to hone your message through social media. Part of this is based on experimenting on what message to send and how to send it. Another aspect was based upon the Wave (of all things); its development and coming to fruition in the early 1980s. It took some time for it to become popular but once it was communicated to enough disparate communications, it took off, literally. “It’s the same thing with social media. On social media, we think something will go viral because the art is beautiful or the science is full of deep analytics, but at the end of the day it really takes time to build the community.”  This means that you will need to work to hone your message but also continue to plug away to send that message out. The Morgan Stanley declination will always be instructional as one of the stated reasons the DOJ did not prosecute the company as they sent out 35 compliance reminders to its workforce, over seven years. Social media can be used in the same cost-effective way, to not only get the message of compliance out but also to receive information and communications back from your customer base, the company employees.  Three key takeaways: What makes your employees want to share information? Facilitate mechanisms which allow sharing with the compliance function. The Morgan Stanley declination still resonates. Learn more about your ad choices. Visit megaphone.fm/adchoices Why do people share information? The answer to that question has important implications for every compliance practitioner and compliance program. Sharing is a primary method to communicate and connect. In any far-flung international corporation, this is always a challenge, particularly for disciplines which can be viewed as home office overhead at best; the Land of No at worst. Work to hone your message through social media. Part of this is based on experimenting on what message to send and how to send it. Another aspect was based upon the Wave (of all things); its development and coming to fruition in the early 1980s. It took some time for it to become popular but once it was communicated to enough disparate communications, it took off, literally. “It’s the same thing with social media. On social media, we think something will go viral because the art is beautiful or the science is full of deep analytics, but at the end of the day it really takes time to build the community.” 

This means that you will need to work to hone your message but also continue to plug away to send that message out. The Morgan Stanley declination will always be instructional as one of the stated reasons the DOJ did not prosecute the company as they sent out 35 compliance reminders to its workforce, over seven years. Social media can be used in the same cost-effective way, to not only get the message of compliance out but also to receive information and communications back from your customer base, the company employees. 

Three key takeaways:

  1. What makes your employees want to share information?
  2. Facilitate mechanisms which allow sharing with the compliance function.
  3. The Morgan Stanley declination still resonates.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 651 no Using social media to innovate in compliance I am a huge fan of using social media in your compliance function. But how can you get your arms around how to structure such a program for your company? After acknowledging that social media focuses on the social aspects of the communication, the most important thing to remember is that communication in social media is two-way; both inbound and outbound. It helps to bring your employee base together in an efficient manner to create an environment conducive to compliance for your organization. It also has the benefit of continued engagement. It is more than putting on training or even a set of initiatives; you can continue the conversation and enthusiasm about compliance going forward throughout the year. The authors break this down further into three parts that emphasize 1) the need to listen to and learn from user-generated content; 2) the need to engage and facilitate dialogue with employee innovators; and 3) to find an audience of early adopters to create excitement and collect feedback. If your goal in the compliance function is to create awareness and publicize your compliance program and initiatives, social media can be a powerful tool. This is so paramount it should become a core activity of your compliance function. Using social media tools, your compliance function can not only tell the story of compliance but also communicate expectations and even train. Yet again it is simply more than a one-way tool. Just as employees are more apt to tell you about a concern immediately or soon after they have been trained on that issue; they may well communicate directly with you after having received a social media communication on subjects such as managing of third-party relationships. CCOs and compliance practitioners need to develop a dedicated compliance strategy around social media in the context of your corporate objectives. It allows you a 360-degree view of compliance, through which you can take the input from your employee base and create a compliance experience that your employees will embrace.  Three key takeaways: Never forget that social media is a two-way communication. Company employees are the customers of the compliance department. As with all compliance issues, assess what works for your company and tailor your social media approach appropriately. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 04 Dec 2020 18:00:00 -0000 Using social media to innovate in compliance full Thomas Fox How can you get your arms around how to structure such a program for your company? The most important thing to remember is that communication in social media is two-way; both inbound and outbound. I am a huge fan of using social media in your compliance function. But how can you get your arms around how to structure such a program for your company? After acknowledging that social media focuses on the social aspects of the communication, the most important thing to remember is that communication in social media is two-way; both inbound and outbound. It helps to bring your employee base together in an efficient manner to create an environment conducive to compliance for your organization. It also has the benefit of continued engagement. It is more than putting on training or even a set of initiatives; you can continue the conversation and enthusiasm about compliance going forward throughout the year. The authors break this down further into three parts that emphasize 1) the need to listen to and learn from user-generated content; 2) the need to engage and facilitate dialogue with employee innovators; and 3) to find an audience of early adopters to create excitement and collect feedback. If your goal in the compliance function is to create awareness and publicize your compliance program and initiatives, social media can be a powerful tool. This is so paramount it should become a core activity of your compliance function. Using social media tools, your compliance function can not only tell the story of compliance but also communicate expectations and even train. Yet again it is simply more than a one-way tool. Just as employees are more apt to tell you about a concern immediately or soon after they have been trained on that issue; they may well communicate directly with you after having received a social media communication on subjects such as managing of third-party relationships. CCOs and compliance practitioners need to develop a dedicated compliance strategy around social media in the context of your corporate objectives. It allows you a 360-degree view of compliance, through which you can take the input from your employee base and create a compliance experience that your employees will embrace.  Three key takeaways: Never forget that social media is a two-way communication. Company employees are the customers of the compliance department. As with all compliance issues, assess what works for your company and tailor your social media approach appropriately. Learn more about your ad choices. Visit megaphone.fm/adchoices I am a huge fan of using social media in your compliance function. But how can you get your arms around how to structure such a program for your company? After acknowledging that social media focuses on the social aspects of the communication, the most important thing to remember is that communication in social media is two-way; both inbound and outbound. It helps to bring your employee base together in an efficient manner to create an environment conducive to compliance for your organization. It also has the benefit of continued engagement. It is more than putting on training or even a set of initiatives; you can continue the conversation and enthusiasm about compliance going forward throughout the year. The authors break this down further into three parts that emphasize 1) the need to listen to and learn from user-generated content; 2) the need to engage and facilitate dialogue with employee innovators; and 3) to find an audience of early adopters to create excitement and collect feedback.

If your goal in the compliance function is to create awareness and publicize your compliance program and initiatives, social media can be a powerful tool. This is so paramount it should become a core activity of your compliance function. Using social media tools, your compliance function can not only tell the story of compliance but also communicate expectations and even train. Yet again it is simply more than a one-way tool. Just as employees are more apt to tell you about a concern immediately or soon after they have been trained on that issue; they may well communicate directly with you after having received a social media communication on subjects such as managing of third-party relationships.

CCOs and compliance practitioners need to develop a dedicated compliance strategy around social media in the context of your corporate objectives. It allows you a 360-degree view of compliance, through which you can take the input from your employee base and create a compliance experience that your employees will embrace.

 Three key takeaways:

  1. Never forget that social media is a two-way communication.
  2. Company employees are the customers of the compliance department.
  3. As with all compliance issues, assess what works for your company and tailor your social media approach appropriately.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 662 no The D&B experience in 360 Degrees of Communications How does one company and one CCO actively use social media to make the company’s compliance culture more effective? The company was Dun & Bradstreet, Inc. (D&B) and its then CCO, Louis Sapirman, who discussed D&B’s integration of social media into compliance with me. These tools can go a long way towards enhancing your compliance program going forward. Recall the declination to prosecute that Morgan Stanley received from the DOJ, when one of its managing directors had engaged in FCPA violations. One of the reasons cited by the DOJ was 35 email compliance reminders sent over seven years, which served to bolster the annual FCPA training the recalcitrant managing director received. You can use your archived social media communications as evidence that you have continually communicated your company’s expectations around compliance. It is equally important that these expectations are documented. Finally, never forget the social part of social media. Social media is a two-way communication. Not only are you setting out expectations but also these tools allow you to receive back communications from your employees. The D&B experience around the name change for its Code of Conduct is but one example. You can also see that if you have several concerns expressed it could alert you earlier to begin some detection and move towards prevention in your compliance program. Three key takeaways: How does 360 degrees of communication work in compliance? Focus on the ‘social’ part of social media. Use internal corporate social media to have a conversation. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 03 Dec 2020 18:00:00 -0000 The D&B experience in 360 Degrees of Communications full Thomas Fox How has one company and one CCO actively use social media to make the company’s compliance culture more effective? How does one company and one CCO actively use social media to make the company’s compliance culture more effective? The company was Dun & Bradstreet, Inc. (D&B) and its then CCO, Louis Sapirman, who discussed D&B’s integration of social media into compliance with me. These tools can go a long way towards enhancing your compliance program going forward. Recall the declination to prosecute that Morgan Stanley received from the DOJ, when one of its managing directors had engaged in FCPA violations. One of the reasons cited by the DOJ was 35 email compliance reminders sent over seven years, which served to bolster the annual FCPA training the recalcitrant managing director received. You can use your archived social media communications as evidence that you have continually communicated your company’s expectations around compliance. It is equally important that these expectations are documented. Finally, never forget the social part of social media. Social media is a two-way communication. Not only are you setting out expectations but also these tools allow you to receive back communications from your employees. The D&B experience around the name change for its Code of Conduct is but one example. You can also see that if you have several concerns expressed it could alert you earlier to begin some detection and move towards prevention in your compliance program. Three key takeaways: How does 360 degrees of communication work in compliance? Focus on the ‘social’ part of social media. Use internal corporate social media to have a conversation. Learn more about your ad choices. Visit megaphone.fm/adchoices How does one company and one CCO actively use social media to make the company’s compliance culture more effective? The company was Dun & Bradstreet, Inc. (D&B) and its then CCO, Louis Sapirman, who discussed D&B’s integration of social media into compliance with me.

These tools can go a long way towards enhancing your compliance program going forward. Recall the declination to prosecute that Morgan Stanley received from the DOJ, when one of its managing directors had engaged in FCPA violations. One of the reasons cited by the DOJ was 35 email compliance reminders sent over seven years, which served to bolster the annual FCPA training the recalcitrant managing director received. You can use your archived social media communications as evidence that you have continually communicated your company’s expectations around compliance. It is equally important that these expectations are documented.

Finally, never forget the social part of social media. Social media is a two-way communication. Not only are you setting out expectations but also these tools allow you to receive back communications from your employees. The D&B experience around the name change for its Code of Conduct is but one example. You can also see that if you have several concerns expressed it could alert you earlier to begin some detection and move towards prevention in your compliance program.

Three key takeaways:

  1. How does 360 degrees of communication work in compliance?
  2. Focus on the ‘social’ part of social media.
  3. Use internal corporate social media to have a conversation.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 700 no Social media is a 360-degree conversation What is the message of compliance inside of a corporation and how it is distributed? In a compliance program, the largest portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communication are free or available at very low cost. So why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward? There is much to be learned by the CCO and compliance practitioner from the disciplines of marketing and social media. These concepts are useful to companies in getting their sales pitches out and can be of great help to you in collaborating and marketing throughout your company. These are only some of the tools that you can incorporate into your compliance program going forward and are a different way to think about who your customers are and how you are reaching them with your message of doing compliance. Three key takeaways: Let your employees know what you stand for. Celebrate not only successes but even employees’ efforts. Give employees a tool kit for compliance using social media. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 02 Dec 2020 18:00:00 -0000 Social media is a 360-degree conversation full Thomas Fox Social media presents some excellent mechanisms to communicate the message of compliance going forward. What is the message of compliance inside of a corporation and how it is distributed? In a compliance program, the largest portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communication are free or available at very low cost. So why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward? There is much to be learned by the CCO and compliance practitioner from the disciplines of marketing and social media. These concepts are useful to companies in getting their sales pitches out and can be of great help to you in collaborating and marketing throughout your company. These are only some of the tools that you can incorporate into your compliance program going forward and are a different way to think about who your customers are and how you are reaching them with your message of doing compliance. Three key takeaways: Let your employees know what you stand for. Celebrate not only successes but even employees’ efforts. Give employees a tool kit for compliance using social media. Learn more about your ad choices. Visit megaphone.fm/adchoices What is the message of compliance inside of a corporation and how it is distributed? In a compliance program, the largest portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communication are free or available at very low cost. So why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward?

There is much to be learned by the CCO and compliance practitioner from the disciplines of marketing and social media. These concepts are useful to companies in getting their sales pitches out and can be of great help to you in collaborating and marketing throughout your company. These are only some of the tools that you can incorporate into your compliance program going forward and are a different way to think about who your customers are and how you are reaching them with your message of doing compliance.

Three key takeaways:

  1. Let your employees know what you stand for.
  2. Celebrate not only successes but even employees’ efforts.
  3. Give employees a tool kit for compliance using social media.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 670 no Introduction To December- Training and Communications In this month's offering of 31 Days to a More Effective Compliance Program, you will learn about training and communication techniques that the CCO can use to provide not only a well-rounded role as a CCO but also facilitate a much more holistic approach to compliance in your organization. Best of all the techniques, discussed are largely available to you at little to no cost. There are things that you can do both in your method of running the CCO positions and innovations that you can bring to the compliance function in your organization.  A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is in touch with, and visible to, your employees at all times. It is about creating a distinctive brand philosophy of compliance which is centered on the customers of your compliance program (i.e., your employees). It helps to anticipate all the aspects of your employees needs around compliance especially when compliance is either perceived as new, something that comes out of the home office or as the Land of No. It gives you the opportunity to build a new brand image for your compliance program. The objective is to build trust for the 360-degree process by determining if the goal was achieved. You can utilize surveys or focus groups to assess the impact on your target audience. Focusing on your customers of compliance allows you to identify gaps and improve the communication process for your compliance program. Three key takeaways: Remember the definition of 360-degrees of compliance communications. It is an effort that moves the compliance identity into a holistic approach, so compliance is in touch and visible to your employees at all times. What is your objective? What are you trying to do with your 360-degrees view of compliance communications and how are you using that mechanism to deliver the objective your compliance program desires? You need to evaluate if the message has been delivered, has it been heard and is it being implemented? Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 01 Dec 2020 18:00:00 -0000 Introduction To December- Training and Communications full Thomas Fox In this month's offering of 31 Days to a More Effective Compliance Program, you will learn about training and communication techniques that the CCO can use. In this month's offering of 31 Days to a More Effective Compliance Program, you will learn about training and communication techniques that the CCO can use to provide not only a well-rounded role as a CCO but also facilitate a much more holistic approach to compliance in your organization. Best of all the techniques, discussed are largely available to you at little to no cost. There are things that you can do both in your method of running the CCO positions and innovations that you can bring to the compliance function in your organization.  A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is in touch with, and visible to, your employees at all times. It is about creating a distinctive brand philosophy of compliance which is centered on the customers of your compliance program (i.e., your employees). It helps to anticipate all the aspects of your employees needs around compliance especially when compliance is either perceived as new, something that comes out of the home office or as the Land of No. It gives you the opportunity to build a new brand image for your compliance program. The objective is to build trust for the 360-degree process by determining if the goal was achieved. You can utilize surveys or focus groups to assess the impact on your target audience. Focusing on your customers of compliance allows you to identify gaps and improve the communication process for your compliance program. Three key takeaways: Remember the definition of 360-degrees of compliance communications. It is an effort that moves the compliance identity into a holistic approach, so compliance is in touch and visible to your employees at all times. What is your objective? What are you trying to do with your 360-degrees view of compliance communications and how are you using that mechanism to deliver the objective your compliance program desires? You need to evaluate if the message has been delivered, has it been heard and is it being implemented? Learn more about your ad choices. Visit megaphone.fm/adchoices In this month's offering of 31 Days to a More Effective Compliance Program, you will learn about training and communication techniques that the CCO can use to provide not only a well-rounded role as a CCO but also facilitate a much more holistic approach to compliance in your organization. Best of all the techniques, discussed are largely available to you at little to no cost. There are things that you can do both in your method of running the CCO positions and innovations that you can bring to the compliance function in your organization.

 A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is in touch with, and visible to, your employees at all times. It is about creating a distinctive brand philosophy of compliance which is centered on the customers of your compliance program (i.e., your employees). It helps to anticipate all the aspects of your employees needs around compliance especially when compliance is either perceived as new, something that comes out of the home office or as the Land of No. It gives you the opportunity to build a new brand image for your compliance program.

The objective is to build trust for the 360-degree process by determining if the goal was achieved. You can utilize surveys or focus groups to assess the impact on your target audience. Focusing on your customers of compliance allows you to identify gaps and improve the communication process for your compliance program.

Three key takeaways:

  1. Remember the definition of 360-degrees of compliance communications. It is an effort that moves the compliance identity into a holistic approach, so compliance is in touch and visible to your employees at all times.
  2. What is your objective? What are you trying to do with your 360-degrees view of compliance communications and how are you using that mechanism to deliver the objective your compliance program desires?
  3. You need to evaluate if the message has been delivered, has it been heard and is it being implemented?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 838 no Leveraging AI in Compliance Investigations The 2020 Update provided clear-cut criteria regarding effective compliance investigations. Sean Freidlin, host of the Compliance Book Club podcast believes that many compliance teams are failing to promptly substantiate a majority of the reports they investigate, due in part to their inability to quickly and easily find the evidence they need, especially in relation to harassment and misconduct cases. He stated, “This doesn’t just demonstrate a fundamental lack of effectiveness from the DOJ’s perspective, but a long-term organizational risk that goes well beyond any individual allegation of misconduct.” The reason is not simply legal but also operational. If there are substantive allegations that are indeed violations, they could continue, thereby exacerbating the problem(s) but also lengthening the time of legal liability. All of this is particularly significant in light of the industry research that shows many compliance investigations today are unsubstantiated and can take over 40 days from start to finish. The ability of AI to find and analyze data from the web and social media in this automated fashion will be able to overcome some of those challenges both in terms of length of time and overall scope of the investigation. Final always remember data preservation. One thing the regulators always want to know is if you have the documents and data tied down. This allows a company to have confidence their documents and, in turn, can make such representations to regulators and prosecutors that the documents are secure. In other words, Document, Document, and Document.  Three key takeaways: AI is an appropriate tool for supplementing investigations. AI can look at large bodies of social media data. AI can help you decrease you investigation length. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 20 Nov 2020 18:00:00 -0000 Leveraging AI in Compliance Investigations full Thomas Fox Leveraging AI is now critical in compliance investigations. The 2020 Update provided clear-cut criteria regarding effective compliance investigations. Sean Freidlin, host of the Compliance Book Club podcast believes that many compliance teams are failing to promptly substantiate a majority of the reports they investigate, due in part to their inability to quickly and easily find the evidence they need, especially in relation to harassment and misconduct cases. He stated, “This doesn’t just demonstrate a fundamental lack of effectiveness from the DOJ’s perspective, but a long-term organizational risk that goes well beyond any individual allegation of misconduct.” The reason is not simply legal but also operational. If there are substantive allegations that are indeed violations, they could continue, thereby exacerbating the problem(s) but also lengthening the time of legal liability. All of this is particularly significant in light of the industry research that shows many compliance investigations today are unsubstantiated and can take over 40 days from start to finish. The ability of AI to find and analyze data from the web and social media in this automated fashion will be able to overcome some of those challenges both in terms of length of time and overall scope of the investigation. Final always remember data preservation. One thing the regulators always want to know is if you have the documents and data tied down. This allows a company to have confidence their documents and, in turn, can make such representations to regulators and prosecutors that the documents are secure. In other words, Document, Document, and Document.  Three key takeaways: AI is an appropriate tool for supplementing investigations. AI can look at large bodies of social media data. AI can help you decrease you investigation length. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2020 Update provided clear-cut criteria regarding effective compliance investigations. Sean Freidlin, host of the Compliance Book Club podcast believes that many compliance teams are failing to promptly substantiate a majority of the reports they investigate, due in part to their inability to quickly and easily find the evidence they need, especially in relation to harassment and misconduct cases. He stated, “This doesn’t just demonstrate a fundamental lack of effectiveness from the DOJ’s perspective, but a long-term organizational risk that goes well beyond any individual allegation of misconduct.” The reason is not simply legal but also operational. If there are substantive allegations that are indeed violations, they could continue, thereby exacerbating the problem(s) but also lengthening the time of legal liability.

All of this is particularly significant in light of the industry research that shows many compliance investigations today are unsubstantiated and can take over 40 days from start to finish. The ability of AI to find and analyze data from the web and social media in this automated fashion will be able to overcome some of those challenges both in terms of length of time and overall scope of the investigation. Final always remember data preservation. One thing the regulators always want to know is if you have the documents and data tied down. This allows a company to have confidence their documents and, in turn, can make such representations to regulators and prosecutors that the documents are secure. In other words, Document, Document, and Document. 

Three key takeaways:

  1. AI is an appropriate tool for supplementing investigations.
  2. AI can look at large bodies of social media data.
  3. AI can help you decrease you investigation length.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 533 no Creating an Inventory of Metrics The 2020 Update not only continued to emphasize the importance of monitoring and testing the effectiveness of a compliance program, but it spoke more about a Chief Compliance Officer (CCO) and compliance function utilizing data to engage in both continuous monitoring and continuous improvement. The DOJ for some time now has stressed the importance of leveraging data in order to have objective evidence around whether or not a compliance program is working effectively. Yet, as many CCOs are legally trained they are unsure about what some of the specific areas to be considered are in establishing quantifiable metrics to monitor for effectiveness. A methodical review of the 2020 Update to identify the different areas where a company could potentially establish and quantify metrics to assess effectiveness is the place to start. Many companies have what Edwards called “metrics on the basics” and noted they “have in place processes whereby their employees review the Code of Conduct and confirm they are in compliance with it either when they first onboard with the company and then periodically on an annual basis, companies are doing just fine at reporting.” But it is now the barest minimum of what compliance professionals must do. For instance, they could consider the lifecycles of Quote To Cash (QTC) or Procure To Pay (P2P). The key is to start with a documented process which can be audited and build out from there. Three key takeaways: Create an inventory of compliance metrics. Create your metrics based upon the 2020 Update. Use these metrics for continuous monitoring and improvement. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 19 Nov 2020 18:00:00 -0000 Creating an Inventory of Metrics full Thomas Fox Why is the creation of an inventory of metrics, a critical step in building a best practices compliance program? The 2020 Update not only continued to emphasize the importance of monitoring and testing the effectiveness of a compliance program, but it spoke more about a Chief Compliance Officer (CCO) and compliance function utilizing data to engage in both continuous monitoring and continuous improvement. The DOJ for some time now has stressed the importance of leveraging data in order to have objective evidence around whether or not a compliance program is working effectively. Yet, as many CCOs are legally trained they are unsure about what some of the specific areas to be considered are in establishing quantifiable metrics to monitor for effectiveness. A methodical review of the 2020 Update to identify the different areas where a company could potentially establish and quantify metrics to assess effectiveness is the place to start. Many companies have what Edwards called “metrics on the basics” and noted they “have in place processes whereby their employees review the Code of Conduct and confirm they are in compliance with it either when they first onboard with the company and then periodically on an annual basis, companies are doing just fine at reporting.” But it is now the barest minimum of what compliance professionals must do. For instance, they could consider the lifecycles of Quote To Cash (QTC) or Procure To Pay (P2P). The key is to start with a documented process which can be audited and build out from there. Three key takeaways: Create an inventory of compliance metrics. Create your metrics based upon the 2020 Update. Use these metrics for continuous monitoring and improvement. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2020 Update not only continued to emphasize the importance of monitoring and testing the effectiveness of a compliance program, but it spoke more about a Chief Compliance Officer (CCO) and compliance function utilizing data to engage in both continuous monitoring and continuous improvement. The DOJ for some time now has stressed the importance of leveraging data in order to have objective evidence around whether or not a compliance program is working effectively. Yet, as many CCOs are legally trained they are unsure about what some of the specific areas to be considered are in establishing quantifiable metrics to monitor for effectiveness.

A methodical review of the 2020 Update to identify the different areas where a company could potentially establish and quantify metrics to assess effectiveness is the place to start. Many companies have what Edwards called “metrics on the basics” and noted they “have in place processes whereby their employees review the Code of Conduct and confirm they are in compliance with it either when they first onboard with the company and then periodically on an annual basis, companies are doing just fine at reporting.” But it is now the barest minimum of what compliance professionals must do. For instance, they could consider the lifecycles of Quote To Cash (QTC) or Procure To Pay (P2P). The key is to start with a documented process which can be audited and build out from there.

Three key takeaways:

  1. Create an inventory of compliance metrics.
  2. Create your metrics based upon the 2020 Update.
  3. Use these metrics for continuous monitoring and improvement.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 533 no Consistency as a Compliance Best Practice The 2020 Update emphasized the need for the corporate compliance function to ensure both consistency and fairness not only in monitoring investigations but also in monitoring the resulting discipline. One of the ways the 2020 Update emphasized this was through tracking the investigations and the discipline that may come out of any investigation. One of the challenges companies have is facts and circumstances are always different in every investigation. This makes it sometimes difficult, but if companies treat employees of one country different in terms of discipline, it does create potential gaps in a compliance program. This can then give certain countries a feeling that they can do what they want, without the risk of punishment from corporate headquarters. This is why the DOJ re-emphasized monitoring the investigations and ensuring consistent application of discipline as a critical factor in ensuring an effective compliance program. The FCPA Resource Guide, 2nd edition, added a new hallmark to the previously titled 10 Hallmarks of an Effective Compliance Program (now it is simply the Hallmarks). The Hallmark added was one which has been around for some time and it is Root Cause Analysis (RCA). It is not new because it was subtly considered in the original FCPA Resource Guide and explicitly discussed since at least the original formulation of the Evaluation of Corporate Compliance Programs in February 2017. The focus on consistency is both insightful and instructive as a key element of a best practices compliance program. Consistency forms the basis of both institutional justice and institutional fairness. That in turns, facilitates a speak up culture, which is the role of the compliance department to foster. Three key takeaways: Consistency is a key part of any compliance program. Consistency forms the basis of both institutional justice and institutional fairness. Consistency facilitates a speak up culture. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 18 Nov 2020 18:00:00 -0000 Consistency as a Compliance Best Practice full Thomas Fox Why is consistency a best practice in compliance? Find out in today's edition of 31 Days to a More Effective Compliance Program. The 2020 Update emphasized the need for the corporate compliance function to ensure both consistency and fairness not only in monitoring investigations but also in monitoring the resulting discipline. One of the ways the 2020 Update emphasized this was through tracking the investigations and the discipline that may come out of any investigation. One of the challenges companies have is facts and circumstances are always different in every investigation. This makes it sometimes difficult, but if companies treat employees of one country different in terms of discipline, it does create potential gaps in a compliance program. This can then give certain countries a feeling that they can do what they want, without the risk of punishment from corporate headquarters. This is why the DOJ re-emphasized monitoring the investigations and ensuring consistent application of discipline as a critical factor in ensuring an effective compliance program. The FCPA Resource Guide, 2nd edition, added a new hallmark to the previously titled 10 Hallmarks of an Effective Compliance Program (now it is simply the Hallmarks). The Hallmark added was one which has been around for some time and it is Root Cause Analysis (RCA). It is not new because it was subtly considered in the original FCPA Resource Guide and explicitly discussed since at least the original formulation of the Evaluation of Corporate Compliance Programs in February 2017. The focus on consistency is both insightful and instructive as a key element of a best practices compliance program. Consistency forms the basis of both institutional justice and institutional fairness. That in turns, facilitates a speak up culture, which is the role of the compliance department to foster. Three key takeaways: Consistency is a key part of any compliance program. Consistency forms the basis of both institutional justice and institutional fairness. Consistency facilitates a speak up culture. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2020 Update emphasized the need for the corporate compliance function to ensure both consistency and fairness not only in monitoring investigations but also in monitoring the resulting discipline. One of the ways the 2020 Update emphasized this was through tracking the investigations and the discipline that may come out of any investigation. One of the challenges companies have is facts and circumstances are always different in every investigation. This makes it sometimes difficult, but if companies treat employees of one country different in terms of discipline, it does create potential gaps in a compliance program. This can then give certain countries a feeling that they can do what they want, without the risk of punishment from corporate headquarters. This is why the DOJ re-emphasized monitoring the investigations and ensuring consistent application of discipline as a critical factor in ensuring an effective compliance program.

The FCPA Resource Guide, 2nd edition, added a new hallmark to the previously titled 10 Hallmarks of an Effective Compliance Program (now it is simply the Hallmarks). The Hallmark added was one which has been around for some time and it is Root Cause Analysis (RCA). It is not new because it was subtly considered in the original FCPA Resource Guide and explicitly discussed since at least the original formulation of the Evaluation of Corporate Compliance Programs in February 2017.

The focus on consistency is both insightful and instructive as a key element of a best practices compliance program. Consistency forms the basis of both institutional justice and institutional fairness. That in turns, facilitates a speak up culture, which is the role of the compliance department to foster.

Three key takeaways:

  1. Consistency is a key part of any compliance program.
  2. Consistency forms the basis of both institutional justice and institutional fairness.
  3. Consistency facilitates a speak up culture.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 533 no Compliance at the Table Going into the 2020s and beyond, a corporate compliance function needs to be an integral part of your corporate business strategy going forward. One of the key reasons is the ever-important debate of compliance as a cost center will become more critical going forward in this decade. Obviously if compliance programs are not effective, enforcement actions will continue to be extremely costly. Over last 10 years, there has been an increasing impact on the business where you not only must have compliance resources focused on remediation, but business resources as well. This has only grown greater with reputational risks amplified by social media. This is because as significant (and costly) as these regulatory fines and penalties have been, it is the intangible reputational damage which, in the long run, may be even more costly. With multiple stakeholders who might not desire to play out on the risk curve that might be higher risk or located in higher jurisdictions or operating in higher risk industries. Further, there are other consequential impacts if compliance does not have a seat at the table. If compliance has a seat at the table, there can be some leeway for compliance officers and for firms to figure out how best to roll out a compliance program that is commensurate with the organization’s risk and compliant with the regulations. If compliance is relegated to the back of the (corporate) bus there will be little chance to do so. Three key takeaways: It will be even more important for compliance to have a seat at the table going forward. Look for synergies with other types of compliance. Such synergies can be a big cost savings. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 17 Nov 2020 18:00:00 -0000 Compliance at the Table full Thomas Fox Why must compliance have a seat at the table in the 2020s? Find out on today's episode of 31 Days to a More Effective Compliance Program Going into the 2020s and beyond, a corporate compliance function needs to be an integral part of your corporate business strategy going forward. One of the key reasons is the ever-important debate of compliance as a cost center will become more critical going forward in this decade. Obviously if compliance programs are not effective, enforcement actions will continue to be extremely costly. Over last 10 years, there has been an increasing impact on the business where you not only must have compliance resources focused on remediation, but business resources as well. This has only grown greater with reputational risks amplified by social media. This is because as significant (and costly) as these regulatory fines and penalties have been, it is the intangible reputational damage which, in the long run, may be even more costly. With multiple stakeholders who might not desire to play out on the risk curve that might be higher risk or located in higher jurisdictions or operating in higher risk industries. Further, there are other consequential impacts if compliance does not have a seat at the table. If compliance has a seat at the table, there can be some leeway for compliance officers and for firms to figure out how best to roll out a compliance program that is commensurate with the organization’s risk and compliant with the regulations. If compliance is relegated to the back of the (corporate) bus there will be little chance to do so. Three key takeaways: It will be even more important for compliance to have a seat at the table going forward. Look for synergies with other types of compliance. Such synergies can be a big cost savings. Learn more about your ad choices. Visit megaphone.fm/adchoices Going into the 2020s and beyond, a corporate compliance function needs to be an integral part of your corporate business strategy going forward. One of the key reasons is the ever-important debate of compliance as a cost center will become more critical going forward in this decade. Obviously if compliance programs are not effective, enforcement actions will continue to be extremely costly. Over last 10 years, there has been an increasing impact on the business where you not only must have compliance resources focused on remediation, but business resources as well. This has only grown greater with reputational risks amplified by social media.

This is because as significant (and costly) as these regulatory fines and penalties have been, it is the intangible reputational damage which, in the long run, may be even more costly. With multiple stakeholders who might not desire to play out on the risk curve that might be higher risk or located in higher jurisdictions or operating in higher risk industries. Further, there are other consequential impacts if compliance does not have a seat at the table. If compliance has a seat at the table, there can be some leeway for compliance officers and for firms to figure out how best to roll out a compliance program that is commensurate with the organization’s risk and compliant with the regulations. If compliance is relegated to the back of the (corporate) bus there will be little chance to do so.

Three key takeaways:

  1. It will be even more important for compliance to have a seat at the table going forward.
  2. Look for synergies with other types of compliance.
  3. Such synergies can be a big cost savings.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 533 no Compliance Innovation Through KPIs Measuring the effectiveness of your compliance program will be one of the key criteria going forward. One of the mechanisms to do so is through Key Performance Indicators (KPIs). KPIs are a critical component in showing compliance program success or failure, if you have been working towards your stated goals and for reporting success. And while specific requirements for this kind of reporting have been hotly debated in the industry for some time, KPIs are a regulatory requirement. Your KPIs are going to be specific and unique to your company and what business it conducts along. Couple this with what goals you are trying to achieve as a whole as a compliance program and you will see there is no set list of these metrics. KPIs provide yet another mechanism for you to monitor and update your compliance program on an almost continuous basis. KPIs can be extremely low in cost and therefore something you can put in place without a lot of approval from higher ups in your organization that you might have to go to for budget approval. Finally, innovation can come in many ways. Obviously ComTech can be a huge jump forward. But sometimes innovation can occur at much less cost and a much more granular level. KPIs can be such a mechanism for you. Three key takeaways: KPIs will be critical to assess a compliance program going forward. Set your KPIs. Decide on how to use KPIs and the blueprint for going forward. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 16 Nov 2020 18:00:00 -0000 Compliance Innovation Through KPIs full Thomas Fox How can you innovate your compliance program though the use of KPIs? Find out on Today's edition of 31 Days to a More Effective Compliance Program. Measuring the effectiveness of your compliance program will be one of the key criteria going forward. One of the mechanisms to do so is through Key Performance Indicators (KPIs). KPIs are a critical component in showing compliance program success or failure, if you have been working towards your stated goals and for reporting success. And while specific requirements for this kind of reporting have been hotly debated in the industry for some time, KPIs are a regulatory requirement. Your KPIs are going to be specific and unique to your company and what business it conducts along. Couple this with what goals you are trying to achieve as a whole as a compliance program and you will see there is no set list of these metrics. KPIs provide yet another mechanism for you to monitor and update your compliance program on an almost continuous basis. KPIs can be extremely low in cost and therefore something you can put in place without a lot of approval from higher ups in your organization that you might have to go to for budget approval. Finally, innovation can come in many ways. Obviously ComTech can be a huge jump forward. But sometimes innovation can occur at much less cost and a much more granular level. KPIs can be such a mechanism for you. Three key takeaways: KPIs will be critical to assess a compliance program going forward. Set your KPIs. Decide on how to use KPIs and the blueprint for going forward. Learn more about your ad choices. Visit megaphone.fm/adchoices Measuring the effectiveness of your compliance program will be one of the key criteria going forward. One of the mechanisms to do so is through Key Performance Indicators (KPIs). KPIs are a critical component in showing compliance program success or failure, if you have been working towards your stated goals and for reporting success. And while specific requirements for this kind of reporting have been hotly debated in the industry for some time, KPIs are a regulatory requirement. Your KPIs are going to be specific and unique to your company and what business it conducts along. Couple this with what goals you are trying to achieve as a whole as a compliance program and you will see there is no set list of these metrics.

KPIs provide yet another mechanism for you to monitor and update your compliance program on an almost continuous basis. KPIs can be extremely low in cost and therefore something you can put in place without a lot of approval from higher ups in your organization that you might have to go to for budget approval. Finally, innovation can come in many ways. Obviously ComTech can be a huge jump forward. But sometimes innovation can occur at much less cost and a much more granular level. KPIs can be such a mechanism for you.

Three key takeaways:

  1. KPIs will be critical to assess a compliance program going forward.
  2. Set your KPIs.
  3. Decide on how to use KPIs and the blueprint for going forward.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 533 no Connected Compliance Disconnectedness compliance comes from the fact there is not one system which connects the disparate strands of the compliance discipline. In the view of Thomas Sehested, GAN Integrity founder and its former Chief Executive Officer connected compliance “enables a CCO and all those people in the organization working with compliance, to have one central place, a one system of record for everything they do.” This can be their whistleblowing hotline, case management, training of their employees or training of their vendors policy. It is literally connecting them all so they are running from one central location and these disparate systems can be monitored from one central location. He put it as, “really like getting everything under one roof.” I was struck by that metaphor, “getting everything under one roof”, as one of the struggles many compliance officers have is that the information they need is literally siloed across different functions of the company. Information can be contained in the sales function, where there may be employee expense data, information on marketing expenses or charitable donations may be in the sales organization but it could be spread among other corporate functions as well. All of this is what the DOJ has articulated as operationalizing compliance. It first garnered attention in the February 2017 release of the original Evaluation of Corporate Compliance Programs. Since that time, compliance practitioners have steadily worked to move their compliance programs forward onto the front lines of their business units. Connected compliance is one way to do so but it clearly requires a human element to not only interpret data but to impart the appropriate or required compliance solution. Operationalizing compliance means that you cannot have an annual or even quarterly update on what’s going on in the program. It must be operationalized in such a way that you are sharing information not only with the regional business units of floating up to the corporate compliance folks, but also sharing information back and forth with the other business units, procurement, finance and reacting in real time. Three key takeaways: Connected compliance moves you towards continuous monitoring. Compliance under one roof. Never forget the human element. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 13 Nov 2020 18:00:00 -0000 Connected Compliance full Thomas Fox Disconnectedness compliance comes from the fact there is not one system which connects the disparate strands of the compliance discipline. Find out more on 31 Days to a More Effective Compliance Program. Disconnectedness compliance comes from the fact there is not one system which connects the disparate strands of the compliance discipline. In the view of Thomas Sehested, GAN Integrity founder and its former Chief Executive Officer connected compliance “enables a CCO and all those people in the organization working with compliance, to have one central place, a one system of record for everything they do.” This can be their whistleblowing hotline, case management, training of their employees or training of their vendors policy. It is literally connecting them all so they are running from one central location and these disparate systems can be monitored from one central location. He put it as, “really like getting everything under one roof.” I was struck by that metaphor, “getting everything under one roof”, as one of the struggles many compliance officers have is that the information they need is literally siloed across different functions of the company. Information can be contained in the sales function, where there may be employee expense data, information on marketing expenses or charitable donations may be in the sales organization but it could be spread among other corporate functions as well. All of this is what the DOJ has articulated as operationalizing compliance. It first garnered attention in the February 2017 release of the original Evaluation of Corporate Compliance Programs. Since that time, compliance practitioners have steadily worked to move their compliance programs forward onto the front lines of their business units. Connected compliance is one way to do so but it clearly requires a human element to not only interpret data but to impart the appropriate or required compliance solution. Operationalizing compliance means that you cannot have an annual or even quarterly update on what’s going on in the program. It must be operationalized in such a way that you are sharing information not only with the regional business units of floating up to the corporate compliance folks, but also sharing information back and forth with the other business units, procurement, finance and reacting in real time. Three key takeaways: Connected compliance moves you towards continuous monitoring. Compliance under one roof. Never forget the human element. Learn more about your ad choices. Visit megaphone.fm/adchoices Disconnectedness compliance comes from the fact there is not one system which connects the disparate strands of the compliance discipline. In the view of Thomas Sehested, GAN Integrity founder and its former Chief Executive Officer connected compliance “enables a CCO and all those people in the organization working with compliance, to have one central place, a one system of record for everything they do.” This can be their whistleblowing hotline, case management, training of their employees or training of their vendors policy. It is literally connecting them all so they are running from one central location and these disparate systems can be monitored from one central location. He put it as, “really like getting everything under one roof.” I was struck by that metaphor, “getting everything under one roof”, as one of the struggles many compliance officers have is that the information they need is literally siloed across different functions of the company. Information can be contained in the sales function, where there may be employee expense data, information on marketing expenses or charitable donations may be in the sales organization but it could be spread among other corporate functions as well.

All of this is what the DOJ has articulated as operationalizing compliance. It first garnered attention in the February 2017 release of the original Evaluation of Corporate Compliance Programs. Since that time, compliance practitioners have steadily worked to move their compliance programs forward onto the front lines of their business units. Connected compliance is one way to do so but it clearly requires a human element to not only interpret data but to impart the appropriate or required compliance solution. Operationalizing compliance means that you cannot have an annual or even quarterly update on what’s going on in the program. It must be operationalized in such a way that you are sharing information not only with the regional business units of floating up to the corporate compliance folks, but also sharing information back and forth with the other business units, procurement, finance and reacting in real time.

Three key takeaways:

  1. Connected compliance moves you towards continuous monitoring.
  2. Compliance under one roof.
  3. Never forget the human element.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 533 no The Competitive (Compliance) Advantage of Data The DOJ and SEC have both made it clear that they expect companies to be more robust in their use of data analytics in compliance programs. This means using data to not only detect and prevent illegal conduct but also in the remediation prong of any best practices compliance program as well through continuous improvement. In 2019, former Deputy Assistant Attorney General Matthew Miner said in a speech that the DOJ will inquire whether compliance departments have access to internal data that could help them identify misconduct and whether compliance officers make adequate use of data analytics in their reviews of companies under investigation. Since at least 2016 in the FCPA enforcement action involving Key Energy Services, Inc., the SEC has been communicating to compliance professionals of the need for increased use of data and data analytics in any compliance program. The bottom line is that it is not if but when you begin to incorporate corporate information into your compliance program to make your compliance program more efficient and your business process run more effectively. My suggestion is that you begin now to identify the data you have access to and the data to which you currently do not have access. Find a way to bridge that gap. Three key takeaways: DOJ pronouncements mandate CCO availability to and use of data. Data can be an actionable solution across geographic and business lines. Use data as a business strategy. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 12 Nov 2020 18:00:00 -0000 The Competitive (Compliance) Advantage of Data full Thomas Fox The bottom line is that it is not if but when you begin to incorporate corporate information into your compliance program to make your compliance program more efficient and your business process run more effectively. The DOJ and SEC have both made it clear that they expect companies to be more robust in their use of data analytics in compliance programs. This means using data to not only detect and prevent illegal conduct but also in the remediation prong of any best practices compliance program as well through continuous improvement. In 2019, former Deputy Assistant Attorney General Matthew Miner said in a speech that the DOJ will inquire whether compliance departments have access to internal data that could help them identify misconduct and whether compliance officers make adequate use of data analytics in their reviews of companies under investigation. Since at least 2016 in the FCPA enforcement action involving Key Energy Services, Inc., the SEC has been communicating to compliance professionals of the need for increased use of data and data analytics in any compliance program. The bottom line is that it is not if but when you begin to incorporate corporate information into your compliance program to make your compliance program more efficient and your business process run more effectively. My suggestion is that you begin now to identify the data you have access to and the data to which you currently do not have access. Find a way to bridge that gap. Three key takeaways: DOJ pronouncements mandate CCO availability to and use of data. Data can be an actionable solution across geographic and business lines. Use data as a business strategy. Learn more about your ad choices. Visit megaphone.fm/adchoices The DOJ and SEC have both made it clear that they expect companies to be more robust in their use of data analytics in compliance programs. This means using data to not only detect and prevent illegal conduct but also in the remediation prong of any best practices compliance program as well through continuous improvement. In 2019, former Deputy Assistant Attorney General Matthew Miner said in a speech that the DOJ will inquire whether compliance departments have access to internal data that could help them identify misconduct and whether compliance officers make adequate use of data analytics in their reviews of companies under investigation. Since at least 2016 in the FCPA enforcement action involving Key Energy Services, Inc., the SEC has been communicating to compliance professionals of the need for increased use of data and data analytics in any compliance program.

The bottom line is that it is not if but when you begin to incorporate corporate information into your compliance program to make your compliance program more efficient and your business process run more effectively. My suggestion is that you begin now to identify the data you have access to and the data to which you currently do not have access. Find a way to bridge that gap.

Three key takeaways:

  1. DOJ pronouncements mandate CCO availability to and use of data.
  2. Data can be an actionable solution across geographic and business lines.
  3. Use data as a business strategy.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 533 no The Compliance Function into the 2020s and Beyond Yesterday we considered the compliance professional in the 2020s and beyond. Today we look at the Compliance Function. The Coronavirus pandemic has accelerated change in compliance that have been percolating for the last few years. Indeed, I believe that in as short a time as 5 years, 2020 will be seen as an inflection point in compliance; IE., the Year When Everything Changed. There are four major changes I would like to highlight. Compliance Convergence. In 2019 there were three significant releases of information by the federal government which directly impacted compliance professionals. Public/private partnership in anti-corruption fight. Over the past few years, the DOJ has gone far towards laying out real incentives for corporations to help in the fight against the international scourge against bribery and corruption. Data, Data, Data. The DOJ has made it clear that it expects companies to be more robust in their use of data analytics in compliance programs. Compliance as the Ethical Edge. We have known for many years that companies with more robust compliance programs were most generally better run companies. This academic research and other case studies demonstrate the effective compliance programs equates to more efficient business processes and leads to greater profitability. As senior business leaders come to understand this message, they will (properly) see compliance as a business process which can be analyzed and improved through continuous improvement to make companies run more efficiently and at the end of the day more profitably. These companies do not make money because they have a better heart, they are more profitable because they are better run. Finally, all of this ties back to a requirement from the DOJ for continuous improvement of your compliance program.  Three key takeaways: It’s all about compliance now. Compliance connectedness. It’s all about the data. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 11 Nov 2020 18:00:00 -0000 The Compliance Function into the 2020s and Beyond full Thomas Fox Yesterday we considered the compliance professional in the 2020s and beyond. Today we look at the Compliance Function. Yesterday we considered the compliance professional in the 2020s and beyond. Today we look at the Compliance Function. The Coronavirus pandemic has accelerated change in compliance that have been percolating for the last few years. Indeed, I believe that in as short a time as 5 years, 2020 will be seen as an inflection point in compliance; IE., the Year When Everything Changed. There are four major changes I would like to highlight. Compliance Convergence. In 2019 there were three significant releases of information by the federal government which directly impacted compliance professionals. Public/private partnership in anti-corruption fight. Over the past few years, the DOJ has gone far towards laying out real incentives for corporations to help in the fight against the international scourge against bribery and corruption. Data, Data, Data. The DOJ has made it clear that it expects companies to be more robust in their use of data analytics in compliance programs. Compliance as the Ethical Edge. We have known for many years that companies with more robust compliance programs were most generally better run companies. This academic research and other case studies demonstrate the effective compliance programs equates to more efficient business processes and leads to greater profitability. As senior business leaders come to understand this message, they will (properly) see compliance as a business process which can be analyzed and improved through continuous improvement to make companies run more efficiently and at the end of the day more profitably. These companies do not make money because they have a better heart, they are more profitable because they are better run. Finally, all of this ties back to a requirement from the DOJ for continuous improvement of your compliance program.  Three key takeaways: It’s all about compliance now. Compliance connectedness. It’s all about the data. Learn more about your ad choices. Visit megaphone.fm/adchoices Yesterday we considered the compliance professional in the 2020s and beyond. Today we look at the Compliance Function. The Coronavirus pandemic has accelerated change in compliance that have been percolating for the last few years. Indeed, I believe that in as short a time as 5 years, 2020 will be seen as an inflection point in compliance; IE., the Year When Everything Changed. There are four major changes I would like to highlight.

Compliance Convergence. In 2019 there were three significant releases of information by the federal government which directly impacted compliance professionals.

Public/private partnership in anti-corruption fight. Over the past few years, the DOJ has gone far towards laying out real incentives for corporations to help in the fight against the international scourge against bribery and corruption.

Data, Data, Data. The DOJ has made it clear that it expects companies to be more robust in their use of data analytics in compliance programs.

Compliance as the Ethical Edge. We have known for many years that companies with more robust compliance programs were most generally better run companies.

This academic research and other case studies demonstrate the effective compliance programs equates to more efficient business processes and leads to greater profitability. As senior business leaders come to understand this message, they will (properly) see compliance as a business process which can be analyzed and improved through continuous improvement to make companies run more efficiently and at the end of the day more profitably. These companies do not make money because they have a better heart, they are more profitable because they are better run. Finally, all of this ties back to a requirement from the DOJ for continuous improvement of your compliance program. 

Three key takeaways:

  1. It’s all about compliance now.
  2. Compliance connectedness.
  3. It’s all about the data.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 529 no Skills for the Compliance Professional in the 2020s What should compliance practitioners do to move themselves forward professionally in the 2020s and beyond? Ton consider this question, I drew inspiration from the Financial Times (FT) piece, entitled “Work in the 2020s: 5 essential skills to succeed”, by Lyndsey Jones. In this article Jones laid out five areas where workers need to have skills that will keep abreast of the ever-evolving marketplace. They are: (1) Adapt to thrive, (2) Be creative; (3) Develop emotional intelligence; (4) Become tech savvy; and (5) Build your personal brand. Being a compliance professional in the coming decade will be one of the most challenging, rewarding and exciting professions for anyone to engage in. You have the opportunity to help lead not only your organization but also your profession. To paraphrase Alyson Van Hooser, will you put your (compliance) stake in the ground and own it? For your sake and the sake of the compliance profession going forward, I hope you will do so. Three key takeaways: Adapt to thrive as you are only limited by your imagination. Build your brand and deliver. Be creative. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 10 Nov 2020 18:00:00 -0000 Skills for the Compliance Professional in the 2020s full Thomas Fox What should compliance practitioners do to move themselves forward professionally in the 2020s and beyond? Find out n this episode of 31 Days to a More Effective Compliance Program. What should compliance practitioners do to move themselves forward professionally in the 2020s and beyond? Ton consider this question, I drew inspiration from the Financial Times (FT) piece, entitled “Work in the 2020s: 5 essential skills to succeed”, by Lyndsey Jones. In this article Jones laid out five areas where workers need to have skills that will keep abreast of the ever-evolving marketplace. They are: (1) Adapt to thrive, (2) Be creative; (3) Develop emotional intelligence; (4) Become tech savvy; and (5) Build your personal brand. Being a compliance professional in the coming decade will be one of the most challenging, rewarding and exciting professions for anyone to engage in. You have the opportunity to help lead not only your organization but also your profession. To paraphrase Alyson Van Hooser, will you put your (compliance) stake in the ground and own it? For your sake and the sake of the compliance profession going forward, I hope you will do so. Three key takeaways: Adapt to thrive as you are only limited by your imagination. Build your brand and deliver. Be creative. Learn more about your ad choices. Visit megaphone.fm/adchoices What should compliance practitioners do to move themselves forward professionally in the 2020s and beyond? Ton consider this question, I drew inspiration from the Financial Times (FT) piece, entitled “Work in the 2020s: 5 essential skills to succeed”, by Lyndsey Jones. In this article Jones laid out five areas where workers need to have skills that will keep abreast of the ever-evolving marketplace. They are: (1) Adapt to thrive, (2) Be creative; (3) Develop emotional intelligence; (4) Become tech savvy; and (5) Build your personal brand.

Being a compliance professional in the coming decade will be one of the most challenging, rewarding and exciting professions for anyone to engage in. You have the opportunity to help lead not only your organization but also your profession. To paraphrase Alyson Van Hooser, will you put your (compliance) stake in the ground and own it? For your sake and the sake of the compliance profession going forward, I hope you will do so.

Three key takeaways:

  1. Adapt to thrive as you are only limited by your imagination.
  2. Build your brand and deliver.
  3. Be creative.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 529 no Future of Compliance Training Where is compliance training headed? In the 2020 Update, the DOJ stated, “companies have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit, or other risk management functions.” While this tactical solution has proven useful, I wanted to consider the broader compliance training themes that compliance professionals have learned over the past few years to gain insight into where compliance training may be headed. I sat down with Shawn Rogers, Director Global Ethics and Compliance - Training and Awareness at Walmart, to provide some thoughts on the veiled land of the future of compliance training. Compliance training needs to get to the point where managers and leaders drive compliance training based on how they perceive the risks in their organizations. In other words, an awareness of risks can permeate the organization to such a degree that managers will be able to recognize when their employees need training and can call on the compliance function to provide custom training opportunities. Three key takeaways: Business crisis almost always begin with a culture failure. Focus your most detailed training on those employees who are truly high-risk. This is the “just-in-time” training model provides training exactly when and where the employee needs the information. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 09 Nov 2020 18:00:00 -0000 Future of Compliance Training full Thomas Fox What does the future of compliance training look like? Find out on this episode of 31 Days to a More Effective Compliance Program Where is compliance training headed? In the 2020 Update, the DOJ stated, “companies have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit, or other risk management functions.” While this tactical solution has proven useful, I wanted to consider the broader compliance training themes that compliance professionals have learned over the past few years to gain insight into where compliance training may be headed. I sat down with Shawn Rogers, Director Global Ethics and Compliance - Training and Awareness at Walmart, to provide some thoughts on the veiled land of the future of compliance training. Compliance training needs to get to the point where managers and leaders drive compliance training based on how they perceive the risks in their organizations. In other words, an awareness of risks can permeate the organization to such a degree that managers will be able to recognize when their employees need training and can call on the compliance function to provide custom training opportunities. Three key takeaways: Business crisis almost always begin with a culture failure. Focus your most detailed training on those employees who are truly high-risk. This is the “just-in-time” training model provides training exactly when and where the employee needs the information. Learn more about your ad choices. Visit megaphone.fm/adchoices Where is compliance training headed? In the 2020 Update, the DOJ stated, “companies have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit, or other risk management functions.” While this tactical solution has proven useful, I wanted to consider the broader compliance training themes that compliance professionals have learned over the past few years to gain insight into where compliance training may be headed. I sat down with Shawn Rogers, Director Global Ethics and Compliance - Training and Awareness at Walmart, to provide some thoughts on the veiled land of the future of compliance training.

Compliance training needs to get to the point where managers and leaders drive compliance training based on how they perceive the risks in their organizations. In other words, an awareness of risks can permeate the organization to such a degree that managers will be able to recognize when their employees need training and can call on the compliance function to provide custom training opportunities.

Three key takeaways:

  1. Business crisis almost always begin with a culture failure.
  2. Focus your most detailed training on those employees who are truly high-risk.
  3. This is the “just-in-time” training model provides training exactly when and where the employee needs the information.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 529 no Communication to see around corners The more you can operationalize compliance, the more it works to operationalize culture in your organization. It works for all levels of a company, literally from the Boardroom to the shop floor. The DOJ and SEC recognized this when they noted in their 2020 FCPA Resource Guide, “A compliance program should apply from the board room to the supply room - no one should be beyond its reach.” Yet culture can provide more than simply an ethical foundation, it is also a part of the business foundation of an entity. Using such an approach to communications, allows a CCO to “see around corners” and can be one of the greatest strengths of a best practices compliance program. The reason is listening. Listening is a key leadership component and there are certainly many ways to listen. You can sit in your office and wait for a call or report on the hotline or you can go out into the field and find out what challenges employees are facing. From this you can work with them to craft a solution that works for the company and holds to the company’s ethical and compliance values. Using social media tools, a CCO can move towards Thomas’ next key ingredient of a successful corporate culture; which is trust. Thomas said, “I’m obsessive about the culture that we create specifically around trust, and this is an adjustment for some people when they come here. If you join our team, there’s trust by default here. That means you trust in the competence of your teammates. You trust in their intentions and what they’re saying. At some companies, the culture is that trust is earned over time, but that means if everyone in the organization says you have to earn trust, the amount of energy that actually goes into the trust-earning process is a distraction from our mission.” Three key takeaways: A company can fail if it does not get its culture right. Using communications to “see around corners”. Trust works as a business strategy. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 06 Nov 2020 18:00:00 -0000 Communication to see around corners full Thomas Fox How can a compliance professional use such an approach to communications, allows a CCO to “see around corners” and why can be one of the greatest strengths of a best practices compliance program? The more you can operationalize compliance, the more it works to operationalize culture in your organization. It works for all levels of a company, literally from the Boardroom to the shop floor. The DOJ and SEC recognized this when they noted in their 2020 FCPA Resource Guide, “A compliance program should apply from the board room to the supply room - no one should be beyond its reach.” Yet culture can provide more than simply an ethical foundation, it is also a part of the business foundation of an entity. Using such an approach to communications, allows a CCO to “see around corners” and can be one of the greatest strengths of a best practices compliance program. The reason is listening. Listening is a key leadership component and there are certainly many ways to listen. You can sit in your office and wait for a call or report on the hotline or you can go out into the field and find out what challenges employees are facing. From this you can work with them to craft a solution that works for the company and holds to the company’s ethical and compliance values. Using social media tools, a CCO can move towards Thomas’ next key ingredient of a successful corporate culture; which is trust. Thomas said, “I’m obsessive about the culture that we create specifically around trust, and this is an adjustment for some people when they come here. If you join our team, there’s trust by default here. That means you trust in the competence of your teammates. You trust in their intentions and what they’re saying. At some companies, the culture is that trust is earned over time, but that means if everyone in the organization says you have to earn trust, the amount of energy that actually goes into the trust-earning process is a distraction from our mission.” Three key takeaways: A company can fail if it does not get its culture right. Using communications to “see around corners”. Trust works as a business strategy. Learn more about your ad choices. Visit megaphone.fm/adchoices The more you can operationalize compliance, the more it works to operationalize culture in your organization. It works for all levels of a company, literally from the Boardroom to the shop floor. The DOJ and SEC recognized this when they noted in their 2020 FCPA Resource Guide, “A compliance program should apply from the board room to the supply room - no one should be beyond its reach.” Yet culture can provide more than simply an ethical foundation, it is also a part of the business foundation of an entity.

Using such an approach to communications, allows a CCO to “see around corners” and can be one of the greatest strengths of a best practices compliance program. The reason is listening. Listening is a key leadership component and there are certainly many ways to listen. You can sit in your office and wait for a call or report on the hotline or you can go out into the field and find out what challenges employees are facing. From this you can work with them to craft a solution that works for the company and holds to the company’s ethical and compliance values.

Using social media tools, a CCO can move towards Thomas’ next key ingredient of a successful corporate culture; which is trust. Thomas said, “I’m obsessive about the culture that we create specifically around trust, and this is an adjustment for some people when they come here. If you join our team, there’s trust by default here. That means you trust in the competence of your teammates. You trust in their intentions and what they’re saying. At some companies, the culture is that trust is earned over time, but that means if everyone in the organization says you have to earn trust, the amount of energy that actually goes into the trust-earning process is a distraction from our mission.”

Three key takeaways:

  1. A company can fail if it does not get its culture right.
  2. Using communications to “see around corners”.
  3. Trust works as a business strategy.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 529 no The ROI of Effective Compliance We are now at a place where there is sufficient data, academic research and actual use cases from corporations and businesses that demonstrate good ethics and compliance programs are not simply good for business but when properly used, they lead to greater profitability.  The data and information you collect, which might initially begin as a compliance solution or project can be used to improve business process efficiency. It can also be the case that the delivery of a compliance solution can improve an overall business process. When you start to consider the compliance data points in every organization, from the Quote To Cash (QTC) sales cycle to the Procure To Pay (P2P) procurement cycle you begin to see how compliance can be used to improve business efficiency and lead to greater profitability. Three key takeaways: The World’s Most Ethical companies had 13.5% delta about the S&P 500 average in 2020. Companies with robust compliance programs do better financially in countries prone to corruption than companies with less effective compliance programs. What does the data tell you? Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 05 Nov 2020 18:00:00 -0000 The ROI of Effective Compliance full Thomas Fox We are now at a place where there is sufficient data, academic research and actual use cases demonstrate good ethics and compliance programs are not simply good for business but when properly used, they lead to greater ROI. We are now at a place where there is sufficient data, academic research and actual use cases from corporations and businesses that demonstrate good ethics and compliance programs are not simply good for business but when properly used, they lead to greater profitability.  The data and information you collect, which might initially begin as a compliance solution or project can be used to improve business process efficiency. It can also be the case that the delivery of a compliance solution can improve an overall business process. When you start to consider the compliance data points in every organization, from the Quote To Cash (QTC) sales cycle to the Procure To Pay (P2P) procurement cycle you begin to see how compliance can be used to improve business efficiency and lead to greater profitability. Three key takeaways: The World’s Most Ethical companies had 13.5% delta about the S&P 500 average in 2020. Companies with robust compliance programs do better financially in countries prone to corruption than companies with less effective compliance programs. What does the data tell you? Learn more about your ad choices. Visit megaphone.fm/adchoices We are now at a place where there is sufficient data, academic research and actual use cases from corporations and businesses that demonstrate good ethics and compliance programs are not simply good for business but when properly used, they lead to greater profitability. 

The data and information you collect, which might initially begin as a compliance solution or project can be used to improve business process efficiency. It can also be the case that the delivery of a compliance solution can improve an overall business process. When you start to consider the compliance data points in every organization, from the Quote To Cash (QTC) sales cycle to the Procure To Pay (P2P) procurement cycle you begin to see how compliance can be used to improve business efficiency and lead to greater profitability.

Three key takeaways:

  1. The World’s Most Ethical companies had 13.5% delta about the S&P 500 average in 2020.
  2. Companies with robust compliance programs do better financially in countries prone to corruption than companies with less effective compliance programs.
  3. What does the data tell you?


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 529 no Operationalizing Compliance Through a Digital Transformation Through restructuring, senior leadership can signal that digital transformation in compliance is critical for the future of the organization. From this point the compliance function can work with an internal digital product design group. By doing so, the corporate compliance function can work with a team dedicated to supervising the development of the new compliance solution through product design, testing, and analysis, which will include customized generative design and analysis tools. Top management can signal the importance of the compliance digital transformation by using this dedicated team to spearhead the compliance function’s digital transformation development process. One of the great things about the compliance world is that we are only limited by our own imaginations. If you can imagine a better way for your company to fully do compliance, it is at your disposal to do so. Yet rarely do we think about the structure of how compliance activates as a way to more fully operationalize compliance. By identifying and bringing in the skills needed to move forward with compliance innovation, you can help kick-start the compliance operationalize process through a digital transformation of your compliance regime. By doing so, you may make all the difference between success and failure coming out of the Coronavirus health crisis as the world reopens for business. Three key takeaways: Have you considered a generational team approach to a digital transformation in compliance? Have non-compliance professionals aid in compliance program development. In compliance you are only limited by your own imagination. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 04 Nov 2020 18:00:00 -0000 Operationalizing Compliance Through a Digital Transformation full Thomas Fox How can you operationalizing compliance through a digital transformation? Find out in today's edition of 31 Days to a More Effective Compliance Program Through restructuring, senior leadership can signal that digital transformation in compliance is critical for the future of the organization. From this point the compliance function can work with an internal digital product design group. By doing so, the corporate compliance function can work with a team dedicated to supervising the development of the new compliance solution through product design, testing, and analysis, which will include customized generative design and analysis tools. Top management can signal the importance of the compliance digital transformation by using this dedicated team to spearhead the compliance function’s digital transformation development process. One of the great things about the compliance world is that we are only limited by our own imaginations. If you can imagine a better way for your company to fully do compliance, it is at your disposal to do so. Yet rarely do we think about the structure of how compliance activates as a way to more fully operationalize compliance. By identifying and bringing in the skills needed to move forward with compliance innovation, you can help kick-start the compliance operationalize process through a digital transformation of your compliance regime. By doing so, you may make all the difference between success and failure coming out of the Coronavirus health crisis as the world reopens for business. Three key takeaways: Have you considered a generational team approach to a digital transformation in compliance? Have non-compliance professionals aid in compliance program development. In compliance you are only limited by your own imagination. Learn more about your ad choices. Visit megaphone.fm/adchoices Through restructuring, senior leadership can signal that digital transformation in compliance is critical for the future of the organization. From this point the compliance function can work with an internal digital product design group. By doing so, the corporate compliance function can work with a team dedicated to supervising the development of the new compliance solution through product design, testing, and analysis, which will include customized generative design and analysis tools. Top management can signal the importance of the compliance digital transformation by using this dedicated team to spearhead the compliance function’s digital transformation development process.

One of the great things about the compliance world is that we are only limited by our own imaginations. If you can imagine a better way for your company to fully do compliance, it is at your disposal to do so. Yet rarely do we think about the structure of how compliance activates as a way to more fully operationalize compliance. By identifying and bringing in the skills needed to move forward with compliance innovation, you can help kick-start the compliance operationalize process through a digital transformation of your compliance regime. By doing so, you may make all the difference between success and failure coming out of the Coronavirus health crisis as the world reopens for business.

Three key takeaways:

  1. Have you considered a generational team approach to a digital transformation in compliance?
  2. Have non-compliance professionals aid in compliance program development.
  3. In compliance you are only limited by your own imagination.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 529 no Taming Complexity in Compliance One of the lessons we have learned from various FCPA enforcement actions over the years is how complexity in business organizations can work to defeat compliance programs. Whether a corrupt employee is working to actively hide a pot of money, which can or will be used to pay a bribe, or an improper payment slips through the cracks; complexity can work to defeat a best practices compliance program. If a compliance function does not have visibility into a business unit, how it does business and where its payments are going; it may be due to design defect or inadvertent complexity. Compliance is now in an era of brisk innovation and evolution. It is prone to technological change and rapid obsolescence of the lawyer-driven, spreadsheets and word document-based compliance programs. Going forward the compliance professional needs to understand that a “package of resilience, adaptability, coordination, and inimitability becomes more attractive than the package of efficiency, understandability, manageability, and predictability.” The key is to learn how to harness complexity on a sustainable basis. Three key takeaways: Not all complexity is bad. If you cannot figure out how a foreign does business you have a problem. Compliance is now properly seen as a business process. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 03 Nov 2020 18:00:00 -0000 Taming Complexity in Compliance full Thomas Fox Why is taming complexity in compliance critical to compliance program effectiveness? Find out in today's episode of 31 Days to a More Effective Compliance Program. One of the lessons we have learned from various FCPA enforcement actions over the years is how complexity in business organizations can work to defeat compliance programs. Whether a corrupt employee is working to actively hide a pot of money, which can or will be used to pay a bribe, or an improper payment slips through the cracks; complexity can work to defeat a best practices compliance program. If a compliance function does not have visibility into a business unit, how it does business and where its payments are going; it may be due to design defect or inadvertent complexity. Compliance is now in an era of brisk innovation and evolution. It is prone to technological change and rapid obsolescence of the lawyer-driven, spreadsheets and word document-based compliance programs. Going forward the compliance professional needs to understand that a “package of resilience, adaptability, coordination, and inimitability becomes more attractive than the package of efficiency, understandability, manageability, and predictability.” The key is to learn how to harness complexity on a sustainable basis. Three key takeaways: Not all complexity is bad. If you cannot figure out how a foreign does business you have a problem. Compliance is now properly seen as a business process. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the lessons we have learned from various FCPA enforcement actions over the years is how complexity in business organizations can work to defeat compliance programs. Whether a corrupt employee is working to actively hide a pot of money, which can or will be used to pay a bribe, or an improper payment slips through the cracks; complexity can work to defeat a best practices compliance program. If a compliance function does not have visibility into a business unit, how it does business and where its payments are going; it may be due to design defect or inadvertent complexity.

Compliance is now in an era of brisk innovation and evolution. It is prone to technological change and rapid obsolescence of the lawyer-driven, spreadsheets and word document-based compliance programs. Going forward the compliance professional needs to understand that a “package of resilience, adaptability, coordination, and inimitability becomes more attractive than the package of efficiency, understandability, manageability, and predictability.” The key is to learn how to harness complexity on a sustainable basis.

Three key takeaways:

  1. Not all complexity is bad.
  2. If you cannot figure out how a foreign does business you have a problem.
  3. Compliance is now properly seen as a business process.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 529 no Originating and Managing a Compliance Ecosystem Have you ever thought of compliance as an ecosystem? When you consider the concept, it becomes clear that this is one thing every company should strive towards. Obviously, every multi-national company must have a compliance program. But to have true effectiveness, your compliance program must be operationalized throughout the organization. One way to facilitate this is through the ecosystem concept. There is another way that this ecosystem approach can make your compliance program more effective. Think about the third parties your company has both on the sales and the supply chain side. If you could work to create a closer ecosystem with those stakeholders from the compliance perspective, it would not only make the business relationship stronger but also make the entire business process more efficient. 2020 has brought a paradigm shift to corporate compliance as a result of technological and digital innovation. CCOs who cannot interpret the data from their own systems will likely find themselves consigned to the dustbin of corporate luddites. Compliance will be moving into a new era of collaboration and connection to more fully operationalize compliance to make all business stakeholders more efficient and at the end of the day more profitable. Three key takeaways: A compliance function’s customers are a variety of stakeholders. Compliance can improve business processes. A compliance ecosystem can help to operationalize compliance. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 02 Nov 2020 18:00:00 -0000 Originating and Managing a Compliance Ecosystem full Thomas Fox Have you ever thought of compliance as an ecosystem? Find out more in today's episode of 31 Days to a More Effective Compliance Program. Have you ever thought of compliance as an ecosystem? When you consider the concept, it becomes clear that this is one thing every company should strive towards. Obviously, every multi-national company must have a compliance program. But to have true effectiveness, your compliance program must be operationalized throughout the organization. One way to facilitate this is through the ecosystem concept. There is another way that this ecosystem approach can make your compliance program more effective. Think about the third parties your company has both on the sales and the supply chain side. If you could work to create a closer ecosystem with those stakeholders from the compliance perspective, it would not only make the business relationship stronger but also make the entire business process more efficient. 2020 has brought a paradigm shift to corporate compliance as a result of technological and digital innovation. CCOs who cannot interpret the data from their own systems will likely find themselves consigned to the dustbin of corporate luddites. Compliance will be moving into a new era of collaboration and connection to more fully operationalize compliance to make all business stakeholders more efficient and at the end of the day more profitable. Three key takeaways: A compliance function’s customers are a variety of stakeholders. Compliance can improve business processes. A compliance ecosystem can help to operationalize compliance. Learn more about your ad choices. Visit megaphone.fm/adchoices Have you ever thought of compliance as an ecosystem? When you consider the concept, it becomes clear that this is one thing every company should strive towards. Obviously, every multi-national company must have a compliance program. But to have true effectiveness, your compliance program must be operationalized throughout the organization. One way to facilitate this is through the ecosystem concept.

There is another way that this ecosystem approach can make your compliance program more effective. Think about the third parties your company has both on the sales and the supply chain side. If you could work to create a closer ecosystem with those stakeholders from the compliance perspective, it would not only make the business relationship stronger but also make the entire business process more efficient.

2020 has brought a paradigm shift to corporate compliance as a result of technological and digital innovation. CCOs who cannot interpret the data from their own systems will likely find themselves consigned to the dustbin of corporate luddites. Compliance will be moving into a new era of collaboration and connection to more fully operationalize compliance to make all business stakeholders more efficient and at the end of the day more profitable.

Three key takeaways:

  1. A compliance function’s customers are a variety of stakeholders.
  2. Compliance can improve business processes.
  3. A compliance ecosystem can help to operationalize compliance.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 529 no Why Business Ventures are Different than 3rd Parties Business ventures, whether JVs, partnerships, franchises, team agreements, strategic alliances or one of the myriad types of business relationships a U.S. company can form outside the U.S., are different than the usual risk presented by third-parties under compliance requirements such as those mandated by the FCPA. The problems for companies is that they tend to treat business venture risk the same as third-party risk. They are different and must be managed differently. The bottom line is that may compliance practitioners have not thought through the specific risks of business ventures such as JVs, franchises, strategic alliances, teaming partner or others as opposed to sales agents or representatives on the sales side of the business. I hope that this will help facilitate a discussion that maybe people will begin to think about more of the issues, more of the risk parameters and perhaps put a better risk management strategy in place. Three key takeaways:  Business ventures bring different FCPA risks from third-parties. JVs have both external compliance risks and corporate governance risks. Use your full compliance tool kit for business ventures in managing the FCPA risk for franchises. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 30 Oct 2020 17:45:01 -0000 Why Business Ventures are Different than 3rd Parties full Thomas Fox Too often compliance professionals do not understand the difference between business ventures and business venture partners and 3rd parties. Business ventures, whether JVs, partnerships, franchises, team agreements, strategic alliances or one of the myriad types of business relationships a U.S. company can form outside the U.S., are different than the usual risk presented by third-parties under compliance requirements such as those mandated by the FCPA. The problems for companies is that they tend to treat business venture risk the same as third-party risk. They are different and must be managed differently. The bottom line is that may compliance practitioners have not thought through the specific risks of business ventures such as JVs, franchises, strategic alliances, teaming partner or others as opposed to sales agents or representatives on the sales side of the business. I hope that this will help facilitate a discussion that maybe people will begin to think about more of the issues, more of the risk parameters and perhaps put a better risk management strategy in place. Three key takeaways:  Business ventures bring different FCPA risks from third-parties. JVs have both external compliance risks and corporate governance risks. Use your full compliance tool kit for business ventures in managing the FCPA risk for franchises. Learn more about your ad choices. Visit megaphone.fm/adchoices Business ventures, whether JVs, partnerships, franchises, team agreements, strategic alliances or one of the myriad types of business relationships a U.S. company can form outside the U.S., are different than the usual risk presented by third-parties under compliance requirements such as those mandated by the FCPA. The problems for companies is that they tend to treat business venture risk the same as third-party risk. They are different and must be managed differently.

The bottom line is that may compliance practitioners have not thought through the specific risks of business ventures such as JVs, franchises, strategic alliances, teaming partner or others as opposed to sales agents or representatives on the sales side of the business. I hope that this will help facilitate a discussion that maybe people will begin to think about more of the issues, more of the risk parameters and perhaps put a better risk management strategy in place.

Three key takeaways: 

  1. Business ventures bring different FCPA risks from third-parties.
  2. JVs have both external compliance risks and corporate governance risks.
  3. Use your full compliance tool kit for business ventures in managing the FCPA risk for franchises.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 1038 no Distributor Liability Under the FCPA Three enforcement actions which made clear that there were no distinctions between agents and distributors. They were the Smith & Nephew, Inc., Oracle and Eli Lilly and Company. Each of these enforcement actions had different FCPA violations and they each revealed separate steps which a company should take to both prevent and detect FCPA violations in their company.  These three separate bribery schemes call for three different but overlapping responses. The Lilly enforcement action also makes clear the need for internal audit to follow up with ongoing monitoring and auditing. Internal audit can be used to help determine the reasonableness of a commission rate outside the accepted corporate norm. The Oracle enforcement action demonstrates that Oracle needed to institute the proper controls to prevent its employees at Oracle India from creating and misusing the parked funds in the distributor’s account. The Company needed to audit and compare the distributor’s margin against the end user price to ensure excess margins were not being built into the pricing structure. Smith & Nephew did not perform sufficient due diligence on these distributors nor did they document any. Further, the distributor was domiciled in a location separate and apart, the UK, from the sole location it was designed to deliver products or services into, Greece. This clearly demonstrated that the entities were used for a purpose that the company wished to hide from Greek authorities. While it is true that a distributor might sell products into a country different than its domicile, if the products are going into a single country, this should have raised several Red Flags. Three Key Takeaways Use auditing and monitoring. Distributors will be treated the same as other business ventures.  Robust due diligence must be performed.  Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 29 Oct 2020 16:56:49 -0000 Distributor Liability Under the FCPA full Thomas Fox In today's episode, we consider three enforcement actions which made clear that there were no distinctions between agents and distributors. Three enforcement actions which made clear that there were no distinctions between agents and distributors. They were the Smith & Nephew, Inc., Oracle and Eli Lilly and Company. Each of these enforcement actions had different FCPA violations and they each revealed separate steps which a company should take to both prevent and detect FCPA violations in their company.  These three separate bribery schemes call for three different but overlapping responses. The Lilly enforcement action also makes clear the need for internal audit to follow up with ongoing monitoring and auditing. Internal audit can be used to help determine the reasonableness of a commission rate outside the accepted corporate norm. The Oracle enforcement action demonstrates that Oracle needed to institute the proper controls to prevent its employees at Oracle India from creating and misusing the parked funds in the distributor’s account. The Company needed to audit and compare the distributor’s margin against the end user price to ensure excess margins were not being built into the pricing structure. Smith & Nephew did not perform sufficient due diligence on these distributors nor did they document any. Further, the distributor was domiciled in a location separate and apart, the UK, from the sole location it was designed to deliver products or services into, Greece. This clearly demonstrated that the entities were used for a purpose that the company wished to hide from Greek authorities. While it is true that a distributor might sell products into a country different than its domicile, if the products are going into a single country, this should have raised several Red Flags. Three Key Takeaways Use auditing and monitoring. Distributors will be treated the same as other business ventures.  Robust due diligence must be performed.  Learn more about your ad choices. Visit megaphone.fm/adchoices Three enforcement actions which made clear that there were no distinctions between agents and distributors. They were the Smith & Nephew, Inc., Oracle and Eli Lilly and Company. Each of these enforcement actions had different FCPA violations and they each revealed separate steps which a company should take to both prevent and detect FCPA violations in their company. 

These three separate bribery schemes call for three different but overlapping responses. The Lilly enforcement action also makes clear the need for internal audit to follow up with ongoing monitoring and auditing. Internal audit can be used to help determine the reasonableness of a commission rate outside the accepted corporate norm. The Oracle enforcement action demonstrates that Oracle needed to institute the proper controls to prevent its employees at Oracle India from creating and misusing the parked funds in the distributor’s account. The Company needed to audit and compare the distributor’s margin against the end user price to ensure excess margins were not being built into the pricing structure. Smith & Nephew did not perform sufficient due diligence on these distributors nor did they document any. Further, the distributor was domiciled in a location separate and apart, the UK, from the sole location it was designed to deliver products or services into, Greece. This clearly demonstrated that the entities were used for a purpose that the company wished to hide from Greek authorities. While it is true that a distributor might sell products into a country different than its domicile, if the products are going into a single country, this should have raised several Red Flags.

Three Key Takeaways

  1. Use auditing and monitoring.
  2. Distributors will be treated the same as other business ventures. 
  3. Robust due diligence must be performed. 


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 549 no Following the Money Through Distributors Polycom came to FCPA grief in China, as have many other US companies. The bribery scheme was long running, occurring from 2006-2014. They included the creation of an off-the books accounting and recordation system for corrupt payments made by or on behalf of Polycom China. The money to fund these bribes came through variations of the basic bribery scheme. There would be a discount between the price reported to Polycom and that paid by the buyer. These discounts were not passed on to the end customer, but instead were intended to cover the cost of the payments the distributors made to the Chinese government officials. In other words, this discount would form the basis of the pot of money to pay the bribe.  The Chinese business unit was equally creative with the reasons for the discounts, which were listed in the CRM. Polycom China usually cited competition with one or more vendors was required to give discounts on pricing. They also claimed that some end-using customers refused to pay full price. However these were all false excuses entered into the CRM to hide the truth from auditors and others charged with reviewing and approving the discounts. Three Key Takeaways Channel your inner Woodward and Bernstein and follow the money. Simply because some type of compliance oversight is difficult or requires extra effort, it is no excuse not to monitor. Channel you inner Ronnie Reagan as well and ‘trust but verify. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 28 Oct 2020 18:49:48 -0000 Following the Money Through Distributors full Thomas Fox In this episode of 31 Days to a More Effective Compliance Program, I am consider the Polycom FCPA enforcement action to discuss following the money through distributors. Polycom came to FCPA grief in China, as have many other US companies. The bribery scheme was long running, occurring from 2006-2014. They included the creation of an off-the books accounting and recordation system for corrupt payments made by or on behalf of Polycom China. The money to fund these bribes came through variations of the basic bribery scheme. There would be a discount between the price reported to Polycom and that paid by the buyer. These discounts were not passed on to the end customer, but instead were intended to cover the cost of the payments the distributors made to the Chinese government officials. In other words, this discount would form the basis of the pot of money to pay the bribe.  The Chinese business unit was equally creative with the reasons for the discounts, which were listed in the CRM. Polycom China usually cited competition with one or more vendors was required to give discounts on pricing. They also claimed that some end-using customers refused to pay full price. However these were all false excuses entered into the CRM to hide the truth from auditors and others charged with reviewing and approving the discounts. Three Key Takeaways Channel your inner Woodward and Bernstein and follow the money. Simply because some type of compliance oversight is difficult or requires extra effort, it is no excuse not to monitor. Channel you inner Ronnie Reagan as well and ‘trust but verify. Learn more about your ad choices. Visit megaphone.fm/adchoices Polycom came to FCPA grief in China, as have many other US companies. The bribery scheme was long running, occurring from 2006-2014. They included the creation of an off-the books accounting and recordation system for corrupt payments made by or on behalf of Polycom China. The money to fund these bribes came through variations of the basic bribery scheme. There would be a discount between the price reported to Polycom and that paid by the buyer. These discounts were not passed on to the end customer, but instead were intended to cover the cost of the payments the distributors made to the Chinese government officials. In other words, this discount would form the basis of the pot of money to pay the bribe. 

The Chinese business unit was equally creative with the reasons for the discounts, which were listed in the CRM. Polycom China usually cited competition with one or more vendors was required to give discounts on pricing. They also claimed that some end-using customers refused to pay full price. However these were all false excuses entered into the CRM to hide the truth from auditors and others charged with reviewing and approving the discounts.

Three Key Takeaways

  1. Channel your inner Woodward and Bernstein and follow the money.
  2. Simply because some type of compliance oversight is difficult or requires extra effort, it is no excuse not to monitor.
  3. Channel you inner Ronnie Reagan as well and ‘trust but verify.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 549 no Franchisor Compliance Most franchisors have thorough financial vetting requirements before allowing any person or business to become a franchisee. However, how many of these same businesses perform compliance due diligence on their prospective overseas franchises? How many U.S. franchisors have compliance training programs? How many evaluate, on an ongoing basis, the compliance program of their overseas franchisees? How many U.S. franchisors have a compliance hotline or other reporting mechanism for any compliance violations made against their franchisees?  Some issues include health and wage compliance officials who may appear during routine health inspections or local wage and hour compliance determinations; intellectual property officials, as maintaining intellectual property rights is critical for any franchise model; utility officials as every franchise operation needs power maintained; and government procurement officials if the franchise is selling to a foreign government or state owned enterprise. How would all of this play out for a franchisor? As a franchisor moves into foreign markets there could well be the temptation to “grease the skids” and make payments or offer gifts to government officials, or their family members, to get the permits or permissions necessary to open and operate. In many countries, bribery is a common way of getting business done, and there can be tremendous pressure from local agents or franchisee candidates to follow regional customs and use bribes to become or remain competitive. Even if it is not the U.S. franchisor’s own employees that engage in the FCPA violations, the U.S. franchisor will still face the risk of an enforcement action if the franchisee’s employees engage in such conduct. Three key takeaways:  Franchises can bring an unexpected level of FCPA exposure. Franchisors must have more than financial vetting for potential franchisees. Use your compliance tool kit for business ventures in managing the FCPA risk for franchises. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 27 Oct 2020 17:00:00 -0000 Franchisor Compliance full Thomas Fox How many franchisors perform compliance due diligence on their prospective overseas franchises? Most franchisors have thorough financial vetting requirements before allowing any person or business to become a franchisee. However, how many of these same businesses perform compliance due diligence on their prospective overseas franchises? How many U.S. franchisors have compliance training programs? How many evaluate, on an ongoing basis, the compliance program of their overseas franchisees? How many U.S. franchisors have a compliance hotline or other reporting mechanism for any compliance violations made against their franchisees?  Some issues include health and wage compliance officials who may appear during routine health inspections or local wage and hour compliance determinations; intellectual property officials, as maintaining intellectual property rights is critical for any franchise model; utility officials as every franchise operation needs power maintained; and government procurement officials if the franchise is selling to a foreign government or state owned enterprise. How would all of this play out for a franchisor? As a franchisor moves into foreign markets there could well be the temptation to “grease the skids” and make payments or offer gifts to government officials, or their family members, to get the permits or permissions necessary to open and operate. In many countries, bribery is a common way of getting business done, and there can be tremendous pressure from local agents or franchisee candidates to follow regional customs and use bribes to become or remain competitive. Even if it is not the U.S. franchisor’s own employees that engage in the FCPA violations, the U.S. franchisor will still face the risk of an enforcement action if the franchisee’s employees engage in such conduct. Three key takeaways:  Franchises can bring an unexpected level of FCPA exposure. Franchisors must have more than financial vetting for potential franchisees. Use your compliance tool kit for business ventures in managing the FCPA risk for franchises. Learn more about your ad choices. Visit megaphone.fm/adchoices Most franchisors have thorough financial vetting requirements before allowing any person or business to become a franchisee. However, how many of these same businesses perform compliance due diligence on their prospective overseas franchises? How many U.S. franchisors have compliance training programs? How many evaluate, on an ongoing basis, the compliance program of their overseas franchisees? How many U.S. franchisors have a compliance hotline or other reporting mechanism for any compliance violations made against their franchisees? 

Some issues include health and wage compliance officials who may appear during routine health inspections or local wage and hour compliance determinations; intellectual property officials, as maintaining intellectual property rights is critical for any franchise model; utility officials as every franchise operation needs power maintained; and government procurement officials if the franchise is selling to a foreign government or state owned enterprise.

How would all of this play out for a franchisor? As a franchisor moves into foreign markets there could well be the temptation to “grease the skids” and make payments or offer gifts to government officials, or their family members, to get the permits or permissions necessary to open and operate. In many countries, bribery is a common way of getting business done, and there can be tremendous pressure from local agents or franchisee candidates to follow regional customs and use bribes to become or remain competitive. Even if it is not the U.S. franchisor’s own employees that engage in the FCPA violations, the U.S. franchisor will still face the risk of an enforcement action if the franchisee’s employees engage in such conduct.

Three key takeaways: 

  1. Franchises can bring an unexpected level of FCPA exposure.
  2. Franchisors must have more than financial vetting for potential franchisees.
  3. Use your compliance tool kit for business ventures in managing the FCPA risk for franchises.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 695 no Franchisor liability There remains a question about franchisor liability under the FCPA. Franchising has been a successful model in the U.S. and now many corporations are looking at overseas expansion opportunities. Franchise law has become well developed across the U.S., with many states developing laws to protect the rights and obligations of both parties in a franchise agreement.  There are no reported FCPA enforcement actions regarding franchisors. However, the factors in a franchise relationship would appear to lead to clear FCPA responsibility of the franchisor for its overseas franchisee’s actions. Additionally, court interpretation of the FCPA has held that it is applicable where conduct is used “to obtain or retain business or secure an improper business advantage” which can cover almost any kind of advantage, including indirect monetary advantage even as nebulous as reputational advantage. As everyone knows, the FCPA prohibits payments to foreign officials to obtain or retain business or secure an improper business advantage. Nevertheless, many U.S. companies view franchisees as different from other types of more direct sales representatives, such as company sales representatives, agents, resellers or even JV partners, for the purposes of FCPA liability. The Master Franchise model is typically the most used model in international franchise expansion. It generally revolves around a Master Franchise agreement between the U.S. based franchisor and a franchisee in a specific geographic territory. This franchisee then contracts with third-party sub-franchisees within the specified territory. Typically, the U.S.-based franchisor will have no contractual relationship with the international sub-franchisees. The master franchisee acts as the franchisor in the local market and recruits, trains, and provides other support in the local area on behalf of the U.S. franchisor. Here the FCPA exposure is both direct and indirect. While some believe that a franchisor may not have direct involvement in conduct prohibited by the FCPA, as there may not be the requisite corrupt intent required under the statute. However, unless a franchisor has an adequate compliance program in place, a franchisor may well find itself in the shoes of Frederic Bourke and sustain a finding of conscious indifference. Three key takeaways:  Consider the different types of international franchise agreements to help assess your compliance risk.  There are no reported FCPA enforcement actions involving international franchisors, yet. Franchisors must conduct thorough research in both the foreign market they hope to enter and on their potential franchisees. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 26 Oct 2020 17:00:00 -0000 Franchisor liability full Thomas Fox What is potential franchisor under the FCPA? More than you might think. Find out more in today's 31 Days to a More Effective Compliance Program. There remains a question about franchisor liability under the FCPA. Franchising has been a successful model in the U.S. and now many corporations are looking at overseas expansion opportunities. Franchise law has become well developed across the U.S., with many states developing laws to protect the rights and obligations of both parties in a franchise agreement.  There are no reported FCPA enforcement actions regarding franchisors. However, the factors in a franchise relationship would appear to lead to clear FCPA responsibility of the franchisor for its overseas franchisee’s actions. Additionally, court interpretation of the FCPA has held that it is applicable where conduct is used “to obtain or retain business or secure an improper business advantage” which can cover almost any kind of advantage, including indirect monetary advantage even as nebulous as reputational advantage. As everyone knows, the FCPA prohibits payments to foreign officials to obtain or retain business or secure an improper business advantage. Nevertheless, many U.S. companies view franchisees as different from other types of more direct sales representatives, such as company sales representatives, agents, resellers or even JV partners, for the purposes of FCPA liability. The Master Franchise model is typically the most used model in international franchise expansion. It generally revolves around a Master Franchise agreement between the U.S. based franchisor and a franchisee in a specific geographic territory. This franchisee then contracts with third-party sub-franchisees within the specified territory. Typically, the U.S.-based franchisor will have no contractual relationship with the international sub-franchisees. The master franchisee acts as the franchisor in the local market and recruits, trains, and provides other support in the local area on behalf of the U.S. franchisor. Here the FCPA exposure is both direct and indirect. While some believe that a franchisor may not have direct involvement in conduct prohibited by the FCPA, as there may not be the requisite corrupt intent required under the statute. However, unless a franchisor has an adequate compliance program in place, a franchisor may well find itself in the shoes of Frederic Bourke and sustain a finding of conscious indifference. Three key takeaways:  Consider the different types of international franchise agreements to help assess your compliance risk.  There are no reported FCPA enforcement actions involving international franchisors, yet. Franchisors must conduct thorough research in both the foreign market they hope to enter and on their potential franchisees. Learn more about your ad choices. Visit megaphone.fm/adchoices There remains a question about franchisor liability under the FCPA. Franchising has been a successful model in the U.S. and now many corporations are looking at overseas expansion opportunities. Franchise law has become well developed across the U.S., with many states developing laws to protect the rights and obligations of both parties in a franchise agreement. 

There are no reported FCPA enforcement actions regarding franchisors. However, the factors in a franchise relationship would appear to lead to clear FCPA responsibility of the franchisor for its overseas franchisee’s actions. Additionally, court interpretation of the FCPA has held that it is applicable where conduct is used “to obtain or retain business or secure an improper business advantage” which can cover almost any kind of advantage, including indirect monetary advantage even as nebulous as reputational advantage. As everyone knows, the FCPA prohibits payments to foreign officials to obtain or retain business or secure an improper business advantage. Nevertheless, many U.S. companies view franchisees as different from other types of more direct sales representatives, such as company sales representatives, agents, resellers or even JV partners, for the purposes of FCPA liability.

The Master Franchise model is typically the most used model in international franchise expansion. It generally revolves around a Master Franchise agreement between the U.S. based franchisor and a franchisee in a specific geographic territory. This franchisee then contracts with third-party sub-franchisees within the specified territory. Typically, the U.S.-based franchisor will have no contractual relationship with the international sub-franchisees. The master franchisee acts as the franchisor in the local market and recruits, trains, and provides other support in the local area on behalf of the U.S. franchisor. Here the FCPA exposure is both direct and indirect.

While some believe that a franchisor may not have direct involvement in conduct prohibited by the FCPA, as there may not be the requisite corrupt intent required under the statute. However, unless a franchisor has an adequate compliance program in place, a franchisor may well find itself in the shoes of Frederic Bourke and sustain a finding of conscious indifference.

Three key takeaways: 

  1. Consider the different types of international franchise agreements to help assess your compliance risk. 
  2. There are no reported FCPA enforcement actions involving international franchisors, yet.
  3. Franchisors must conduct thorough research in both the foreign market they hope to enter and on their potential franchisees.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 647 no Distributors as business venture partners Many compliance practitioners generally view distributors as a part of their third-party risk management program, with most of their attention on the pre-contract phase of the risk management process. Typically, most of the efforts are spent on due diligence with less on managing the relationship after the contract is signed. However, many facets of a corporate relationship with a distributor are closer to those of other business venture partners.  One of the issues in any compliance program is the compensation paid to a business venture partner as FCPA exposure arises when companies pay money - either directly or indirectly - to fund bribe payments. In the traditional intermediary scenario, the company funnels money to a business venture partner, who then passes on some or all of it to the bribe recipient. Often, the payment is disguised. Rethinking approaches to evaluating distributor activities is but one of the ways that the increased number of enforcement actions, 2020 FCPA Resource Guide, 2nd edition and DOJ’s 2020 Update to the Evaluation of Corporate Compliance Programs, have provided insight into how the government interprets and enforces the FCPA. This information, in turn, allows companies to get smarter about FCPA compliance. With a manageable amount of forethought, companies who rely on distributors can create, install and maintain systems which allow them to spend fewer resources to more effectively prevent violations. Moreover, these systems generate tangible proof of a company’s genuine commitment to FCPA compliance, by more fully operationalizing this aspect of their compliance program. Many companies have been involved in FCPA enforcement actions because of distributors. This sales side channel does not receive the focus equal to that of commissioned sales agents. Yet it can present an equally large compliance risk. By using this DAR approach, you will have created a well-thought out process which will operationalize your compliance program around distributor compensation, in a manner which documents your decision-making calculus. Three key takeaways:  The creation of well-thought out process which operationalizes your compliance program around distributor compensation, in a manner which documents your decision-making calculus is key. Require multiple levels of approval for an out of range distributor discount. Tracking distributor discounts globally makes your company more efficient. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 23 Oct 2020 17:00:00 -0000 Distributors as business venture partners full Thomas Fox Do you consider you distributors as business venture partners? Find out why you should on this episode of 31 Days to a More Effective Compliance Program. Many compliance practitioners generally view distributors as a part of their third-party risk management program, with most of their attention on the pre-contract phase of the risk management process. Typically, most of the efforts are spent on due diligence with less on managing the relationship after the contract is signed. However, many facets of a corporate relationship with a distributor are closer to those of other business venture partners.  One of the issues in any compliance program is the compensation paid to a business venture partner as FCPA exposure arises when companies pay money - either directly or indirectly - to fund bribe payments. In the traditional intermediary scenario, the company funnels money to a business venture partner, who then passes on some or all of it to the bribe recipient. Often, the payment is disguised. Rethinking approaches to evaluating distributor activities is but one of the ways that the increased number of enforcement actions, 2020 FCPA Resource Guide, 2nd edition and DOJ’s 2020 Update to the Evaluation of Corporate Compliance Programs, have provided insight into how the government interprets and enforces the FCPA. This information, in turn, allows companies to get smarter about FCPA compliance. With a manageable amount of forethought, companies who rely on distributors can create, install and maintain systems which allow them to spend fewer resources to more effectively prevent violations. Moreover, these systems generate tangible proof of a company’s genuine commitment to FCPA compliance, by more fully operationalizing this aspect of their compliance program. Many companies have been involved in FCPA enforcement actions because of distributors. This sales side channel does not receive the focus equal to that of commissioned sales agents. Yet it can present an equally large compliance risk. By using this DAR approach, you will have created a well-thought out process which will operationalize your compliance program around distributor compensation, in a manner which documents your decision-making calculus. Three key takeaways:  The creation of well-thought out process which operationalizes your compliance program around distributor compensation, in a manner which documents your decision-making calculus is key. Require multiple levels of approval for an out of range distributor discount. Tracking distributor discounts globally makes your company more efficient. Learn more about your ad choices. Visit megaphone.fm/adchoices Many compliance practitioners generally view distributors as a part of their third-party risk management program, with most of their attention on the pre-contract phase of the risk management process. Typically, most of the efforts are spent on due diligence with less on managing the relationship after the contract is signed. However, many facets of a corporate relationship with a distributor are closer to those of other business venture partners. 

One of the issues in any compliance program is the compensation paid to a business venture partner as FCPA exposure arises when companies pay money - either directly or indirectly - to fund bribe payments. In the traditional intermediary scenario, the company funnels money to a business venture partner, who then passes on some or all of it to the bribe recipient. Often, the payment is disguised. Rethinking approaches to evaluating distributor activities is but one of the ways that the increased number of enforcement actions, 2020 FCPA Resource Guide, 2nd edition and DOJ’s 2020 Update to the Evaluation of Corporate Compliance Programs, have provided insight into how the government interprets and enforces the FCPA. This information, in turn, allows companies to get smarter about FCPA compliance. With a manageable amount of forethought, companies who rely on distributors can create, install and maintain systems which allow them to spend fewer resources to more effectively prevent violations. Moreover, these systems generate tangible proof of a company’s genuine commitment to FCPA compliance, by more fully operationalizing this aspect of their compliance program.

Many companies have been involved in FCPA enforcement actions because of distributors. This sales side channel does not receive the focus equal to that of commissioned sales agents. Yet it can present an equally large compliance risk. By using this DAR approach, you will have created a well-thought out process which will operationalize your compliance program around distributor compensation, in a manner which documents your decision-making calculus.

Three key takeaways: 

  1. The creation of well-thought out process which operationalizes your compliance program around distributor compensation, in a manner which documents your decision-making calculus is key.
  2. Require multiple levels of approval for an out of range distributor discount.
  3. Tracking distributor discounts globally makes your company more efficient.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 664 no Financial review of your business venture partner One area not usually considered around your business ventures is the financial health of JV partner, teaming partner, strategic partner or any other type of business partner or relationship which might occur in a business venture. It turns out such an oversight may have some significant ramifications for an accurate picture of a business venture partner. The financial health of a business venture partner as not only a key metric but also a key tool which allows a more robust assessment prior to contract signing and in managing the relationship after the contract has been signed.  A business venture partner which is in a weakened financial position can come back to damage your business in a variety of ways. Obviously, a company which is under financial strain is more susceptible to cutting corners to obtain business. You can almost begin to see the fraud triangle forming at this point and a rationalization for committing a FCPA violation forming in the mind of a business venture partner. Continuous improvement through monitoring of ongoing financial health is a tool where technological solutions can have an impact. Understanding the financial viability of third-parties can help the compliance practitioner meet the DOJ requirement to more fully operationalize a compliance program. It can also lead to more and better operational stability and with that ever-sought increase in corporate profitability. As compliance moves into the business process, this type of review should become part of your compliance toolkit going forward. Three key takeaways:  What is the financial health of your business venture partners? Do you even know? Poor financial results can open a business venture partner to engaging in risky behavior. Financial health monitoring is key for monitoring business venture partners. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 22 Oct 2020 17:00:00 -0000 Financial review of your business venture partner full Thomas Fox Why is the financial review of your business venture partners so critical? Find out in today's 31 Days to a More Effective Compliance Program. One area not usually considered around your business ventures is the financial health of JV partner, teaming partner, strategic partner or any other type of business partner or relationship which might occur in a business venture. It turns out such an oversight may have some significant ramifications for an accurate picture of a business venture partner. The financial health of a business venture partner as not only a key metric but also a key tool which allows a more robust assessment prior to contract signing and in managing the relationship after the contract has been signed.  A business venture partner which is in a weakened financial position can come back to damage your business in a variety of ways. Obviously, a company which is under financial strain is more susceptible to cutting corners to obtain business. You can almost begin to see the fraud triangle forming at this point and a rationalization for committing a FCPA violation forming in the mind of a business venture partner. Continuous improvement through monitoring of ongoing financial health is a tool where technological solutions can have an impact. Understanding the financial viability of third-parties can help the compliance practitioner meet the DOJ requirement to more fully operationalize a compliance program. It can also lead to more and better operational stability and with that ever-sought increase in corporate profitability. As compliance moves into the business process, this type of review should become part of your compliance toolkit going forward. Three key takeaways:  What is the financial health of your business venture partners? Do you even know? Poor financial results can open a business venture partner to engaging in risky behavior. Financial health monitoring is key for monitoring business venture partners. Learn more about your ad choices. Visit megaphone.fm/adchoices One area not usually considered around your business ventures is the financial health of JV partner, teaming partner, strategic partner or any other type of business partner or relationship which might occur in a business venture. It turns out such an oversight may have some significant ramifications for an accurate picture of a business venture partner. The financial health of a business venture partner as not only a key metric but also a key tool which allows a more robust assessment prior to contract signing and in managing the relationship after the contract has been signed. 

A business venture partner which is in a weakened financial position can come back to damage your business in a variety of ways. Obviously, a company which is under financial strain is more susceptible to cutting corners to obtain business. You can almost begin to see the fraud triangle forming at this point and a rationalization for committing a FCPA violation forming in the mind of a business venture partner.

Continuous improvement through monitoring of ongoing financial health is a tool where technological solutions can have an impact. Understanding the financial viability of third-parties can help the compliance practitioner meet the DOJ requirement to more fully operationalize a compliance program. It can also lead to more and better operational stability and with that ever-sought increase in corporate profitability. As compliance moves into the business process, this type of review should become part of your compliance toolkit going forward.

Three key takeaways: 

  1. What is the financial health of your business venture partners? Do you even know?
  2. Poor financial results can open a business venture partner to engaging in risky behavior.
  3. Financial health monitoring is key for monitoring business venture partners.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 596 no The Corp Controller and Business Ventures One area not often considered by the CCO as a key part of any compliance regime is the Corporate Controller. The Controller generally has the responsibility to accurately record and report the financial transactions of the company, to design, implement and execute the financial processes and controls of the company to be both effective and efficient, and to safeguard the financial assets of the company. Some of the compliance responsibilities of the Controller include: 1) Designing and implementing internal controls that impact ethics and compliance risks; 2) Accurately recording the financial transactions of the company; and 3) Preventing and detecting fraudulent activity. All of this means, in practical terms the Controller is both being the keeper of the books and records and the implementer of internal controls. Moreover, while many of these internal controls would most probably be viewed financial internal controls, there are additional internal controls which are not financial in nature.  Russ Berland, Chief Integrity & Risk Officer at Aventiv Technologies, has noted, “Those guys live really in the battle zone. They are constantly looking at financial transactions. They’re evaluating them. They’re figuring out where things go within the books and records. They are implementing the processes that should be keeping fraud from happening; keeping bribery and corruption from happening.” These benefits are not a one-way street for compliance as a Controller benefits from a closer relationship with the corporate compliance function as well. They can leverage compliance resources. The compliance function can bring its observations and insights from investigations and emerging risks to the Controller. A closer collaboration will broaden awareness of compliance risks which relate to the company’s financial processes. By more fully integrating compliance into the Controller function a more robust picture of enterprise risk emerges, one which encompasses legal, compliance, ethics, internal controls, financial, business and governance risks. Three key takeaways:  CCOs need to integrate the function of the Controller into their compliance regime. Offshore payments must be flagged for further investigations. The Controller is both the keeper of the books and records and the implementer of internal controls. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 21 Oct 2020 17:00:00 -0000 The Corp Controller and Business Ventures full Thomas Fox How can the Corporate Controller be a key to risk management in business ventures? Find out in today's 31 Day's to a More Effective Compliance Program. One area not often considered by the CCO as a key part of any compliance regime is the Corporate Controller. The Controller generally has the responsibility to accurately record and report the financial transactions of the company, to design, implement and execute the financial processes and controls of the company to be both effective and efficient, and to safeguard the financial assets of the company. Some of the compliance responsibilities of the Controller include: 1) Designing and implementing internal controls that impact ethics and compliance risks; 2) Accurately recording the financial transactions of the company; and 3) Preventing and detecting fraudulent activity. All of this means, in practical terms the Controller is both being the keeper of the books and records and the implementer of internal controls. Moreover, while many of these internal controls would most probably be viewed financial internal controls, there are additional internal controls which are not financial in nature.  Russ Berland, Chief Integrity & Risk Officer at Aventiv Technologies, has noted, “Those guys live really in the battle zone. They are constantly looking at financial transactions. They’re evaluating them. They’re figuring out where things go within the books and records. They are implementing the processes that should be keeping fraud from happening; keeping bribery and corruption from happening.” These benefits are not a one-way street for compliance as a Controller benefits from a closer relationship with the corporate compliance function as well. They can leverage compliance resources. The compliance function can bring its observations and insights from investigations and emerging risks to the Controller. A closer collaboration will broaden awareness of compliance risks which relate to the company’s financial processes. By more fully integrating compliance into the Controller function a more robust picture of enterprise risk emerges, one which encompasses legal, compliance, ethics, internal controls, financial, business and governance risks. Three key takeaways:  CCOs need to integrate the function of the Controller into their compliance regime. Offshore payments must be flagged for further investigations. The Controller is both the keeper of the books and records and the implementer of internal controls. Learn more about your ad choices. Visit megaphone.fm/adchoices One area not often considered by the CCO as a key part of any compliance regime is the Corporate Controller. The Controller generally has the responsibility to accurately record and report the financial transactions of the company, to design, implement and execute the financial processes and controls of the company to be both effective and efficient, and to safeguard the financial assets of the company. Some of the compliance responsibilities of the Controller include: 1) Designing and implementing internal controls that impact ethics and compliance risks; 2) Accurately recording the financial transactions of the company; and 3) Preventing and detecting fraudulent activity. All of this means, in practical terms the Controller is both being the keeper of the books and records and the implementer of internal controls. Moreover, while many of these internal controls would most probably be viewed financial internal controls, there are additional internal controls which are not financial in nature. 

Russ Berland, Chief Integrity & Risk Officer at Aventiv Technologies, has noted, “Those guys live really in the battle zone. They are constantly looking at financial transactions. They’re evaluating them. They’re figuring out where things go within the books and records. They are implementing the processes that should be keeping fraud from happening; keeping bribery and corruption from happening.”

These benefits are not a one-way street for compliance as a Controller benefits from a closer relationship with the corporate compliance function as well. They can leverage compliance resources. The compliance function can bring its observations and insights from investigations and emerging risks to the Controller. A closer collaboration will broaden awareness of compliance risks which relate to the company’s financial processes. By more fully integrating compliance into the Controller function a more robust picture of enterprise risk emerges, one which encompasses legal, compliance, ethics, internal controls, financial, business and governance risks.

Three key takeaways: 

  1. CCOs need to integrate the function of the Controller into their compliance regime.
  2. Offshore payments must be flagged for further investigations.
  3. The Controller is both the keeper of the books and records and the implementer of internal controls.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 632 no Know Your Customer Do FCPA considerations come into play for customers? How should you think about your obligations under the FCPA for a group not traditionally associated with FCPA liability or even FCPA risk? These questions and perhaps others are raised by the 2015 FCPA investigation into certain transactions in Venezuela by Derwick Associates (Derwick) and a U.S. company ProEnergy Services (ProEnergy). ProEnergy supplied turbines that Derwick resold to the Venezuelan government and then installed in that country. This investigation demonstrates why businesses need to be more concerned with not only who they do business with but how their customers might be doing business. In banking and financial services parlance, you now need to ramp up your organization’s Know Your Customer (KYC) information to continue throughout a seller-purchaser relationship, in the context of the FCPA. There does not have to be a direct bribe or other corrupt payment made by a U.S. company to have liability under the FCPA. FCPA enforcement is littered with companies that have paid bribes through third-parties. However, as the Fifth Circuit said in US v. Kay, “[W]e hold that Congress intended for the FCPA to apply broadly to payments intended to assist the payor, either directly or indirectly,” [emphasis mine]. While at first blush, ProEnergy may appear to be at the edge of potential FCPA liability; if it knew, had reason to know, or should have taken steps to know about some nefarious conduct by its customer, it does not take too many steps to get to some FCPA exposure. The FinCEN rules on customer due diligence for financial institutions are a good starting point for other commercial entities to base their compliance program for customers around. Three key takeaways:  Non-banking and non-financial service entities need to consider their KYC obligations in the context of FCPA risk. FinCEN rules on customer due diligence are a good starting point for the non-financial institution. Ongoing monitoring should be used and the information incorporated into your customer risk profile going forward. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 20 Oct 2020 17:00:00 -0000 Know Your Customer full Thomas Fox Why is know your customer becoming more important in the business venture context? Find out on this episode of 31 Days to a More Effective Compliance Program. Do FCPA considerations come into play for customers? How should you think about your obligations under the FCPA for a group not traditionally associated with FCPA liability or even FCPA risk? These questions and perhaps others are raised by the 2015 FCPA investigation into certain transactions in Venezuela by Derwick Associates (Derwick) and a U.S. company ProEnergy Services (ProEnergy). ProEnergy supplied turbines that Derwick resold to the Venezuelan government and then installed in that country. This investigation demonstrates why businesses need to be more concerned with not only who they do business with but how their customers might be doing business. In banking and financial services parlance, you now need to ramp up your organization’s Know Your Customer (KYC) information to continue throughout a seller-purchaser relationship, in the context of the FCPA. There does not have to be a direct bribe or other corrupt payment made by a U.S. company to have liability under the FCPA. FCPA enforcement is littered with companies that have paid bribes through third-parties. However, as the Fifth Circuit said in US v. Kay, “[W]e hold that Congress intended for the FCPA to apply broadly to payments intended to assist the payor, either directly or indirectly,” [emphasis mine]. While at first blush, ProEnergy may appear to be at the edge of potential FCPA liability; if it knew, had reason to know, or should have taken steps to know about some nefarious conduct by its customer, it does not take too many steps to get to some FCPA exposure. The FinCEN rules on customer due diligence for financial institutions are a good starting point for other commercial entities to base their compliance program for customers around. Three key takeaways:  Non-banking and non-financial service entities need to consider their KYC obligations in the context of FCPA risk. FinCEN rules on customer due diligence are a good starting point for the non-financial institution. Ongoing monitoring should be used and the information incorporated into your customer risk profile going forward. Learn more about your ad choices. Visit megaphone.fm/adchoices Do FCPA considerations come into play for customers? How should you think about your obligations under the FCPA for a group not traditionally associated with FCPA liability or even FCPA risk? These questions and perhaps others are raised by the 2015 FCPA investigation into certain transactions in Venezuela by Derwick Associates (Derwick) and a U.S. company ProEnergy Services (ProEnergy). ProEnergy supplied turbines that Derwick resold to the Venezuelan government and then installed in that country. This investigation demonstrates why businesses need to be more concerned with not only who they do business with but how their customers might be doing business. In banking and financial services parlance, you now need to ramp up your organization’s Know Your Customer (KYC) information to continue throughout a seller-purchaser relationship, in the context of the FCPA.

There does not have to be a direct bribe or other corrupt payment made by a U.S. company to have liability under the FCPA. FCPA enforcement is littered with companies that have paid bribes through third-parties. However, as the Fifth Circuit said in US v. Kay, “[W]e hold that Congress intended for the FCPA to apply broadly to payments intended to assist the payor, either directly or indirectly,” [emphasis mine]. While at first blush, ProEnergy may appear to be at the edge of potential FCPA liability; if it knew, had reason to know, or should have taken steps to know about some nefarious conduct by its customer, it does not take too many steps to get to some FCPA exposure. The FinCEN rules on customer due diligence for financial institutions are a good starting point for other commercial entities to base their compliance program for customers around.

Three key takeaways: 

  1. Non-banking and non-financial service entities need to consider their KYC obligations in the context of FCPA risk.
  2. FinCEN rules on customer due diligence are a good starting point for the non-financial institution.
  3. Ongoing monitoring should be used and the information incorporated into your customer risk profile going forward.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 608 no Tying it all together for JVs I want to emphasize again the risks JVs pose under the FCPA. Mike Volkov has stated, “A joint venture requires the integration of disparate company cultures. It can be successful and is usually one of the significant reason for the joint venture itself.” Both parties should assess each other and decide that the JV is a good fit, meaning that each side will benefit. Too much time is spent on looking at the JV partner’s compliance toolbox (i.e., policies, procedures, and controls), and not enough time is spent on identifying compliance strengths and weaknesses. You must bring it all together with one format. Indeed the 2020 Update to the Evaluation of Corporate Compliance Programs posed the following questions under the category, “Process Connecting Due Diligence to Implementation” What has been the company’s process for tracking and remediating misconduct or misconduct risks identified during the due diligence process? What has been the company’s process for implementing compliance policies and procedures, and conducting post- acquisition audits, at newly acquired entities? Remember a “newly acquired entity” can be a joint venture. Three key takeaways:  It all starts with a Relationship Manager. Have company oversight of all JVs. Couple this with a COC for a second set of eyes. Audit, monitor, and remediate (as appropriate) your JVs on an ongoing basis. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 19 Oct 2020 17:00:00 -0000 Tying it all together for JVs full Thomas Fox In this episode, I tie together the risk and risk management strategies for Joint Ventures under the FCPA. In this edition of 31 Days to a More Effective Compliance Program. I want to emphasize again the risks JVs pose under the FCPA. Mike Volkov has stated, “A joint venture requires the integration of disparate company cultures. It can be successful and is usually one of the significant reason for the joint venture itself.” Both parties should assess each other and decide that the JV is a good fit, meaning that each side will benefit. Too much time is spent on looking at the JV partner’s compliance toolbox (i.e., policies, procedures, and controls), and not enough time is spent on identifying compliance strengths and weaknesses. You must bring it all together with one format. Indeed the 2020 Update to the Evaluation of Corporate Compliance Programs posed the following questions under the category, “Process Connecting Due Diligence to Implementation” What has been the company’s process for tracking and remediating misconduct or misconduct risks identified during the due diligence process? What has been the company’s process for implementing compliance policies and procedures, and conducting post- acquisition audits, at newly acquired entities? Remember a “newly acquired entity” can be a joint venture. Three key takeaways:  It all starts with a Relationship Manager. Have company oversight of all JVs. Couple this with a COC for a second set of eyes. Audit, monitor, and remediate (as appropriate) your JVs on an ongoing basis. Learn more about your ad choices. Visit megaphone.fm/adchoices I want to emphasize again the risks JVs pose under the FCPA. Mike Volkov has stated, “A joint venture requires the integration of disparate company cultures. It can be successful and is usually one of the significant reason for the joint venture itself.” Both parties should assess each other and decide that the JV is a good fit, meaning that each side will benefit. Too much time is spent on looking at the JV partner’s compliance toolbox (i.e., policies, procedures, and controls), and not enough time is spent on identifying compliance strengths and weaknesses. You must bring it all together with one format.

Indeed the 2020 Update to the Evaluation of Corporate Compliance Programs posed the following questions under the category, “Process Connecting Due Diligence to Implementation” What has been the company’s process for tracking and remediating misconduct or misconduct risks identified during the due diligence process? What has been the company’s process for implementing compliance policies and procedures, and conducting post- acquisition audits, at newly acquired entities? Remember a “newly acquired entity” can be a joint venture.

Three key takeaways: 

  1. It all starts with a Relationship Manager.
  2. Have company oversight of all JVs. Couple this with a COC for a second set of eyes.
  3. Audit, monitor, and remediate (as appropriate) your JVs on an ongoing basis.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 566 no Post-acquisition integration plan Your company has just made its largest acquisition ever and your CEO says that he wants you to have a compliance post-acquisition integration plan on his desk in one week. Where do you begin? Of course, you think about the 2020 FCPA Resource Guide, 2nd edition but you also remember that the established time frames in the enforcement actions involving Johnson & Johnson (J&J), Pfizer Inc. and DS&S and the Halliburton Opinion Release.  While there are time frames listed in these DPAs, they are a guide of timeframes, not a ‘how to’ guide and many compliance professionals struggle with how to perform these post-acquisition compliance integrations. The 2020 Update to the Evaluation of Corporate Compliance Programs asked the following questions, What has been the company’s process for tracking and remediating misconduct or misconduct risks identified during the due diligence process? What has been the company’s process for implementing compliance policies and procedures, and conducting post- acquisition audits, at newly acquired entities? Whatever compendium of steps you utilize for post-acquisition integration, they should be taken as soon as practicable. Three key takeaways:  Planning is critical in the post-acquisition phase. Build upon what you learned in pre-acquisition due diligence. You need to be ready to hit the ground running when a transaction closes. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 16 Oct 2020 17:00:00 -0000 Post-acquisition integration plan full Thomas Fox What is your post acquisition integration plan? Find out why having one is so critical in this episode of 31 Days to a More Effective Compliance Program. Your company has just made its largest acquisition ever and your CEO says that he wants you to have a compliance post-acquisition integration plan on his desk in one week. Where do you begin? Of course, you think about the 2020 FCPA Resource Guide, 2nd edition but you also remember that the established time frames in the enforcement actions involving Johnson & Johnson (J&J), Pfizer Inc. and DS&S and the Halliburton Opinion Release.  While there are time frames listed in these DPAs, they are a guide of timeframes, not a ‘how to’ guide and many compliance professionals struggle with how to perform these post-acquisition compliance integrations. The 2020 Update to the Evaluation of Corporate Compliance Programs asked the following questions, What has been the company’s process for tracking and remediating misconduct or misconduct risks identified during the due diligence process? What has been the company’s process for implementing compliance policies and procedures, and conducting post- acquisition audits, at newly acquired entities? Whatever compendium of steps you utilize for post-acquisition integration, they should be taken as soon as practicable. Three key takeaways:  Planning is critical in the post-acquisition phase. Build upon what you learned in pre-acquisition due diligence. You need to be ready to hit the ground running when a transaction closes. Learn more about your ad choices. Visit megaphone.fm/adchoices Your company has just made its largest acquisition ever and your CEO says that he wants you to have a compliance post-acquisition integration plan on his desk in one week. Where do you begin? Of course, you think about the 2020 FCPA Resource Guide, 2nd edition but you also remember that the established time frames in the enforcement actions involving Johnson & Johnson (J&J), Pfizer Inc. and DS&S and the Halliburton Opinion Release. 

While there are time frames listed in these DPAs, they are a guide of timeframes, not a ‘how to’ guide and many compliance professionals struggle with how to perform these post-acquisition compliance integrations. The 2020 Update to the Evaluation of Corporate Compliance Programs asked the following questions, What has been the company’s process for tracking and remediating misconduct or misconduct risks identified during the due diligence process? What has been the company’s process for implementing compliance policies and procedures, and conducting post- acquisition audits, at newly acquired entities?

Whatever compendium of steps you utilize for post-acquisition integration, they should be taken as soon as practicable.

Three key takeaways: 

  1. Planning is critical in the post-acquisition phase.
  2. Build upon what you learned in pre-acquisition due diligence.
  3. You need to be ready to hit the ground running when a transaction closes.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 710 no Pre-acquisition due diligence The compliance component of your M&A regime should begin with a preliminary pre-acquisition assessment of risk. Such an early assessment will inform the transaction research and evaluation phases. This could include an objective view of the risks faced and the level of risk exposure, such as best/worst case scenarios. A pre-acquisition risk assessment could also be used as a “lens through which to view the feasibility of the business strategy” and help to value the potential target.  I suggest a four-step process to plan and execute a strategy to perform pre-acquisition due diligence in the M&A context. Establish a point of contact. Collect relevant documents.  Review the compliance and ethics mission and goals.  Review the elements of an effective compliance program. There are multiple red flags which could be raised in this process, which might well warrant further investigation. They include if the target has ineffective compliance program elements in their compliance program or if there were frequent breach of policies and procedures. Obviously, a target which is in financial difficulty would bear closer scrutiny. Structurally, if the company did not have a formal ethics and compliance committee at the senior management or Board of Directors’ level, this could present issues. From the CCO perspective, if the position did not have Board or CEO access or if there were not regular reports to the Board, it could present an issue for compliance. Conversely, if there were frequent requests to waive policies, management over-ride of compliance controls or no consistent consequence management for violations; it could present clear red flags for further investigation. Three key takeaways:  The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward. Periodically review your M&A due diligence protocol. If red flags appear in pre-acquisition due diligence, they should be cleared. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 15 Oct 2020 17:00:00 -0000 Pre-acquisition due diligence full Thomas Fox A pre-acquisition risk assessment could also be used as a “lens through which to view the feasibility of the business strategy” and help to value the potential target. The compliance component of your M&A regime should begin with a preliminary pre-acquisition assessment of risk. Such an early assessment will inform the transaction research and evaluation phases. This could include an objective view of the risks faced and the level of risk exposure, such as best/worst case scenarios. A pre-acquisition risk assessment could also be used as a “lens through which to view the feasibility of the business strategy” and help to value the potential target.  I suggest a four-step process to plan and execute a strategy to perform pre-acquisition due diligence in the M&A context. Establish a point of contact. Collect relevant documents.  Review the compliance and ethics mission and goals.  Review the elements of an effective compliance program. There are multiple red flags which could be raised in this process, which might well warrant further investigation. They include if the target has ineffective compliance program elements in their compliance program or if there were frequent breach of policies and procedures. Obviously, a target which is in financial difficulty would bear closer scrutiny. Structurally, if the company did not have a formal ethics and compliance committee at the senior management or Board of Directors’ level, this could present issues. From the CCO perspective, if the position did not have Board or CEO access or if there were not regular reports to the Board, it could present an issue for compliance. Conversely, if there were frequent requests to waive policies, management over-ride of compliance controls or no consistent consequence management for violations; it could present clear red flags for further investigation. Three key takeaways:  The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward. Periodically review your M&A due diligence protocol. If red flags appear in pre-acquisition due diligence, they should be cleared. Learn more about your ad choices. Visit megaphone.fm/adchoices The compliance component of your M&A regime should begin with a preliminary pre-acquisition assessment of risk. Such an early assessment will inform the transaction research and evaluation phases. This could include an objective view of the risks faced and the level of risk exposure, such as best/worst case scenarios. A pre-acquisition risk assessment could also be used as a “lens through which to view the feasibility of the business strategy” and help to value the potential target. 

I suggest a four-step process to plan and execute a strategy to perform pre-acquisition due diligence in the M&A context.

  1. Establish a point of contact.
  2. Collect relevant documents. 
  3. Review the compliance and ethics mission and goals. 
  4. Review the elements of an effective compliance program.

There are multiple red flags which could be raised in this process, which might well warrant further investigation. They include if the target has ineffective compliance program elements in their compliance program or if there were frequent breach of policies and procedures. Obviously, a target which is in financial difficulty would bear closer scrutiny. Structurally, if the company did not have a formal ethics and compliance committee at the senior management or Board of Directors’ level, this could present issues. From the CCO perspective, if the position did not have Board or CEO access or if there were not regular reports to the Board, it could present an issue for compliance. Conversely, if there were frequent requests to waive policies, management over-ride of compliance controls or no consistent consequence management for violations; it could present clear red flags for further investigation.

Three key takeaways: 

  1. The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward.
  2. Periodically review your M&A due diligence protocol.
  3. If red flags appear in pre-acquisition due diligence, they should be cleared.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 576 no Pre-acquisition risk assessment One of the clearest themes from the original, 2012 FCPA Resource Guide was around the importance of your pre-acquisition work in any M&A on a target company. In the section on Declinations, the 2012 FCPA Resource Guide provided an example of a company which had received a declination in large part because of its pre-acquisition work, which then served as a basis of its post-acquisition remediation. I find it appropriate to think of the process as a straight line, directly from the pre-acquisition phase through to closing and then to remediation, integration and self-reporting in the post-acquisition phase. These same concepts were brought forward in the 2020 FCPA Resource Guide, 2nd edition.  It should all begin with a preliminary pre-acquisition assessment of risk. Such an early assessment will inform the transaction research and evaluation phases. This could include an objective view of the risks faced and the level of risk exposure, such as best/worst case scenarios. A pre-acquisition risk assessment could also be used as a mechanism through which to view the feasibility of the business strategy and help to value the potential target. The first step is to develop the risk assessment as a base document. From this document, you should be able to prepare a focused series of queries and requests to be obtained from the target company. Thereafter, company management can use this pre-acquisition risk assessment to attain what might be required in the way of integration, in the post-acquisition phase. It would also help to inform how the corporate and business functions may be affected. It should also assist in planning for timing and anticipation of the overall expenses involved in post-acquisition integration. These costs are not insignificant and they should be thoroughly evaluated in the decision-making calculus. The pre-acquisition risk assessment can be a critical element in any M&A work for compliance. Use this opportunity to see where the target might stand on compliance. Your risk assessment can evolve as you obtain greater information. Finally, use this pre-acquisition risk assessment as a base document to plan, resource and budget for your post-acquisition remediation, integration and reporting. Three key takeaways:  One never has enough time to engage in all of the pre-acquisition review you might want to do, so optimize your time and resources. Consider what you can review to put together a preliminary risk assessment on the target. As with most compliance initiatives, you are only limited by your imagination, so if you are limited in time and scope, try something new and different. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 14 Oct 2020 17:00:00 -0000 Pre-acquisition risk assessment full Thomas Fox What is the pre-acquisition risk assessment and how can it lead to safe harbor? Find out in this episode of 31 Days to a More Effective Compliance Program. One of the clearest themes from the original, 2012 FCPA Resource Guide was around the importance of your pre-acquisition work in any M&A on a target company. In the section on Declinations, the 2012 FCPA Resource Guide provided an example of a company which had received a declination in large part because of its pre-acquisition work, which then served as a basis of its post-acquisition remediation. I find it appropriate to think of the process as a straight line, directly from the pre-acquisition phase through to closing and then to remediation, integration and self-reporting in the post-acquisition phase. These same concepts were brought forward in the 2020 FCPA Resource Guide, 2nd edition.  It should all begin with a preliminary pre-acquisition assessment of risk. Such an early assessment will inform the transaction research and evaluation phases. This could include an objective view of the risks faced and the level of risk exposure, such as best/worst case scenarios. A pre-acquisition risk assessment could also be used as a mechanism through which to view the feasibility of the business strategy and help to value the potential target. The first step is to develop the risk assessment as a base document. From this document, you should be able to prepare a focused series of queries and requests to be obtained from the target company. Thereafter, company management can use this pre-acquisition risk assessment to attain what might be required in the way of integration, in the post-acquisition phase. It would also help to inform how the corporate and business functions may be affected. It should also assist in planning for timing and anticipation of the overall expenses involved in post-acquisition integration. These costs are not insignificant and they should be thoroughly evaluated in the decision-making calculus. The pre-acquisition risk assessment can be a critical element in any M&A work for compliance. Use this opportunity to see where the target might stand on compliance. Your risk assessment can evolve as you obtain greater information. Finally, use this pre-acquisition risk assessment as a base document to plan, resource and budget for your post-acquisition remediation, integration and reporting. Three key takeaways:  One never has enough time to engage in all of the pre-acquisition review you might want to do, so optimize your time and resources. Consider what you can review to put together a preliminary risk assessment on the target. As with most compliance initiatives, you are only limited by your imagination, so if you are limited in time and scope, try something new and different. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the clearest themes from the original, 2012 FCPA Resource Guide was around the importance of your pre-acquisition work in any M&A on a target company. In the section on Declinations, the 2012 FCPA Resource Guide provided an example of a company which had received a declination in large part because of its pre-acquisition work, which then served as a basis of its post-acquisition remediation. I find it appropriate to think of the process as a straight line, directly from the pre-acquisition phase through to closing and then to remediation, integration and self-reporting in the post-acquisition phase. These same concepts were brought forward in the 2020 FCPA Resource Guide, 2nd edition. 

It should all begin with a preliminary pre-acquisition assessment of risk. Such an early assessment will inform the transaction research and evaluation phases. This could include an objective view of the risks faced and the level of risk exposure, such as best/worst case scenarios. A pre-acquisition risk assessment could also be used as a mechanism through which to view the feasibility of the business strategy and help to value the potential target.

The first step is to develop the risk assessment as a base document. From this document, you should be able to prepare a focused series of queries and requests to be obtained from the target company. Thereafter, company management can use this pre-acquisition risk assessment to attain what might be required in the way of integration, in the post-acquisition phase. It would also help to inform how the corporate and business functions may be affected. It should also assist in planning for timing and anticipation of the overall expenses involved in post-acquisition integration. These costs are not insignificant and they should be thoroughly evaluated in the decision-making calculus.

The pre-acquisition risk assessment can be a critical element in any M&A work for compliance. Use this opportunity to see where the target might stand on compliance. Your risk assessment can evolve as you obtain greater information. Finally, use this pre-acquisition risk assessment as a base document to plan, resource and budget for your post-acquisition remediation, integration and reporting.

Three key takeaways: 

  1. One never has enough time to engage in all of the pre-acquisition review you might want to do, so optimize your time and resources.
  2. Consider what you can review to put together a preliminary risk assessment on the target.
  3. As with most compliance initiatives, you are only limited by your imagination, so if you are limited in time and scope, try something new and different.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 576 no Draft Episode for Oct 13, 2020 Why should a company engage in pre-acquisition due diligence in the M&A context? Certainly, compliance with anti-corruption laws such as the FCPA or U.K. Bribery Act is a good starting point. A Transparency International white paper, entitled “Anti-Bribery Due Diligence for Transactions”, suggested that there are greater forces driving compliance than simply compliance with anti-corruption and anti-bribery laws. A company engaging in an international acquisition should also strive to avoid the potential financial and reputational damage that may arise from investing in or purchasing a company associated with bribery or corruption. Financial, legal, or reputational risk can have a significant impact the valuation or a transaction or its desirability. Factors such as current or historical bribery/corruption discovered at any point in the acquiring company provide the compliance practitioner with strong ammunition when confronted with a management that fails to understand the need for a robust due diligence in a M&A transaction. By not focusing on the regulatory aspects of M&A transactions, but more on the market reasons for engaging in the appropriate due diligence, you can emphasize the business reasons for compliance. Three key takeaways:  There are numerous legal and business reason to engage in anti-corruption due diligence in the M&A space. ESG can present significant corruption risks in emerging markets. Present your analysis in high, medium and low risk formats. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 13 Oct 2020 14:45:22 -0000 Why engage in pre-acquisition due diligence? The Business Perspective full Thomas Fox Why should a company engage in pre-acquisition due diligence in the M&A context? Find out the business reasons in this episode of 31 Days to a More Effective Compliance Program Why should a company engage in pre-acquisition due diligence in the M&A context? Certainly, compliance with anti-corruption laws such as the FCPA or U.K. Bribery Act is a good starting point. A Transparency International white paper, entitled “Anti-Bribery Due Diligence for Transactions”, suggested that there are greater forces driving compliance than simply compliance with anti-corruption and anti-bribery laws. A company engaging in an international acquisition should also strive to avoid the potential financial and reputational damage that may arise from investing in or purchasing a company associated with bribery or corruption. Financial, legal, or reputational risk can have a significant impact the valuation or a transaction or its desirability. Factors such as current or historical bribery/corruption discovered at any point in the acquiring company provide the compliance practitioner with strong ammunition when confronted with a management that fails to understand the need for a robust due diligence in a M&A transaction. By not focusing on the regulatory aspects of M&A transactions, but more on the market reasons for engaging in the appropriate due diligence, you can emphasize the business reasons for compliance. Three key takeaways:  There are numerous legal and business reason to engage in anti-corruption due diligence in the M&A space. ESG can present significant corruption risks in emerging markets. Present your analysis in high, medium and low risk formats. Learn more about your ad choices. Visit megaphone.fm/adchoices Why should a company engage in pre-acquisition due diligence in the M&A context? Certainly, compliance with anti-corruption laws such as the FCPA or U.K. Bribery Act is a good starting point. A Transparency International white paper, entitled “Anti-Bribery Due Diligence for Transactions”, suggested that there are greater forces driving compliance than simply compliance with anti-corruption and anti-bribery laws. A company engaging in an international acquisition should also strive to avoid the potential financial and reputational damage that may arise from investing in or purchasing a company associated with bribery or corruption.

Financial, legal, or reputational risk can have a significant impact the valuation or a transaction or its desirability. Factors such as current or historical bribery/corruption discovered at any point in the acquiring company provide the compliance practitioner with strong ammunition when confronted with a management that fails to understand the need for a robust due diligence in a M&A transaction. By not focusing on the regulatory aspects of M&A transactions, but more on the market reasons for engaging in the appropriate due diligence, you can emphasize the business reasons for compliance.

Three key takeaways: 

  1. There are numerous legal and business reason to engage in anti-corruption due diligence in the M&A space.
  2. ESG can present significant corruption risks in emerging markets.
  3. Present your analysis in high, medium and low risk formats.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 624 no Safe Harbor for Successor Liability White collar defense practitioners have long called for a specific safe harbor for companies in the mergers and acquisition context where they meet the criteria set out by the DOJ. This clarion call was answered in the summer, 2018 when in July 2018, the DOJ announced a revision to the FCPA Corporation Enforcement Policy, specifically around mergers and acquisitions. The new language read:  M&A Due Diligence and Remediation: The Department recognizes the potential benefits of corporate mergers and acquisitions, particularly when the acquiring entity has a robust compliance program in place and implements that program as quickly as practicable at the merged or acquired entity. Accordingly, where a company undertakes a merger or acquisition, uncovers misconduct through thorough and timely due diligence or, in appropriate instances, through post-acquisition audits or compliance integration efforts, and voluntarily self-discloses the misconduct and otherwise takes action consistent with this Policy (including, among other requirements, the timely implementation of an effective compliance program at the merged or acquired entity), there will be a presumption of a declination in accordance with and subject to the other requirements of this Policy. In announcing the change, then Deputy Assistant Attorney General Matthew Miner, that while the 2012 FCPA Resource Guide did provide some guidance on what may constitute a safe harbor; that word ‘may’ was a “sticking point for corporate management when deciding whether and how to proceed with a potential merger or acquisition. There is a big difference between a theoretical outcome and one that is concrete and presumptively available.” Three Key Takeaways The FCPA Corporate Enforcement Policy was amended in 2018 to provide a safe harbor in the M&A context. Pre and post-acquisition compliance work must be equally robust. If you find misconduct, report and remediate. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 12 Oct 2020 17:00:00 -0000 Safe Harbor for Successor Liability full Thomas Fox White collar defense practitioners have long called for a specific safe harbor for companies in the mergers and acquisition context. This clarion call was answered when in July 2018, the DOJ announced a safe harbor. White collar defense practitioners have long called for a specific safe harbor for companies in the mergers and acquisition context where they meet the criteria set out by the DOJ. This clarion call was answered in the summer, 2018 when in July 2018, the DOJ announced a revision to the FCPA Corporation Enforcement Policy, specifically around mergers and acquisitions. The new language read:  M&A Due Diligence and Remediation: The Department recognizes the potential benefits of corporate mergers and acquisitions, particularly when the acquiring entity has a robust compliance program in place and implements that program as quickly as practicable at the merged or acquired entity. Accordingly, where a company undertakes a merger or acquisition, uncovers misconduct through thorough and timely due diligence or, in appropriate instances, through post-acquisition audits or compliance integration efforts, and voluntarily self-discloses the misconduct and otherwise takes action consistent with this Policy (including, among other requirements, the timely implementation of an effective compliance program at the merged or acquired entity), there will be a presumption of a declination in accordance with and subject to the other requirements of this Policy. In announcing the change, then Deputy Assistant Attorney General Matthew Miner, that while the 2012 FCPA Resource Guide did provide some guidance on what may constitute a safe harbor; that word ‘may’ was a “sticking point for corporate management when deciding whether and how to proceed with a potential merger or acquisition. There is a big difference between a theoretical outcome and one that is concrete and presumptively available.” Three Key Takeaways The FCPA Corporate Enforcement Policy was amended in 2018 to provide a safe harbor in the M&A context. Pre and post-acquisition compliance work must be equally robust. If you find misconduct, report and remediate. Learn more about your ad choices. Visit megaphone.fm/adchoices White collar defense practitioners have long called for a specific safe harbor for companies in the mergers and acquisition context where they meet the criteria set out by the DOJ. This clarion call was answered in the summer, 2018 when in July 2018, the DOJ announced a revision to the FCPA Corporation Enforcement Policy, specifically around mergers and acquisitions. The new language read: 

M&A Due Diligence and Remediation: The Department recognizes the potential benefits of corporate mergers and acquisitions, particularly when the acquiring entity has a robust compliance program in place and implements that program as quickly as practicable at the merged or acquired entity. Accordingly, where a company undertakes a merger or acquisition, uncovers misconduct through thorough and timely due diligence or, in appropriate instances, through post-acquisition audits or compliance integration efforts, and voluntarily self-discloses the misconduct and otherwise takes action consistent with this Policy (including, among other requirements, the timely implementation of an effective compliance program at the merged or acquired entity), there will be a presumption of a declination in accordance with and subject to the other requirements of this Policy.

In announcing the change, then Deputy Assistant Attorney General Matthew Miner, that while the 2012 FCPA Resource Guide did provide some guidance on what may constitute a safe harbor; that word ‘may’ was a “sticking point for corporate management when deciding whether and how to proceed with a potential merger or acquisition. There is a big difference between a theoretical outcome and one that is concrete and presumptively available.”

Three Key Takeaways

  1. The FCPA Corporate Enforcement Policy was amended in 2018 to provide a safe harbor in the M&A context.
  2. Pre and post-acquisition compliance work must be equally robust.
  3. If you find misconduct, report and remediate.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 588 no Auditing Joint Ventures JVs provide many FCPA risks that other types of business relationships do not bring. For instance, the JV may interact with foreign government officials or employees of a state-owned enterprise; then leverage those relationships for an improper benefit relating to contracts, regulatory licenses, permits or customs approvals. It is difficult to regulate a JVs interaction with foreign government officials when your partner is a state-owned enterprise, or where your company is relying on the local company for its local contacts and expertise for business development and/or regulatory knowledge and experience.  The risks are compounded when the U.S. company does not exercise control of the JV. This is further compounded by the fact there is no minimum threshold for a FCPA enforcement action against a U.S. company for the actions of a JV in which it holds an interest. If a company holds something less than majority rights, it must to urge, beg and plead for the majority partner to adhere to anti-corruption compliance standards and controls. Often, these requirements are established in the JV agreement but the success in securing such contract protections depends on the importance of the global company to the JV itself. Another set of issues comes from the JV when it seeks to retain third-party agents and/or distributors. Depending on the amount of control, the U.S. company usually can impose its set of standards for conducting due diligence of third-party agents and distributors. These risks become more difficult when the JV partner brings a proposed third-party agent or distributor and vouches for the agent or distributor. If the JV partner is a state-owned enterprise, the issues become even more complicated as such a referral creates an obvious red flag for a government-sponsored referral. Now add on the fact that the JV partner may not be proficient in English as a first language. The U.S. company may not have financial personnel with requisite language skills in the foreign country. Some companies have a policy that English will be used throughout the world in its business dealings. However, even with such an English only policy in place, the risks represented by such lack of effective oversight by the multinational extend not only to potential FCPA violations, but to other corrupt acts, including kickbacks, fraud and theft. Three key takeaways:  JVs present unique FCPA risks and must be managed accordingly. Your final report needs to consider the final viewer of the document, potentially the DOJ or SEC. Be sure to follow up on any red flags raised but not cleared and action items for remediation or additional scrutiny.  Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 09 Oct 2020 17:00:00 -0000 Auditing Joint Ventures full Thomas Fox Joint Ventures present unique compliance risks and must be managed accordingly. Audit rights and their exercise are key risk management tools. JVs provide many FCPA risks that other types of business relationships do not bring. For instance, the JV may interact with foreign government officials or employees of a state-owned enterprise; then leverage those relationships for an improper benefit relating to contracts, regulatory licenses, permits or customs approvals. It is difficult to regulate a JVs interaction with foreign government officials when your partner is a state-owned enterprise, or where your company is relying on the local company for its local contacts and expertise for business development and/or regulatory knowledge and experience.  The risks are compounded when the U.S. company does not exercise control of the JV. This is further compounded by the fact there is no minimum threshold for a FCPA enforcement action against a U.S. company for the actions of a JV in which it holds an interest. If a company holds something less than majority rights, it must to urge, beg and plead for the majority partner to adhere to anti-corruption compliance standards and controls. Often, these requirements are established in the JV agreement but the success in securing such contract protections depends on the importance of the global company to the JV itself. Another set of issues comes from the JV when it seeks to retain third-party agents and/or distributors. Depending on the amount of control, the U.S. company usually can impose its set of standards for conducting due diligence of third-party agents and distributors. These risks become more difficult when the JV partner brings a proposed third-party agent or distributor and vouches for the agent or distributor. If the JV partner is a state-owned enterprise, the issues become even more complicated as such a referral creates an obvious red flag for a government-sponsored referral. Now add on the fact that the JV partner may not be proficient in English as a first language. The U.S. company may not have financial personnel with requisite language skills in the foreign country. Some companies have a policy that English will be used throughout the world in its business dealings. However, even with such an English only policy in place, the risks represented by such lack of effective oversight by the multinational extend not only to potential FCPA violations, but to other corrupt acts, including kickbacks, fraud and theft. Three key takeaways:  JVs present unique FCPA risks and must be managed accordingly. Your final report needs to consider the final viewer of the document, potentially the DOJ or SEC. Be sure to follow up on any red flags raised but not cleared and action items for remediation or additional scrutiny.  Learn more about your ad choices. Visit megaphone.fm/adchoices JVs provide many FCPA risks that other types of business relationships do not bring. For instance, the JV may interact with foreign government officials or employees of a state-owned enterprise; then leverage those relationships for an improper benefit relating to contracts, regulatory licenses, permits or customs approvals. It is difficult to regulate a JVs interaction with foreign government officials when your partner is a state-owned enterprise, or where your company is relying on the local company for its local contacts and expertise for business development and/or regulatory knowledge and experience. 

The risks are compounded when the U.S. company does not exercise control of the JV. This is further compounded by the fact there is no minimum threshold for a FCPA enforcement action against a U.S. company for the actions of a JV in which it holds an interest. If a company holds something less than majority rights, it must to urge, beg and plead for the majority partner to adhere to anti-corruption compliance standards and controls. Often, these requirements are established in the JV agreement but the success in securing such contract protections depends on the importance of the global company to the JV itself.

Another set of issues comes from the JV when it seeks to retain third-party agents and/or distributors. Depending on the amount of control, the U.S. company usually can impose its set of standards for conducting due diligence of third-party agents and distributors. These risks become more difficult when the JV partner brings a proposed third-party agent or distributor and vouches for the agent or distributor. If the JV partner is a state-owned enterprise, the issues become even more complicated as such a referral creates an obvious red flag for a government-sponsored referral.

Now add on the fact that the JV partner may not be proficient in English as a first language. The U.S. company may not have financial personnel with requisite language skills in the foreign country. Some companies have a policy that English will be used throughout the world in its business dealings. However, even with such an English only policy in place, the risks represented by such lack of effective oversight by the multinational extend not only to potential FCPA violations, but to other corrupt acts, including kickbacks, fraud and theft.

Three key takeaways: 

  1. JVs present unique FCPA risks and must be managed accordingly.
  2. Your final report needs to consider the final viewer of the document, potentially the DOJ or SEC.
  3. Be sure to follow up on any red flags raised but not cleared and action items for remediation or additional scrutiny. 


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 588 no Compliance terms and conditions in JV agreements Numerous U.S. companies have come to FCPA grief for their overseas JVs and this continues to be a bane for many companies under the FCPA. There are some basic compliance terms and conditions which should be considered for any foreign JV agreement to help U.S. companies manage these compliance risks.  As a starting point, it is important to have compliance terms and conditions, these reasons can include some of the following: 1) to set expectations between the parties; 2) to demonstrate the seriousness of the issue to the non-U.S. party; and 3) to provide a financial incentive to do business in compliant manner. This all must be spelled out for them, so you should have language regarding the following: Prohibition of all forms of bribery and corruption.  Right to cancel, and recoupment rights. Duties in JV Governance. Audit rights. Prohibited Parties. Certifications. After the contract is signed your company will have to work just as hard to keep the compliance program for any JV robust and meaningful. However, with these terms and conditions in place, you will have a chance to maintain your FCPA obligations and to manage the risk that is involved when working jointly with non-U.S. companies. Three key takeaways:  Failure to secure appropriate compliance terms and conditions in a JV agreement can cause great FCPA risk for a U.S. company. Certifications are important requirements to obtain. Audit rights must be secured and equally importantly, exercised.  Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 08 Oct 2020 17:00:00 -0000 Compliance terms and conditions in JV agreements full Thomas Fox What are the compliance terms and conditions you should have in every JV subject to the FCPA? Find out in this episode of 31 Days to a More Effective Compliance Program. Numerous U.S. companies have come to FCPA grief for their overseas JVs and this continues to be a bane for many companies under the FCPA. There are some basic compliance terms and conditions which should be considered for any foreign JV agreement to help U.S. companies manage these compliance risks.  As a starting point, it is important to have compliance terms and conditions, these reasons can include some of the following: 1) to set expectations between the parties; 2) to demonstrate the seriousness of the issue to the non-U.S. party; and 3) to provide a financial incentive to do business in compliant manner. This all must be spelled out for them, so you should have language regarding the following: Prohibition of all forms of bribery and corruption.  Right to cancel, and recoupment rights. Duties in JV Governance. Audit rights. Prohibited Parties. Certifications. After the contract is signed your company will have to work just as hard to keep the compliance program for any JV robust and meaningful. However, with these terms and conditions in place, you will have a chance to maintain your FCPA obligations and to manage the risk that is involved when working jointly with non-U.S. companies. Three key takeaways:  Failure to secure appropriate compliance terms and conditions in a JV agreement can cause great FCPA risk for a U.S. company. Certifications are important requirements to obtain. Audit rights must be secured and equally importantly, exercised.  Learn more about your ad choices. Visit megaphone.fm/adchoices Numerous U.S. companies have come to FCPA grief for their overseas JVs and this continues to be a bane for many companies under the FCPA. There are some basic compliance terms and conditions which should be considered for any foreign JV agreement to help U.S. companies manage these compliance risks. 

As a starting point, it is important to have compliance terms and conditions, these reasons can include some of the following: 1) to set expectations between the parties; 2) to demonstrate the seriousness of the issue to the non-U.S. party; and 3) to provide a financial incentive to do business in compliant manner. This all must be spelled out for them, so you should have language regarding the following:

  • Prohibition of all forms of bribery and corruption. 
  • Right to cancel, and recoupment rights.
  • Duties in JV Governance.
  • Audit rights.
  • Prohibited Parties.
  • Certifications.

After the contract is signed your company will have to work just as hard to keep the compliance program for any JV robust and meaningful. However, with these terms and conditions in place, you will have a chance to maintain your FCPA obligations and to manage the risk that is involved when working jointly with non-U.S. companies.

Three key takeaways: 

  1. Failure to secure appropriate compliance terms and conditions in a JV agreement can cause great FCPA risk for a U.S. company.
  2. Certifications are important requirements to obtain.
  3. Audit rights must be secured and equally importantly, exercised. 


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 607 no JV Due Diligence When you bring two entities together to operate jointly, there are several difficult issues to analyze. For the U.S. company operating under the FCPA, there must be an adequate business justification for a JV with a specific partner, all in writing and approved by an appropriate level of the organization. This is where the due diligence process comes into play. The due diligence process should be built on principles similar to those involving third-parties. The procedure should be robust, documented and address all potential risks involved. A company should use its due diligence review of the JV partner to properly assess and uncover any corruption risk. Using this due diligence and its evaluation, you can then move to contractual clauses, certifications, representations and warranties from a JV partner or insist on other remedial measures to minimize its risk exposure. In addition to asking for all of this information, you must take care to document the entire process that your company goes through in the investigation and creating a foreign JV. (“Document, Document, and Document”) It is equally important to remember that obtaining this information is only one step. A company must evaluate the information and follow up if responses to such inquiries warrant such action. A paper program is simply not good enough and can lead to serious consequences if red flags are not reviewed and cleared. This evaluation should also be documented so that if a regulator ever comes knocking you can demonstrate what you asked for, why, the response, your follow up and the details of your evaluation. Finally, never forget the human factor. It is important to perform an in-person interview of your proposed JV partner. It is important that you meet them, see their facilities and assess them up close and personal. A U.S. business looking to engage a JV partner must consider the people who make up its JV partner. As you will have to mesh what may be two very different cultures and understandings of compliance, it is important to assess how your potential JV partner will take these obligations before, rather than after you ink the JV agreement. Three key takeaways:  JV due diligence must focus on the unique risks. Ask for a detailed list of information from your potential JV partner. Be sure to do onsite investigation of your potential JV partner. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 07 Oct 2020 17:00:00 -0000 JV Due Diligence full Thomas Fox When you bring two entities together to operate jointly, there are several difficult issues to analyze. This is where the due diligence process comes into play. Find out more in this episode of 31 Days to a More Effective Compliance Program. When you bring two entities together to operate jointly, there are several difficult issues to analyze. For the U.S. company operating under the FCPA, there must be an adequate business justification for a JV with a specific partner, all in writing and approved by an appropriate level of the organization. This is where the due diligence process comes into play. The due diligence process should be built on principles similar to those involving third-parties. The procedure should be robust, documented and address all potential risks involved. A company should use its due diligence review of the JV partner to properly assess and uncover any corruption risk. Using this due diligence and its evaluation, you can then move to contractual clauses, certifications, representations and warranties from a JV partner or insist on other remedial measures to minimize its risk exposure. In addition to asking for all of this information, you must take care to document the entire process that your company goes through in the investigation and creating a foreign JV. (“Document, Document, and Document”) It is equally important to remember that obtaining this information is only one step. A company must evaluate the information and follow up if responses to such inquiries warrant such action. A paper program is simply not good enough and can lead to serious consequences if red flags are not reviewed and cleared. This evaluation should also be documented so that if a regulator ever comes knocking you can demonstrate what you asked for, why, the response, your follow up and the details of your evaluation. Finally, never forget the human factor. It is important to perform an in-person interview of your proposed JV partner. It is important that you meet them, see their facilities and assess them up close and personal. A U.S. business looking to engage a JV partner must consider the people who make up its JV partner. As you will have to mesh what may be two very different cultures and understandings of compliance, it is important to assess how your potential JV partner will take these obligations before, rather than after you ink the JV agreement. Three key takeaways:  JV due diligence must focus on the unique risks. Ask for a detailed list of information from your potential JV partner. Be sure to do onsite investigation of your potential JV partner. Learn more about your ad choices. Visit megaphone.fm/adchoices When you bring two entities together to operate jointly, there are several difficult issues to analyze. For the U.S. company operating under the FCPA, there must be an adequate business justification for a JV with a specific partner, all in writing and approved by an appropriate level of the organization. This is where the due diligence process comes into play. The due diligence process should be built on principles similar to those involving third-parties. The procedure should be robust, documented and address all potential risks involved. A company should use its due diligence review of the JV partner to properly assess and uncover any corruption risk. Using this due diligence and its evaluation, you can then move to contractual clauses, certifications, representations and warranties from a JV partner or insist on other remedial measures to minimize its risk exposure.

In addition to asking for all of this information, you must take care to document the entire process that your company goes through in the investigation and creating a foreign JV. (“Document, Document, and Document”) It is equally important to remember that obtaining this information is only one step. A company must evaluate the information and follow up if responses to such inquiries warrant such action. A paper program is simply not good enough and can lead to serious consequences if red flags are not reviewed and cleared. This evaluation should also be documented so that if a regulator ever comes knocking you can demonstrate what you asked for, why, the response, your follow up and the details of your evaluation.

Finally, never forget the human factor. It is important to perform an in-person interview of your proposed JV partner. It is important that you meet them, see their facilities and assess them up close and personal. A U.S. business looking to engage a JV partner must consider the people who make up its JV partner. As you will have to mesh what may be two very different cultures and understandings of compliance, it is important to assess how your potential JV partner will take these obligations before, rather than after you ink the JV agreement.

Three key takeaways: 

  1. JV due diligence must focus on the unique risks.
  2. Ask for a detailed list of information from your potential JV partner.
  3. Be sure to do onsite investigation of your potential JV partner.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 664 no JV risks under the FCPA Just as the FCPA enforcement field is covered with actions centering around M&A, there are multiple actions involving JVs. JVs continue to plague many U.S. companies up to this day. In many ways, JVs present more difficult issues for the compliance practitioner than M&A because of the control issues present in JVs with foreign governments or state-owned enterprises ownership. There are other risks that a company must seek to avoid. These include the transfer of things of value to a state-owned enterprise for benefits of someone outside the JV. A company must avoid payments for which there is no legitimate business purpose to the state-owned enterprise in the JV itself; as they will be deemed to be illegal benefits to the state-owned enterprise outside the JV. In this case, the JV becomes a vehicle by which to disguise bribery payments for benefits to those outside the JV. Any company which operates a JV with foreign governments or state-owned enterprises holds the same FCPA risk as the JV partner itself; the risks become apparent relating to the operation of the JV itself. This means that if the JV interacts with foreign government officials or employee of a state-owned enterprise and leverages its state-owned enterprise relationships for an improper benefit either contracts and/or regulatory licenses, permits or customs approvals; it could well be subject to FCPA scrutiny. Unfortunately, it is often difficult to regulate JV interactions with foreign government officials, particularly when your partner is a state-owned enterprise, or where your company is relying on the local company for its local contacts and expertise for business development and/or regulatory knowledge and experience in the country where the JV operates. The bottom line is JVs present a unique set of FCPA risks for the compliance practitioner. You will need to incorporate risk management techniques in all phases of the JV relations; pre-formation, the JV agreement and in operations after the JV has begun operation. The compliance obligations and compliance process are ongoing. Three key takeaways:  JVs present unique FCPA risks. Control is only one issue a compliance practitioner must consider in evaluating JV risks. Companies continue to have significant FCPA risks from JVs. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 06 Oct 2020 18:14:05 -0000 JV risks under the FCPA full Thomas Fox In many ways, JVs present more difficult issues for the compliance practitioner than M&A because of the control issues present in JVs with foreign governments or state-owned enterprises ownership. Just as the FCPA enforcement field is covered with actions centering around M&A, there are multiple actions involving JVs. JVs continue to plague many U.S. companies up to this day. In many ways, JVs present more difficult issues for the compliance practitioner than M&A because of the control issues present in JVs with foreign governments or state-owned enterprises ownership. There are other risks that a company must seek to avoid. These include the transfer of things of value to a state-owned enterprise for benefits of someone outside the JV. A company must avoid payments for which there is no legitimate business purpose to the state-owned enterprise in the JV itself; as they will be deemed to be illegal benefits to the state-owned enterprise outside the JV. In this case, the JV becomes a vehicle by which to disguise bribery payments for benefits to those outside the JV. Any company which operates a JV with foreign governments or state-owned enterprises holds the same FCPA risk as the JV partner itself; the risks become apparent relating to the operation of the JV itself. This means that if the JV interacts with foreign government officials or employee of a state-owned enterprise and leverages its state-owned enterprise relationships for an improper benefit either contracts and/or regulatory licenses, permits or customs approvals; it could well be subject to FCPA scrutiny. Unfortunately, it is often difficult to regulate JV interactions with foreign government officials, particularly when your partner is a state-owned enterprise, or where your company is relying on the local company for its local contacts and expertise for business development and/or regulatory knowledge and experience in the country where the JV operates. The bottom line is JVs present a unique set of FCPA risks for the compliance practitioner. You will need to incorporate risk management techniques in all phases of the JV relations; pre-formation, the JV agreement and in operations after the JV has begun operation. The compliance obligations and compliance process are ongoing. Three key takeaways:  JVs present unique FCPA risks. Control is only one issue a compliance practitioner must consider in evaluating JV risks. Companies continue to have significant FCPA risks from JVs. Learn more about your ad choices. Visit megaphone.fm/adchoices Just as the FCPA enforcement field is covered with actions centering around M&A, there are multiple actions involving JVs. JVs continue to plague many U.S. companies up to this day. In many ways, JVs present more difficult issues for the compliance practitioner than M&A because of the control issues present in JVs with foreign governments or state-owned enterprises ownership.

There are other risks that a company must seek to avoid. These include the transfer of things of value to a state-owned enterprise for benefits of someone outside the JV. A company must avoid payments for which there is no legitimate business purpose to the state-owned enterprise in the JV itself; as they will be deemed to be illegal benefits to the state-owned enterprise outside the JV. In this case, the JV becomes a vehicle by which to disguise bribery payments for benefits to those outside the JV.

Any company which operates a JV with foreign governments or state-owned enterprises holds the same FCPA risk as the JV partner itself; the risks become apparent relating to the operation of the JV itself. This means that if the JV interacts with foreign government officials or employee of a state-owned enterprise and leverages its state-owned enterprise relationships for an improper benefit either contracts and/or regulatory licenses, permits or customs approvals; it could well be subject to FCPA scrutiny. Unfortunately, it is often difficult to regulate JV interactions with foreign government officials, particularly when your partner is a state-owned enterprise, or where your company is relying on the local company for its local contacts and expertise for business development and/or regulatory knowledge and experience in the country where the JV operates.

The bottom line is JVs present a unique set of FCPA risks for the compliance practitioner. You will need to incorporate risk management techniques in all phases of the JV relations; pre-formation, the JV agreement and in operations after the JV has begun operation. The compliance obligations and compliance process are ongoing.

Three key takeaways: 

  1. JVs present unique FCPA risks.
  2. Control is only one issue a compliance practitioner must consider in evaluating JV risks.
  3. Companies continue to have significant FCPA risks from JVs.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 669 no Opinion Release 14-02: Dis-linking illegal conduct One of my favorite words in the context of FCPA enforcement is dis-link. It a useful adjective in explaining how certain conduct by a company must be separated from the winning of business and more broadly it works on many different levels when discussing the FCPA. The concept of dis-linking was most prominently laid out in Opinion Release 14-02. It provided one of the most concrete statements from the DOJ on the unidimensional nature of compliance in the M&A context; both in the pre-acquisition and post-acquisition phases. Opinion Release 14-02, taken together with the steps laid out in the 2020 FCPA Resource Guide, 2nd edition, has provided the post-acquisition actions a compliance professional needs to take after the transaction is closed. If you cannot perform any or even an adequate pre-acquisition due diligence, the time frames you put in place after the acquisition closes will need to be compressed to make sure that you are not continuing any nefarious FCPA conduct going forward. But it all goes back to dis-linking. If a Target is engaging in conduct that violates the FCPA but the Target itself is not subject to the jurisdiction of the FCPA, you simply cannot afford to allow that conduct to continue. If you do allow such conduct to continue your company will be actively engaging and participating in an ongoing FCPA violation. That is the final takeaway from this Opinion Release; it is allowing corruption and bribery to continue which brings companies into FCPA grief. Opinion Release 14-02 provides a roadmap of the steps you can take to prevent such exposure. Three key takeaways:  In the M&A context, the key is to dis-link any illegal conduct going forward. Opinion Release 14-02 provides the clearest roadmap for pre- and post-acquisition compliance actions in the M&A context. Never forget the Opinion Release procedure. It has been used successfully in two important M&A matters (08-02 and 14-02). Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 05 Oct 2020 18:52:01 -0000 Opinion Release 14-02: Dis-linking illegal conduct full Thomas Fox The concept of dis-linking was most prominently laid out in Opinion Release 14-02. It provided one of the most concrete statements from the DOJ on the unidimensional nature of compliance in the M&A context. One of my favorite words in the context of FCPA enforcement is dis-link. It a useful adjective in explaining how certain conduct by a company must be separated from the winning of business and more broadly it works on many different levels when discussing the FCPA. The concept of dis-linking was most prominently laid out in Opinion Release 14-02. It provided one of the most concrete statements from the DOJ on the unidimensional nature of compliance in the M&A context; both in the pre-acquisition and post-acquisition phases. Opinion Release 14-02, taken together with the steps laid out in the 2020 FCPA Resource Guide, 2nd edition, has provided the post-acquisition actions a compliance professional needs to take after the transaction is closed. If you cannot perform any or even an adequate pre-acquisition due diligence, the time frames you put in place after the acquisition closes will need to be compressed to make sure that you are not continuing any nefarious FCPA conduct going forward. But it all goes back to dis-linking. If a Target is engaging in conduct that violates the FCPA but the Target itself is not subject to the jurisdiction of the FCPA, you simply cannot afford to allow that conduct to continue. If you do allow such conduct to continue your company will be actively engaging and participating in an ongoing FCPA violation. That is the final takeaway from this Opinion Release; it is allowing corruption and bribery to continue which brings companies into FCPA grief. Opinion Release 14-02 provides a roadmap of the steps you can take to prevent such exposure. Three key takeaways:  In the M&A context, the key is to dis-link any illegal conduct going forward. Opinion Release 14-02 provides the clearest roadmap for pre- and post-acquisition compliance actions in the M&A context. Never forget the Opinion Release procedure. It has been used successfully in two important M&A matters (08-02 and 14-02). Learn more about your ad choices. Visit megaphone.fm/adchoices One of my favorite words in the context of FCPA enforcement is dis-link. It a useful adjective in explaining how certain conduct by a company must be separated from the winning of business and more broadly it works on many different levels when discussing the FCPA. The concept of dis-linking was most prominently laid out in Opinion Release 14-02. It provided one of the most concrete statements from the DOJ on the unidimensional nature of compliance in the M&A context; both in the pre-acquisition and post-acquisition phases.

Opinion Release 14-02, taken together with the steps laid out in the 2020 FCPA Resource Guide, 2nd edition, has provided the post-acquisition actions a compliance professional needs to take after the transaction is closed. If you cannot perform any or even an adequate pre-acquisition due diligence, the time frames you put in place after the acquisition closes will need to be compressed to make sure that you are not continuing any nefarious FCPA conduct going forward.

But it all goes back to dis-linking. If a Target is engaging in conduct that violates the FCPA but the Target itself is not subject to the jurisdiction of the FCPA, you simply cannot afford to allow that conduct to continue. If you do allow such conduct to continue your company will be actively engaging and participating in an ongoing FCPA violation. That is the final takeaway from this Opinion Release; it is allowing corruption and bribery to continue which brings companies into FCPA grief. Opinion Release 14-02 provides a roadmap of the steps you can take to prevent such exposure.

Three key takeaways: 

  1. In the M&A context, the key is to dis-link any illegal conduct going forward.
  2. Opinion Release 14-02 provides the clearest roadmap for pre- and post-acquisition compliance actions in the M&A context.
  3. Never forget the Opinion Release procedure. It has been used successfully in two important M&A matters (08-02 and 14-02).


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 723 no Key M&A cases under the FCPA What are some of the key FCPA enforcement actions involving M&A? These enforcement actions, FCPA Resource Guide and the Evaluation of Corporate Compliance Program (and Update) have all made clear that the DOJ and SEC will vigorously prosecute companies which allow bribery and corruption to continue after a merger or purchase occurs. The key point to remember is that if a company was engaging in bribery and corruption before it was acquired and continues to do so after the transaction is completed, it is now you who is engaging in bribery and corruption, not them.   Three key takeaways:  FCPA enforcement in the M&A space is one of the most well settled areas of enforcement.  Failure to perform pre-acquisition due diligence can significantly devalue a purchased asset. Always remember that if bribery continues after an acquisition it is no longer them engaging in bribery and corruption but you who are engaging in bribery and corruption.  Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 02 Oct 2020 17:00:00 -0000 Key M&A cases under the FCPA full Thomas Fox What are some of the key M&A enforcement actions under the FCPA? What are some of the key FCPA enforcement actions involving M&A? These enforcement actions, FCPA Resource Guide and the Evaluation of Corporate Compliance Program (and Update) have all made clear that the DOJ and SEC will vigorously prosecute companies which allow bribery and corruption to continue after a merger or purchase occurs. The key point to remember is that if a company was engaging in bribery and corruption before it was acquired and continues to do so after the transaction is completed, it is now you who is engaging in bribery and corruption, not them.   Three key takeaways:  FCPA enforcement in the M&A space is one of the most well settled areas of enforcement.  Failure to perform pre-acquisition due diligence can significantly devalue a purchased asset. Always remember that if bribery continues after an acquisition it is no longer them engaging in bribery and corruption but you who are engaging in bribery and corruption.  Learn more about your ad choices. Visit megaphone.fm/adchoices What are some of the key FCPA enforcement actions involving M&A? These enforcement actions, FCPA Resource Guide and the Evaluation of Corporate Compliance Program (and Update) have all made clear that the DOJ and SEC will vigorously prosecute companies which allow bribery and corruption to continue after a merger or purchase occurs. The key point to remember is that if a company was engaging in bribery and corruption before it was acquired and continues to do so after the transaction is completed, it is now you who is engaging in bribery and corruption, not them.  

Three key takeaways: 

  1. FCPA enforcement in the M&A space is one of the most well settled areas of enforcement.
  2.  Failure to perform pre-acquisition due diligence can significantly devalue a purchased asset.
  3. Always remember that if bribery continues after an acquisition it is no longer them engaging in bribery and corruption but you who are engaging in bribery and corruption. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 742 no Introduction to Business Ventures We next consider how to create a more effective compliance program involving business ventures. This will include the role of compliance in M&A, JV agreements, distributorships, teaming agreements and franchises as well as other forms of business relationships.  The FCPA Resource Guide, 2nd edition made clear that one of the Hallmarks of An Effective Compliance Program is around M&A, in both the pre- and post-acquisition context. A company that does not perform adequate due diligence prior to a merger or acquisition it may face both legal and business risks. Perhaps, most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. In contrast, companies that conduct effective due diligence on their acquisition targets can evaluate more accurately each target’s value and negotiate for the costs of the bribery to be borne by the target. Equally important is that if a company engages in the suggested actions, they will go a long way towards insulating, or at least lessening, the risk of FCPA liability going forward. The 2020 Update went on to say that to “The extent to which a company subjects its acquisition targets to appropriate scrutiny is indicative of whether its compliance program is, as implemented, able to effectively enforce its internal controls and remediate misconduct at all levels of the organization” and posed the following queries. One of the key themes in this chapter is the integrated nature of compliance and business ventures. Whether the compliance work is seen in the M&A context, JV context or one of the myriad of other business relationships of the current business world, there is an approach that a CCO or compliance professional should take to assess the risk, monitor the risk and then manage the risk with continued monitoring with a feedback of data and information into your risk management strategy. Three key takeaways:  Consider the role of compliance in a wide variety of business relationships, including M&A, JV agreements, distributorships and franchises as well as other forms of business relationships. Compliance for M&A should be seen as a unidimensional continuum. The Evaluationfocuses on what data did your risk monitoring system turn up and how did you utilize it going forward? Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 01 Oct 2020 17:00:00 -0000 Introduction to Business Ventures full Thomas Fox This month we consider how to create a more effective compliance program involving business ventures. We next consider how to create a more effective compliance program involving business ventures. This will include the role of compliance in M&A, JV agreements, distributorships, teaming agreements and franchises as well as other forms of business relationships.  The FCPA Resource Guide, 2nd edition made clear that one of the Hallmarks of An Effective Compliance Program is around M&A, in both the pre- and post-acquisition context. A company that does not perform adequate due diligence prior to a merger or acquisition it may face both legal and business risks. Perhaps, most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. In contrast, companies that conduct effective due diligence on their acquisition targets can evaluate more accurately each target’s value and negotiate for the costs of the bribery to be borne by the target. Equally important is that if a company engages in the suggested actions, they will go a long way towards insulating, or at least lessening, the risk of FCPA liability going forward. The 2020 Update went on to say that to “The extent to which a company subjects its acquisition targets to appropriate scrutiny is indicative of whether its compliance program is, as implemented, able to effectively enforce its internal controls and remediate misconduct at all levels of the organization” and posed the following queries. One of the key themes in this chapter is the integrated nature of compliance and business ventures. Whether the compliance work is seen in the M&A context, JV context or one of the myriad of other business relationships of the current business world, there is an approach that a CCO or compliance professional should take to assess the risk, monitor the risk and then manage the risk with continued monitoring with a feedback of data and information into your risk management strategy. Three key takeaways:  Consider the role of compliance in a wide variety of business relationships, including M&A, JV agreements, distributorships and franchises as well as other forms of business relationships. Compliance for M&A should be seen as a unidimensional continuum. The Evaluationfocuses on what data did your risk monitoring system turn up and how did you utilize it going forward? Learn more about your ad choices. Visit megaphone.fm/adchoices We next consider how to create a more effective compliance program involving business ventures. This will include the role of compliance in M&A, JV agreements, distributorships, teaming agreements and franchises as well as other forms of business relationships. 

The FCPA Resource Guide, 2nd edition made clear that one of the Hallmarks of An Effective Compliance Program is around M&A, in both the pre- and post-acquisition context. A company that does not perform adequate due diligence prior to a merger or acquisition it may face both legal and business risks. Perhaps, most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. In contrast, companies that conduct effective due diligence on their acquisition targets can evaluate more accurately each target’s value and negotiate for the costs of the bribery to be borne by the target. Equally important is that if a company engages in the suggested actions, they will go a long way towards insulating, or at least lessening, the risk of FCPA liability going forward.

The 2020 Update went on to say that to “The extent to which a company subjects its acquisition targets to appropriate scrutiny is indicative of whether its compliance program is, as implemented, able to effectively enforce its internal controls and remediate misconduct at all levels of the organization” and posed the following queries.

One of the key themes in this chapter is the integrated nature of compliance and business ventures. Whether the compliance work is seen in the M&A context, JV context or one of the myriad of other business relationships of the current business world, there is an approach that a CCO or compliance professional should take to assess the risk, monitor the risk and then manage the risk with continued monitoring with a feedback of data and information into your risk management strategy.

Three key takeaways: 

  1. Consider the role of compliance in a wide variety of business relationships, including M&A, JV agreements, distributorships and franchises as well as other forms of business relationships.
  2. Compliance for M&A should be seen as a unidimensional continuum.
  3. The Evaluationfocuses on what data did your risk monitoring system turn up and how did you utilize it going forward?


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 620 Culture as a Foundational Internal Control To conclude this month's series on Internal Controls, I am joined by Vin DiCianni, Founder and CEO of AMI. We discuss how corporate culture is a foundational internal control. It is a fascinating topic that is not discussed enough by compliance professionals.   3 Key Takeaways. It must start at the top. Hiring is critical to creating and sustaining an ethical culture.  Creative internal controls around culture.  Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 30 Sep 2020 17:00:00 -0000 Culture as a Foundational Internal Control full Thomas Fox To conclude this month's series on Internal Controls, I am joined by Vin DiCianni, Founder and CEO of AMI. We discuss how corporate culture is a foundational internal control. It is a fascinating topic that is not discussed enough by compliance professionals. To conclude this month's series on Internal Controls, I am joined by Vin DiCianni, Founder and CEO of AMI. We discuss how corporate culture is a foundational internal control. It is a fascinating topic that is not discussed enough by compliance professionals.   3 Key Takeaways. It must start at the top. Hiring is critical to creating and sustaining an ethical culture.  Creative internal controls around culture.  Learn more about your ad choices. Visit megaphone.fm/adchoices To conclude this month's series on Internal Controls, I am joined by Vin DiCianni, Founder and CEO of AMI. We discuss how corporate culture is a foundational internal control. It is a fascinating topic that is not discussed enough by compliance professionals.  

3 Key Takeaways.

  1. It must start at the top.
  2. Hiring is critical to creating and sustaining an ethical culture. 
  3. Creative internal controls around culture. 


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 788 no Gap Analysis A gap analysis is a method of assessing the differences in performance between a business’ internal controls to determine whether business requirements are being met and, if not, what steps should be taken to ensure they are met successfully. Moreover, it is a determination of the degree of conformance of your organization to the requirements of an internal controls standard. A gap analysis is mainly a document review or a “show me the evidence” type activity, evidence which usually will come in the form of a record or document. During a gap analysis, there is some auditing accomplished, through key stakeholders providing the evidence they may have - or not - for each of the requirements set forth in the relevant internal controls standard. In this episode, I am joined by AMI's Eric Feldman to explore this topic.   3 Key Takeaways Now is the time for a gap analysis.  Add a Fraud Risk Assessment to your gap analysis. Culture is a foundational internal control.  Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 29 Sep 2020 17:02:00 -0000 Gap Analysis full Thomas Fox In this episode of 31 Days to a More Effective Compliance Program, I am joined by AMI's Eric Feldman to discuss a gap analysis and why it is so critical. A gap analysis is a method of assessing the differences in performance between a business’ internal controls to determine whether business requirements are being met and, if not, what steps should be taken to ensure they are met successfully. Moreover, it is a determination of the degree of conformance of your organization to the requirements of an internal controls standard. A gap analysis is mainly a document review or a “show me the evidence” type activity, evidence which usually will come in the form of a record or document. During a gap analysis, there is some auditing accomplished, through key stakeholders providing the evidence they may have - or not - for each of the requirements set forth in the relevant internal controls standard. In this episode, I am joined by AMI's Eric Feldman to explore this topic.   3 Key Takeaways Now is the time for a gap analysis.  Add a Fraud Risk Assessment to your gap analysis. Culture is a foundational internal control.  Learn more about your ad choices. Visit megaphone.fm/adchoices A gap analysis is a method of assessing the differences in performance between a business’ internal controls to determine whether business requirements are being met and, if not, what steps should be taken to ensure they are met successfully. Moreover, it is a determination of the degree of conformance of your organization to the requirements of an internal controls standard. A gap analysis is mainly a document review or a “show me the evidence” type activity, evidence which usually will come in the form of a record or document. During a gap analysis, there is some auditing accomplished, through key stakeholders providing the evidence they may have - or not - for each of the requirements set forth in the relevant internal controls standard. In this episode, I am joined by AMI's Eric Feldman to explore this topic.  

3 Key Takeaways

  1. Now is the time for a gap analysis. 
  2. Add a Fraud Risk Assessment to your gap analysis.
  3. Culture is a foundational internal control. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 709 no Assessing compliance internal controls under COSO Next, consider what COSO says about assessing compliance internal controls. In its Illustrative Guide, COSO laid out its views on “how to assess the effectiveness of its internal controls.” It went on to note, “An effective system of internal controls provides reasonable assurance of achievement of the entity’s objectives, relating to operations, reporting and compliance.” Moreover, there are two over-arching requirements that can only be met through such a structured post. First, each of the five components are present and functioning. Second, are the five components “operating together in an integrated approach.” One of the most critical components of the COSO 2013 Internal Controls Framework is that it sets internal control standards against those which you can audit to assess the strength of your compliance internal controls. Under a compliance regime, you may be faced with known or relevant criteria to classify any deficiency. For example, if written policies do not have at a minimum the categories of policies laid out in the 2020 FCPA Resource Guide, which states “the nature and extent of transactions with foreign governments, including payments to foreign officials; use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments”, also formulated in the Illustrative Guide, such a finding would preclude management from “concluding that the entity has met the requirements for effective internal controls in accordance with the Framework.” Three key takeaways: A new revenue recognition standard has become effective. What have you done from the compliance perspective? This new revenue recognition standard is much more judgment based and when a standard is more judgment based, there can be more room for manipulation. Compliance internal controls now can also be used to gather the information which will be presented to auditors under the new rev rec standard. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 28 Sep 2020 17:00:00 -0000 Assessing compliance internal controls under COSO full Thomas Fox How can you assess your internal controls? Find out in today's edition of 31 Days to a More Effective Compliance Program Next, consider what COSO says about assessing compliance internal controls. In its Illustrative Guide, COSO laid out its views on “how to assess the effectiveness of its internal controls.” It went on to note, “An effective system of internal controls provides reasonable assurance of achievement of the entity’s objectives, relating to operations, reporting and compliance.” Moreover, there are two over-arching requirements that can only be met through such a structured post. First, each of the five components are present and functioning. Second, are the five components “operating together in an integrated approach.” One of the most critical components of the COSO 2013 Internal Controls Framework is that it sets internal control standards against those which you can audit to assess the strength of your compliance internal controls. Under a compliance regime, you may be faced with known or relevant criteria to classify any deficiency. For example, if written policies do not have at a minimum the categories of policies laid out in the 2020 FCPA Resource Guide, which states “the nature and extent of transactions with foreign governments, including payments to foreign officials; use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments”, also formulated in the Illustrative Guide, such a finding would preclude management from “concluding that the entity has met the requirements for effective internal controls in accordance with the Framework.” Three key takeaways: A new revenue recognition standard has become effective. What have you done from the compliance perspective? This new revenue recognition standard is much more judgment based and when a standard is more judgment based, there can be more room for manipulation. Compliance internal controls now can also be used to gather the information which will be presented to auditors under the new rev rec standard. Learn more about your ad choices. Visit megaphone.fm/adchoices Next, consider what COSO says about assessing compliance internal controls. In its Illustrative Guide, COSO laid out its views on “how to assess the effectiveness of its internal controls.” It went on to note, “An effective system of internal controls provides reasonable assurance of achievement of the entity’s objectives, relating to operations, reporting and compliance.” Moreover, there are two over-arching requirements that can only be met through such a structured post. First, each of the five components are present and functioning. Second, are the five components “operating together in an integrated approach.” One of the most critical components of the COSO 2013 Internal Controls Framework is that it sets internal control standards against those which you can audit to assess the strength of your compliance internal controls.

Under a compliance regime, you may be faced with known or relevant criteria to classify any deficiency. For example, if written policies do not have at a minimum the categories of policies laid out in the 2020 FCPA Resource Guide, which states “the nature and extent of transactions with foreign governments, including payments to foreign officials; use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments”, also formulated in the Illustrative Guide, such a finding would preclude management from “concluding that the entity has met the requirements for effective internal controls in accordance with the Framework.”

Three key takeaways:

  1. A new revenue recognition standard has become effective. What have you done from the compliance perspective?
  2. This new revenue recognition standard is much more judgment based and when a standard is more judgment based, there can be more room for manipulation.
  3. Compliance internal controls now can also be used to gather the information which will be presented to auditors under the new rev rec standard.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no COSO Objective V: Monitoring Activities The fifth and final Objective is Monitoring Activities and as with all other components of the COSO Cube, Monitoring Activities are part of an inter-related whole and cannot be taken singularly. For the CCO or compliance practitioner, Monitoring Activities has been growing in importance over the past few years and will continue to do so in the future as is reinforced in the COSO 2013 Internal Controls Framework.  The Monitoring Activities objective consists of two principles: 1) The organization selects, develops and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning; and 2) the organization evaluates and communicates internal control deficiencies timely to those parties responsible for taking corrective action, including senior management and the Board of Directors, as appropriate. Principle 16: Ongoing evaluation. Principle 17: Evaluation and communication of deficiencies. Discussion. Monitoring Activities should bring together your entire compliance program and give you a sense of whether it is running properly. Both ongoing monitoring and auditing are tools the CCO and compliance practitioner should use in support of this objective. The most important item to note is that all the controls need to be sustainable. You cannot just build one-off controls and not have a process in place to help you monitor all the controls that you need to cover. Controls cannot just be a one and done. Many companies are going to find that their initial approach to all of this is one and done. There must also be a mechanism in place for the communication of controls which do not work or can readily be over-ridden. From there, you must be able to remediate your controls going forward. This will align with the compliance professional’s requirement to prevent, detect and remediate going forward. Three key takeaways: Monitoring activities is inter-related with all other Principles and cannot be taken singularly. Monitoring activities helps to ensure that all controls are present and functioning. Monitoring Activities should bring together your entire compliance program and give you a sense of whether it is running properly. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 25 Sep 2020 17:00:00 -0000 COSO Objective V: Monitoring Activities full Thomas Fox The fifth and final Objective is Monitoring Activities and as with all other components of the COSO Cube, Monitoring Activities are part of an inter-related whole and cannot be taken singularly. The fifth and final Objective is Monitoring Activities and as with all other components of the COSO Cube, Monitoring Activities are part of an inter-related whole and cannot be taken singularly. For the CCO or compliance practitioner, Monitoring Activities has been growing in importance over the past few years and will continue to do so in the future as is reinforced in the COSO 2013 Internal Controls Framework.  The Monitoring Activities objective consists of two principles: 1) The organization selects, develops and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning; and 2) the organization evaluates and communicates internal control deficiencies timely to those parties responsible for taking corrective action, including senior management and the Board of Directors, as appropriate. Principle 16: Ongoing evaluation. Principle 17: Evaluation and communication of deficiencies. Discussion. Monitoring Activities should bring together your entire compliance program and give you a sense of whether it is running properly. Both ongoing monitoring and auditing are tools the CCO and compliance practitioner should use in support of this objective. The most important item to note is that all the controls need to be sustainable. You cannot just build one-off controls and not have a process in place to help you monitor all the controls that you need to cover. Controls cannot just be a one and done. Many companies are going to find that their initial approach to all of this is one and done. There must also be a mechanism in place for the communication of controls which do not work or can readily be over-ridden. From there, you must be able to remediate your controls going forward. This will align with the compliance professional’s requirement to prevent, detect and remediate going forward. Three key takeaways: Monitoring activities is inter-related with all other Principles and cannot be taken singularly. Monitoring activities helps to ensure that all controls are present and functioning. Monitoring Activities should bring together your entire compliance program and give you a sense of whether it is running properly. Learn more about your ad choices. Visit megaphone.fm/adchoices The fifth and final Objective is Monitoring Activities and as with all other components of the COSO Cube, Monitoring Activities are part of an inter-related whole and cannot be taken singularly. For the CCO or compliance practitioner, Monitoring Activities has been growing in importance over the past few years and will continue to do so in the future as is reinforced in the COSO 2013 Internal Controls Framework. 

The Monitoring Activities objective consists of two principles: 1) The organization selects, develops and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning; and 2) the organization evaluates and communicates internal control deficiencies timely to those parties responsible for taking corrective action, including senior management and the Board of Directors, as appropriate.

Principle 16: Ongoing evaluation.

Principle 17: Evaluation and communication of deficiencies.

Discussion. Monitoring Activities should bring together your entire compliance program and give you a sense of whether it is running properly. Both ongoing monitoring and auditing are tools the CCO and compliance practitioner should use in support of this objective.

The most important item to note is that all the controls need to be sustainable. You cannot just build one-off controls and not have a process in place to help you monitor all the controls that you need to cover. Controls cannot just be a one and done. Many companies are going to find that their initial approach to all of this is one and done.

There must also be a mechanism in place for the communication of controls which do not work or can readily be over-ridden. From there, you must be able to remediate your controls going forward. This will align with the compliance professional’s requirement to prevent, detect and remediate going forward.

Three key takeaways:

  1. Monitoring activities is inter-related with all other Principles and cannot be taken singularly.
  2. Monitoring activities helps to ensure that all controls are present and functioning.
  3. Monitoring Activities should bring together your entire compliance program and give you a sense of whether it is running properly.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 578 no COSO Objective IV: Information and Communication As with the other components of the COSO Cube, the objective of Information and Communication is not to be taken in a vacuum. Indeed, one of the more interesting aspects of this objective is that it runs not only vertically but also horizontally.  Principle 13: Use of relevant and quality information. Principle 14: Communicate internally. Principle 15: Communicate externally. Discussion. Obviously, there must be communications up and down from the Board but also within an organization for dissemination of the appropriate compliance related information. For this principle, the CCO or compliance practitioner should also evaluate the communication lines to third parties. This communication can flow both ways, as noted, with compliance obligations to third parties but also information in the form of compliance issues back from third parties. Joe Howell noted “communication internally is how you establish the communications with your sales organization, with your sales operations. How do you establish communications with the legal organization? How do you establish information with the post-sales organizations? Even with the auditors, and your internal auditors and your external auditors and the board, to give the Audit Committee of the Board comfort that the company has put in place the right levels of controls.” Three key takeaways: Consider the use of relevant and quality information. You need to document your internal communications so auditors can review the audit trail. This objective relates to your third-party compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 24 Sep 2020 17:00:00 -0000 COSO Objective IV: Information and Communication full Thomas Fox The objective of Information and Communication is not to be taken in a vacuum. Indeed, one of the more interesting aspects of this objective is that it runs not only vertically but also horizontally. Find out more in today's 31 Days to a More Effective Compliance Program As with the other components of the COSO Cube, the objective of Information and Communication is not to be taken in a vacuum. Indeed, one of the more interesting aspects of this objective is that it runs not only vertically but also horizontally.  Principle 13: Use of relevant and quality information. Principle 14: Communicate internally. Principle 15: Communicate externally. Discussion. Obviously, there must be communications up and down from the Board but also within an organization for dissemination of the appropriate compliance related information. For this principle, the CCO or compliance practitioner should also evaluate the communication lines to third parties. This communication can flow both ways, as noted, with compliance obligations to third parties but also information in the form of compliance issues back from third parties. Joe Howell noted “communication internally is how you establish the communications with your sales organization, with your sales operations. How do you establish communications with the legal organization? How do you establish information with the post-sales organizations? Even with the auditors, and your internal auditors and your external auditors and the board, to give the Audit Committee of the Board comfort that the company has put in place the right levels of controls.” Three key takeaways: Consider the use of relevant and quality information. You need to document your internal communications so auditors can review the audit trail. This objective relates to your third-party compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices As with the other components of the COSO Cube, the objective of Information and Communication is not to be taken in a vacuum. Indeed, one of the more interesting aspects of this objective is that it runs not only vertically but also horizontally.

 Principle 13: Use of relevant and quality information.

Principle 14: Communicate internally.

Principle 15: Communicate externally.

Discussion. Obviously, there must be communications up and down from the Board but also within an organization for dissemination of the appropriate compliance related information. For this principle, the CCO or compliance practitioner should also evaluate the communication lines to third parties. This communication can flow both ways, as noted, with compliance obligations to third parties but also information in the form of compliance issues back from third parties.

Joe Howell noted “communication internally is how you establish the communications with your sales organization, with your sales operations. How do you establish communications with the legal organization? How do you establish information with the post-sales organizations? Even with the auditors, and your internal auditors and your external auditors and the board, to give the Audit Committee of the Board comfort that the company has put in place the right levels of controls.”

Three key takeaways:

  1. Consider the use of relevant and quality information.
  2. You need to document your internal communications so auditors can review the audit trail.
  3. This objective relates to your third-party compliance program.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 660 no COSO Objective III: Control Activities In its Framework Volume, COSO Control Activities “are the actions established through policies and procedures that help ensure that management’s directives to mitigate risks to the achievement of objectives are carried out.” They should be performed at all levels in an organization’s process cycle.  Principle 10: Selects and develops controls activities. Principle 11: Selects and develops general controls over technology. Principle 12: Control activities established through policies and procedures. Discussion. While the objective of Control Activities should be the most familiar to the CCO or compliance practitioner, this objective demonstrates the inter-relatedness of all the five COSO Objectives and the corporate functions in your organization. It is your control environment and then risk assessment that should lead you to this point. It is the Control Activities objective that lays the groundwork for a living, breathing compliance program going forward. This objective requires that you have new ways of capturing, gathering, confirming the accuracy and completeness of the information and the controls reporting it. The Control Activities regarding the policies and procedures needed is certainly an important consideration going forward. Three key takeaways: Think of a “second set of eyes” as a primary control activity. SODs must always be employed. Control Activities should be performed at all levels in the business process cycle and this speaks directly to the operationalization of your compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 23 Sep 2020 17:00:00 -0000 COSO Objective III: Control Activities full Thomas Fox Control Activities are the actions established through policies and procedures that help ensure that management’s directives to mitigate risks to the achievement of objectives are carried out. Find out more in today's 31 Days to a More Effective Compliance Program. In its Framework Volume, COSO Control Activities “are the actions established through policies and procedures that help ensure that management’s directives to mitigate risks to the achievement of objectives are carried out.” They should be performed at all levels in an organization’s process cycle.  Principle 10: Selects and develops controls activities. Principle 11: Selects and develops general controls over technology. Principle 12: Control activities established through policies and procedures. Discussion. While the objective of Control Activities should be the most familiar to the CCO or compliance practitioner, this objective demonstrates the inter-relatedness of all the five COSO Objectives and the corporate functions in your organization. It is your control environment and then risk assessment that should lead you to this point. It is the Control Activities objective that lays the groundwork for a living, breathing compliance program going forward. This objective requires that you have new ways of capturing, gathering, confirming the accuracy and completeness of the information and the controls reporting it. The Control Activities regarding the policies and procedures needed is certainly an important consideration going forward. Three key takeaways: Think of a “second set of eyes” as a primary control activity. SODs must always be employed. Control Activities should be performed at all levels in the business process cycle and this speaks directly to the operationalization of your compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices In its Framework Volume, COSO Control Activities “are the actions established through policies and procedures that help ensure that management’s directives to mitigate risks to the achievement of objectives are carried out.” They should be performed at all levels in an organization’s process cycle. 

Principle 10: Selects and develops controls activities.

Principle 11: Selects and develops general controls over technology.

Principle 12: Control activities established through policies and procedures.

Discussion. While the objective of Control Activities should be the most familiar to the CCO or compliance practitioner, this objective demonstrates the inter-relatedness of all the five COSO Objectives and the corporate functions in your organization. It is your control environment and then risk assessment that should lead you to this point. It is the Control Activities objective that lays the groundwork for a living, breathing compliance program going forward.

This objective requires that you have new ways of capturing, gathering, confirming the accuracy and completeness of the information and the controls reporting it. The Control Activities regarding the policies and procedures needed is certainly an important consideration going forward.

Three key takeaways:

  1. Think of a “second set of eyes” as a primary control activity.
  2. SODs must always be employed.
  3. Control Activities should be performed at all levels in the business process cycle and this speaks directly to the operationalization of your compliance program.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 577 no COSO Objective II: Risk Assessments Objective II is designed to provide a company with a dynamic and iterative process for identifying and assessing risks. For the compliance practitioner, none of this will sound new or even insightful, However the Framework requires a component of management input and oversight that was perhaps not as well understood.  The objective of Risk Assessment consists of four principles. Principle 6: Suitable objectives. Principle 7: Identifies and analyzes risk. Principle 8: Fraud risk. Principle 9: Identifies and analyzes significant change. Discussion. The SEC has made it clear that companies should be expanding their view of risk in implementing the COSO 2013 Internal Controls Framework. Obviously, risk assessments are a cornerstone of a best practices compliance program as laid out in the 2012 FCPA Guidance and in the DOJ’s Evaluation. The regulators are telling companies specifically that they should be seeing new risks that they need address because of the changes brought about by the new standard. Three key takeaways: Risk assessments are required under the COSO 2013 Internal Controls Framework, the 2012 FCPA Guidance and almost all other best practices compliance programs. Look at your risks across your organization and not in a siloed manner. Risks, both determination and management of, changes over time so be cognizant of changes in business practices on the ground. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 22 Sep 2020 17:00:00 -0000 COSO Objective II: Risk Assessments full Thomas Fox Objective II is designed to provide a company with a dynamic and iterative process for identifying and assessing risks. Find out more in today's 31 Days to a More Effective Compliance Program Objective II is designed to provide a company with a dynamic and iterative process for identifying and assessing risks. For the compliance practitioner, none of this will sound new or even insightful, However the Framework requires a component of management input and oversight that was perhaps not as well understood.  The objective of Risk Assessment consists of four principles. Principle 6: Suitable objectives. Principle 7: Identifies and analyzes risk. Principle 8: Fraud risk. Principle 9: Identifies and analyzes significant change. Discussion. The SEC has made it clear that companies should be expanding their view of risk in implementing the COSO 2013 Internal Controls Framework. Obviously, risk assessments are a cornerstone of a best practices compliance program as laid out in the 2012 FCPA Guidance and in the DOJ’s Evaluation. The regulators are telling companies specifically that they should be seeing new risks that they need address because of the changes brought about by the new standard. Three key takeaways: Risk assessments are required under the COSO 2013 Internal Controls Framework, the 2012 FCPA Guidance and almost all other best practices compliance programs. Look at your risks across your organization and not in a siloed manner. Risks, both determination and management of, changes over time so be cognizant of changes in business practices on the ground. Learn more about your ad choices. Visit megaphone.fm/adchoices Objective II is designed to provide a company with a dynamic and iterative process for identifying and assessing risks. For the compliance practitioner, none of this will sound new or even insightful, However the Framework requires a component of management input and oversight that was perhaps not as well understood. 

The objective of Risk Assessment consists of four principles.

Principle 6: Suitable objectives.

Principle 7: Identifies and analyzes risk.

Principle 8: Fraud risk.

Principle 9: Identifies and analyzes significant change.

Discussion. The SEC has made it clear that companies should be expanding their view of risk in implementing the COSO 2013 Internal Controls Framework. Obviously, risk assessments are a cornerstone of a best practices compliance program as laid out in the 2012 FCPA Guidance and in the DOJ’s Evaluation. The regulators are telling companies specifically that they should be seeing new risks that they need address because of the changes brought about by the new standard.

Three key takeaways:

  1. Risk assessments are required under the COSO 2013 Internal Controls Framework, the 2012 FCPA Guidance and almost all other best practices compliance programs.
  2. Look at your risks across your organization and not in a siloed manner.
  3. Risks, both determination and management of, changes over time so be cognizant of changes in business practices on the ground.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 684 no COSO Objective I: Control Environment The first of the five objectives is control environment and it sets the tone for the implementation and operation of all other components of internal control. It begins with the ethical commitment of senior management, oversight by those in governance, and a commitment to competent employees. The five principles of the control environment object are as follows:  Principle 1: Commitment to integrity and ethical values. Principle 2: Board independence and oversight. Principle 3: Structures, reporting lines, authority and responsibility. Principle 4: Attracting, developing and retaining competent individuals. Principle 5: individuals held accountable. Discussion. Both Board of Directors’ independence and Compliance Committee (or other applicable committee) oversight are essential to this objective because the committee needs to be actively engaged to be comfortable that the company has implemented the internal controls under SOX 404(a); as required under Principles 1 and 2. Under Principle 3, structures in reporting lines, authority and responsibility are essential to the recognition of revenue. Under Principle 4, a business must attract and develop, then retaining competent talent. This ties into Principle 5, which mandates individuals being held responsible. This requires someone to document that they have made a judgment based upon the evidence that they have been able to accumulate, that the company has analyzed that evidence and has gone through the process of comparing this to the COSO 2013 Internal Controls Framework and to the spirit of the standard.  Three key takeaways: What controls do you have in place to measure conduct at the top? Reporting lines must be clear and functioning. You must provide the right personnel with the right resources. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 21 Sep 2020 17:00:00 -0000 COSO Objective I: Control Environment full Thomas Fox The first of the five objectives is control environment and it sets the tone for the implementation and operation of all other components of internal control. Find out more in today's 31 Days to a More Effective Compliance Program The first of the five objectives is control environment and it sets the tone for the implementation and operation of all other components of internal control. It begins with the ethical commitment of senior management, oversight by those in governance, and a commitment to competent employees. The five principles of the control environment object are as follows:  Principle 1: Commitment to integrity and ethical values. Principle 2: Board independence and oversight. Principle 3: Structures, reporting lines, authority and responsibility. Principle 4: Attracting, developing and retaining competent individuals. Principle 5: individuals held accountable. Discussion. Both Board of Directors’ independence and Compliance Committee (or other applicable committee) oversight are essential to this objective because the committee needs to be actively engaged to be comfortable that the company has implemented the internal controls under SOX 404(a); as required under Principles 1 and 2. Under Principle 3, structures in reporting lines, authority and responsibility are essential to the recognition of revenue. Under Principle 4, a business must attract and develop, then retaining competent talent. This ties into Principle 5, which mandates individuals being held responsible. This requires someone to document that they have made a judgment based upon the evidence that they have been able to accumulate, that the company has analyzed that evidence and has gone through the process of comparing this to the COSO 2013 Internal Controls Framework and to the spirit of the standard.  Three key takeaways: What controls do you have in place to measure conduct at the top? Reporting lines must be clear and functioning. You must provide the right personnel with the right resources. Learn more about your ad choices. Visit megaphone.fm/adchoices The first of the five objectives is control environment and it sets the tone for the implementation and operation of all other components of internal control. It begins with the ethical commitment of senior management, oversight by those in governance, and a commitment to competent employees. The five principles of the control environment object are as follows: 

Principle 1: Commitment to integrity and ethical values.

Principle 2: Board independence and oversight.

Principle 3: Structures, reporting lines, authority and responsibility.

Principle 4: Attracting, developing and retaining competent individuals.

Principle 5: individuals held accountable.

Discussion. Both Board of Directors’ independence and Compliance Committee (or other applicable committee) oversight are essential to this objective because the committee needs to be actively engaged to be comfortable that the company has implemented the internal controls under SOX 404(a); as required under Principles 1 and 2.

Under Principle 3, structures in reporting lines, authority and responsibility are essential to the recognition of revenue. Under Principle 4, a business must attract and develop, then retaining competent talent. This ties into Principle 5, which mandates individuals being held responsible. This requires someone to document that they have made a judgment based upon the evidence that they have been able to accumulate, that the company has analyzed that evidence and has gone through the process of comparing this to the COSO 2013 Internal Controls Framework and to the spirit of the standard. 

Three key takeaways:

  1. What controls do you have in place to measure conduct at the top?
  2. Reporting lines must be clear and functioning.
  3. You must provide the right personnel with the right resources.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 693 no What is the COSO 2013 Internal Controls Framework? COSO was adopted in 1992 as a framework for basis to design and then test the effectiveness of internal controls. In 2010, it was deemed necessary to update this more than 20-year old COSO Framework, to provide a more supportable approach when adversarial third parties challenged whether a company has effective internal controls (such as the SEC). While the COSO 2013 Internal Controls Framework is designed for financial controls, I believe that the SEC will use this to review a company’s compliance internal controls. This means that you need to understand what is required under the COSO 2013 Internal Controls Framework and can show adherence to it or justify an exception if you receive a letter from the SEC asking for evidence of your company’s compliance with the internal controls provisions of the FCPA. COSO has produced three volumes detailing the COSO 2013 Internal Controls Framework. The first lays out the Framework and is entitled “Internal Control – Integrated Framework”, herein “the Framework volume.” The second is an illustrative guide, entitled “Internal Controls – Integrated Framework, Illustrative Tools for Assessing Effectiveness of a System of Internal Controls”, herein “the Illustrative Guide”, which discusses how best to assess your internal control regime and provides forms and work sheets to use. The third volume is the “Executive Summary of the first volume, herein “Executive Summary”. All three works form an excellent starting point for exploration of the COSO 2013 Internal Controls Framework and how you might use it for your best practices anti-corruption compliance program. In the COSO 2013 Internal Controls Framework update the basic framework was retained with substantial support from user companies, and 3 specific objectives were added: I) Operations Objectives – effectiveness and efficiency of operations, including safeguarding assets against loss; II) Reporting Objectives – internal and external financial reporting; and III) Compliance Objectives – adherence to laws and regulations to which the entity is subject. According to the guidance in the 2013 update, the system of internal controls can be considered effective only if it provides reasonable assurance the organization, among other things, complies with applicable laws, rules, regulations and external standards. With the addition of those specific objectives, the COSO 2013 Internal Controls Framework now specifically includes the need for controls to address compliance with laws and regulations. The COSO 2013 Internal Controls Framework defines internal controls, from bottom to top, with the following Objectives: a) Control Environment, b) Risk Assessment, c) Control Activities, d) Information and Communication, and e) Monitoring. From these five Objectives come 17 Principles which we explore in more detail. Three key takeaways: You must use the 2013 Internal Controls Framework or a similar source for your internal controls structure. The 2013 Internal Controls Framework identifies the following areas: a) Control Environment, b) Risk Assessment, c) Control Activities, d) Information and Communication, and e) Monitoring. Your internal controls must be sustainable. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 18 Sep 2020 17:00:00 -0000 What is the COSO 2013 Internal Controls Framework? full Thomas Fox What is the COSO 2013 Internal Controls Framework and how does it relate to compliance. We begin a consideration of the COSO Framework in this episode of 31 Days to a More Effective Compliance Program. COSO was adopted in 1992 as a framework for basis to design and then test the effectiveness of internal controls. In 2010, it was deemed necessary to update this more than 20-year old COSO Framework, to provide a more supportable approach when adversarial third parties challenged whether a company has effective internal controls (such as the SEC). While the COSO 2013 Internal Controls Framework is designed for financial controls, I believe that the SEC will use this to review a company’s compliance internal controls. This means that you need to understand what is required under the COSO 2013 Internal Controls Framework and can show adherence to it or justify an exception if you receive a letter from the SEC asking for evidence of your company’s compliance with the internal controls provisions of the FCPA. COSO has produced three volumes detailing the COSO 2013 Internal Controls Framework. The first lays out the Framework and is entitled “Internal Control – Integrated Framework”, herein “the Framework volume.” The second is an illustrative guide, entitled “Internal Controls – Integrated Framework, Illustrative Tools for Assessing Effectiveness of a System of Internal Controls”, herein “the Illustrative Guide”, which discusses how best to assess your internal control regime and provides forms and work sheets to use. The third volume is the “Executive Summary of the first volume, herein “Executive Summary”. All three works form an excellent starting point for exploration of the COSO 2013 Internal Controls Framework and how you might use it for your best practices anti-corruption compliance program. In the COSO 2013 Internal Controls Framework update the basic framework was retained with substantial support from user companies, and 3 specific objectives were added: I) Operations Objectives – effectiveness and efficiency of operations, including safeguarding assets against loss; II) Reporting Objectives – internal and external financial reporting; and III) Compliance Objectives – adherence to laws and regulations to which the entity is subject. According to the guidance in the 2013 update, the system of internal controls can be considered effective only if it provides reasonable assurance the organization, among other things, complies with applicable laws, rules, regulations and external standards. With the addition of those specific objectives, the COSO 2013 Internal Controls Framework now specifically includes the need for controls to address compliance with laws and regulations. The COSO 2013 Internal Controls Framework defines internal controls, from bottom to top, with the following Objectives: a) Control Environment, b) Risk Assessment, c) Control Activities, d) Information and Communication, and e) Monitoring. From these five Objectives come 17 Principles which we explore in more detail. Three key takeaways: You must use the 2013 Internal Controls Framework or a similar source for your internal controls structure. The 2013 Internal Controls Framework identifies the following areas: a) Control Environment, b) Risk Assessment, c) Control Activities, d) Information and Communication, and e) Monitoring. Your internal controls must be sustainable. Learn more about your ad choices. Visit megaphone.fm/adchoices COSO was adopted in 1992 as a framework for basis to design and then test the effectiveness of internal controls. In 2010, it was deemed necessary to update this more than 20-year old COSO Framework, to provide a more supportable approach when adversarial third parties challenged whether a company has effective internal controls (such as the SEC). While the COSO 2013 Internal Controls Framework is designed for financial controls, I believe that the SEC will use this to review a company’s compliance internal controls. This means that you need to understand what is required under the COSO 2013 Internal Controls Framework and can show adherence to it or justify an exception if you receive a letter from the SEC asking for evidence of your company’s compliance with the internal controls provisions of the FCPA.

COSO has produced three volumes detailing the COSO 2013 Internal Controls Framework. The first lays out the Framework and is entitled “Internal Control – Integrated Framework”, herein “the Framework volume.” The second is an illustrative guide, entitled “Internal Controls – Integrated Framework, Illustrative Tools for Assessing Effectiveness of a System of Internal Controls”, herein “the Illustrative Guide”, which discusses how best to assess your internal control regime and provides forms and work sheets to use. The third volume is the “Executive Summary of the first volume, herein “Executive Summary”. All three works form an excellent starting point for exploration of the COSO 2013 Internal Controls Framework and how you might use it for your best practices anti-corruption compliance program.

In the COSO 2013 Internal Controls Framework update the basic framework was retained with substantial support from user companies, and 3 specific objectives were added: I) Operations Objectives – effectiveness and efficiency of operations, including safeguarding assets against loss; II) Reporting Objectives – internal and external financial reporting; and III) Compliance Objectives – adherence to laws and regulations to which the entity is subject. According to the guidance in the 2013 update, the system of internal controls can be considered effective only if it provides reasonable assurance the organization, among other things, complies with applicable laws, rules, regulations and external standards. With the addition of those specific objectives, the COSO 2013 Internal Controls Framework now specifically includes the need for controls to address compliance with laws and regulations.

The COSO 2013 Internal Controls Framework defines internal controls, from bottom to top, with the following Objectives: a) Control Environment, b) Risk Assessment, c) Control Activities, d) Information and Communication, and e) Monitoring. From these five Objectives come 17 Principles which we explore in more detail.

Three key takeaways:

  1. You must use the 2013 Internal Controls Framework or a similar source for your internal controls structure.
  2. The 2013 Internal Controls Framework identifies the following areas: a) Control Environment, b) Risk Assessment, c) Control Activities, d) Information and Communication, and e) Monitoring.
  3. Your internal controls must be sustainable.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 656 no Code of Conduct as an internal control In 2016, one of the most interesting non-international focused FCPA enforcement actions was announced by the SEC. It involved a clear quid pro quo benefit paid out by United Airlines, Inc. to David Samson, the former chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity which has authority over, among other things, United’s operations at the company’s huge east coast hub at Newark, New Jersey. The reason that it is so interesting from an enforcement prospective is that it is not foreign corruption but domestic corruption, therefore not subject to the foreign government official requirement of the FCPA. However, the actions of United’s former CEO, Jeff Smisek, in personally approving the benefit granted to favor Samson violated the company’s internal controls around gifts to government officials. That sounds suspiciously like a books and records violation of the FCPA. The $2.4 million civil penalty levied on United was in addition to its NPA settlement with the DOJ, which resulted in a penalty of $2.25 million. Former Chairman Samson also pled guilty for putting pressure on United to reinstitute a flight service which was near his weekend residence. At the time, United’s Code of Conduct prohibited “United employees from directly or indirectly making bribes, kickbacks or other improper payments to government officials, civil servants or anyone else to influence their acts or decisions” and that “[n]o gift may be offered or accepted if it will create a feeling of obligation, compromise judgment or appear to improperly influence the recipient.” Only the United Board of Director’s could grant a waiver to the code and none was sought or obtained by Smisek. The Order concluded, “The [Chairman’s] Route was initiated in violation of United’s policies.” Three key takeaways: It is very unusual for the FCPA to form the basis of a domestic bribery violation. A Code of Conduct can be an internal control. Even a CEO must follow internal controls. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 17 Sep 2020 17:00:00 -0000 Code of Conduct as an internal control full Thomas Fox When does a Code of Conduct violation become a FCPA enforcement action? Find out in today's edition of 31 Days to a More Effective Compliance Program. In 2016, one of the most interesting non-international focused FCPA enforcement actions was announced by the SEC. It involved a clear quid pro quo benefit paid out by United Airlines, Inc. to David Samson, the former chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity which has authority over, among other things, United’s operations at the company’s huge east coast hub at Newark, New Jersey. The reason that it is so interesting from an enforcement prospective is that it is not foreign corruption but domestic corruption, therefore not subject to the foreign government official requirement of the FCPA. However, the actions of United’s former CEO, Jeff Smisek, in personally approving the benefit granted to favor Samson violated the company’s internal controls around gifts to government officials. That sounds suspiciously like a books and records violation of the FCPA. The $2.4 million civil penalty levied on United was in addition to its NPA settlement with the DOJ, which resulted in a penalty of $2.25 million. Former Chairman Samson also pled guilty for putting pressure on United to reinstitute a flight service which was near his weekend residence. At the time, United’s Code of Conduct prohibited “United employees from directly or indirectly making bribes, kickbacks or other improper payments to government officials, civil servants or anyone else to influence their acts or decisions” and that “[n]o gift may be offered or accepted if it will create a feeling of obligation, compromise judgment or appear to improperly influence the recipient.” Only the United Board of Director’s could grant a waiver to the code and none was sought or obtained by Smisek. The Order concluded, “The [Chairman’s] Route was initiated in violation of United’s policies.” Three key takeaways: It is very unusual for the FCPA to form the basis of a domestic bribery violation. A Code of Conduct can be an internal control. Even a CEO must follow internal controls. Learn more about your ad choices. Visit megaphone.fm/adchoices In 2016, one of the most interesting non-international focused FCPA enforcement actions was announced by the SEC. It involved a clear quid pro quo benefit paid out by United Airlines, Inc. to David Samson, the former chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity which has authority over, among other things, United’s operations at the company’s huge east coast hub at Newark, New Jersey.

The reason that it is so interesting from an enforcement prospective is that it is not foreign corruption but domestic corruption, therefore not subject to the foreign government official requirement of the FCPA. However, the actions of United’s former CEO, Jeff Smisek, in personally approving the benefit granted to favor Samson violated the company’s internal controls around gifts to government officials. That sounds suspiciously like a books and records violation of the FCPA. The $2.4 million civil penalty levied on United was in addition to its NPA settlement with the DOJ, which resulted in a penalty of $2.25 million. Former Chairman Samson also pled guilty for putting pressure on United to reinstitute a flight service which was near his weekend residence.

At the time, United’s Code of Conduct prohibited “United employees from directly or indirectly making bribes, kickbacks or other improper payments to government officials, civil servants or anyone else to influence their acts or decisions” and that “[n]o gift may be offered or accepted if it will create a feeling of obligation, compromise judgment or appear to improperly influence the recipient.” Only the United Board of Director’s could grant a waiver to the code and none was sought or obtained by Smisek. The Order concluded, “The [Chairman’s] Route was initiated in violation of United’s policies.”

Three key takeaways:

  1. It is very unusual for the FCPA to form the basis of a domestic bribery violation.
  2. A Code of Conduct can be an internal control.
  3. Even a CEO must follow internal controls.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 773 no Board of Directors’ oversight as an internal control Is a Board of Directors a compliance internal control? The clear answer is yes. In the 2020 FCPA Resource Guide, Hallmarks of an Effective Compliance Program, there are two specific references to the obligations of a Board in a best practices compliance program. One states, “Within a business organization, compliance begins with the Board of Directors and senior executives setting the proper tone for the rest of the company.” The second is found under the Hallmark entitled “Oversight, Autonomy and Resources,” which says the CCO should have “direct access to an organization’s governing authority, such as the Board of Directors and committees of the Board of Directors (e.g., the audit committee).” Further, under the U.S. Sentencing Guidelines, the Board must exercise reasonable oversight on the effectiveness of a company’s compliance program. The DOJ Prosecution Standards posed the following queries: Do the directors exercise independent review of a company’s compliance program, and are directors provided information sufficient to enable the exercise of independent judgment? The DOJ’s remarks drove home to me the absolute requirement for Board participation in any best practices or even effective anti-corruption compliance program. Three key takeaways: Board oversight over the compliance function is a separate internal control so document it and use it. Board must perform oversight over your company’s internal controls. Does your Board use the five principles for involvement in compliance internal controls? Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 16 Sep 2020 17:00:00 -0000 Board of Directors’ oversight as an internal control full Thomas Fox How does Board of Director oversight act as an internal control? Find out in today's edition of 31 Days to a More Effective Compliance Program. Is a Board of Directors a compliance internal control? The clear answer is yes. In the 2020 FCPA Resource Guide, Hallmarks of an Effective Compliance Program, there are two specific references to the obligations of a Board in a best practices compliance program. One states, “Within a business organization, compliance begins with the Board of Directors and senior executives setting the proper tone for the rest of the company.” The second is found under the Hallmark entitled “Oversight, Autonomy and Resources,” which says the CCO should have “direct access to an organization’s governing authority, such as the Board of Directors and committees of the Board of Directors (e.g., the audit committee).” Further, under the U.S. Sentencing Guidelines, the Board must exercise reasonable oversight on the effectiveness of a company’s compliance program. The DOJ Prosecution Standards posed the following queries: Do the directors exercise independent review of a company’s compliance program, and are directors provided information sufficient to enable the exercise of independent judgment? The DOJ’s remarks drove home to me the absolute requirement for Board participation in any best practices or even effective anti-corruption compliance program. Three key takeaways: Board oversight over the compliance function is a separate internal control so document it and use it. Board must perform oversight over your company’s internal controls. Does your Board use the five principles for involvement in compliance internal controls? Learn more about your ad choices. Visit megaphone.fm/adchoices Is a Board of Directors a compliance internal control? The clear answer is yes. In the 2020 FCPA Resource Guide, Hallmarks of an Effective Compliance Program, there are two specific references to the obligations of a Board in a best practices compliance program. One states, “Within a business organization, compliance begins with the Board of Directors and senior executives setting the proper tone for the rest of the company.” The second is found under the Hallmark entitled “Oversight, Autonomy and Resources,” which says the CCO should have “direct access to an organization’s governing authority, such as the Board of Directors and committees of the Board of Directors (e.g., the audit committee).”

Further, under the U.S. Sentencing Guidelines, the Board must exercise reasonable oversight on the effectiveness of a company’s compliance program. The DOJ Prosecution Standards posed the following queries: Do the directors exercise independent review of a company’s compliance program, and are directors provided information sufficient to enable the exercise of independent judgment? The DOJ’s remarks drove home to me the absolute requirement for Board participation in any best practices or even effective anti-corruption compliance program.

Three key takeaways:

  1. Board oversight over the compliance function is a separate internal control so document it and use it.
  2. Board must perform oversight over your company’s internal controls.
  3. Does your Board use the five principles for involvement in compliance internal controls?


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 638 no Internal controls for gifts, travel and entertainment It is reasonable to expect that internal controls over gifts, travel and entertainment be designed to ensure that they satisfy the criteria as defined in company policies. These are narrow, including a definition of the dollar limit, which must not be exceeded for gifts to be permissible, coupled with some subjective criteria such as the legality of the gifts for the recipient and whether the practice is customary within the country where the gift is delivered. The question I focus on is how to enforce the policies so that employees are not free to disregard them at will?  The key analysis is whether there are controls in place to enforce the policies and whether those controls are documented. There are four issues to evaluate: Is the correct level of person approving the payment/reimbursement for the gift? Are there specific controls, including signoffs, to demonstrate that the gift had a proper business purpose? Are the controls regarding gifts sufficiently preventative, rather than relying on detect controls? If controls are not followed, is that failure detected by other internal controls or the compliance protocols? Internal controls around gifts can be used in a variety of ways in your best practices compliance program. They can certainly be used to detect an issue and perhaps even prevent an issue from becoming a full-blown FCPA violation, however, by using some of the techniques you can move your compliance program to a proscriptive phase where you not only stop an issue from becoming a violation but through identification, you can move towards remediation as a part of your ongoing compliance efforts. The bottom line is good internal controls make for good business processes; if you can move your compliance program’s internal controls forward, you can help make them a part of your financial controls and thereby have a better run company.  Three key takeaways: Gifts, travel and entertainment compliance internal controls are low hanging fruit, pick them. Compliance internal controls can be both detect and prevent controls. Good compliance internal controls are good for business. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 15 Sep 2020 17:00:00 -0000 Internal controls for gifts, travel and entertainment full Thomas Fox Today, we consider how to construct internal controls around gifts, travel and entertainment in a best practices compliance program. It is reasonable to expect that internal controls over gifts, travel and entertainment be designed to ensure that they satisfy the criteria as defined in company policies. These are narrow, including a definition of the dollar limit, which must not be exceeded for gifts to be permissible, coupled with some subjective criteria such as the legality of the gifts for the recipient and whether the practice is customary within the country where the gift is delivered. The question I focus on is how to enforce the policies so that employees are not free to disregard them at will?  The key analysis is whether there are controls in place to enforce the policies and whether those controls are documented. There are four issues to evaluate: Is the correct level of person approving the payment/reimbursement for the gift? Are there specific controls, including signoffs, to demonstrate that the gift had a proper business purpose? Are the controls regarding gifts sufficiently preventative, rather than relying on detect controls? If controls are not followed, is that failure detected by other internal controls or the compliance protocols? Internal controls around gifts can be used in a variety of ways in your best practices compliance program. They can certainly be used to detect an issue and perhaps even prevent an issue from becoming a full-blown FCPA violation, however, by using some of the techniques you can move your compliance program to a proscriptive phase where you not only stop an issue from becoming a violation but through identification, you can move towards remediation as a part of your ongoing compliance efforts. The bottom line is good internal controls make for good business processes; if you can move your compliance program’s internal controls forward, you can help make them a part of your financial controls and thereby have a better run company.  Three key takeaways: Gifts, travel and entertainment compliance internal controls are low hanging fruit, pick them. Compliance internal controls can be both detect and prevent controls. Good compliance internal controls are good for business. Learn more about your ad choices. Visit megaphone.fm/adchoices It is reasonable to expect that internal controls over gifts, travel and entertainment be designed to ensure that they satisfy the criteria as defined in company policies. These are narrow, including a definition of the dollar limit, which must not be exceeded for gifts to be permissible, coupled with some subjective criteria such as the legality of the gifts for the recipient and whether the practice is customary within the country where the gift is delivered. The question I focus on is how to enforce the policies so that employees are not free to disregard them at will? 

The key analysis is whether there are controls in place to enforce the policies and whether those controls are documented. There are four issues to evaluate:

  1. Is the correct level of person approving the payment/reimbursement for the gift?
  2. Are there specific controls, including signoffs, to demonstrate that the gift had a proper business purpose?
  3. Are the controls regarding gifts sufficiently preventative, rather than relying on detect controls?
  4. If controls are not followed, is that failure detected by other internal controls or the compliance protocols?

Internal controls around gifts can be used in a variety of ways in your best practices compliance program. They can certainly be used to detect an issue and perhaps even prevent an issue from becoming a full-blown FCPA violation, however, by using some of the techniques you can move your compliance program to a proscriptive phase where you not only stop an issue from becoming a violation but through identification, you can move towards remediation as a part of your ongoing compliance efforts. The bottom line is good internal controls make for good business processes; if you can move your compliance program’s internal controls forward, you can help make them a part of your financial controls and thereby have a better run company. 

Three key takeaways:

  1. Gifts, travel and entertainment compliance internal controls are low hanging fruit, pick them.
  2. Compliance internal controls can be both detect and prevent controls.
  3. Good compliance internal controls are good for business.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 553 no Internal controls for third parties One of the questions GSK faced during the bribery and corruption investigation of its Chinese operations was how an allegedly massive bribery and corruption scheme occurred? Where were the appropriate internal controls? You might think that a company as large as GSK and one that had gone through the ringer of a prior DOJ investigation resulting in charges for off-label marketing and an attendant Corporate Integrity Agreement (CIA) might have such controls in place. It would be reasonable to expect that internal controls over gifts would be designed to ensure that all gifts satisfy the required criteria, as defined and interpreted in company policies. It should fall to compliance to finalize and approve a definition of permissible and non-permissible gifts, travel and entertainment and internal controls will follow from such definition or criteria set by the company. These criteria would include the amount of the spend, localized down into increased risk such the higher risk recognized in China. Within this context, there are four general internal controls to consider. 1) Is the correct level of person approving the payment/reimbursement?; 2) Are there specific controls (and signoffs) that the gift had proper business purpose?; 3) Are the controls regarding gifts sufficiently preventative, rather than relying on detect controls?; and 4) If controls are not followed, is that failure detected? Obviously, the use of third parties can be a powerful and effective way for a business to achieve its strategic goals. This may be one of the key reasons why third parties are still one of the leading indicia of bribery and corruption. Every compliance program should regularly review its third-party service providers and evaluate internal policies and procedures to ensure compliance. Three key takeaways: GSK continues to be an example of the lack of internal controls for third-parties in an effective compliance program. General areas of review for compliance internal controls. Third parties are still the highest risk of corruption related issues. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 14 Sep 2020 17:00:00 -0000 Internal controls for third parties full Thomas Fox How can you create effective internal controls for third parties? Find out in today's episode of 31 Days to a More Effective Compliance Program. One of the questions GSK faced during the bribery and corruption investigation of its Chinese operations was how an allegedly massive bribery and corruption scheme occurred? Where were the appropriate internal controls? You might think that a company as large as GSK and one that had gone through the ringer of a prior DOJ investigation resulting in charges for off-label marketing and an attendant Corporate Integrity Agreement (CIA) might have such controls in place. It would be reasonable to expect that internal controls over gifts would be designed to ensure that all gifts satisfy the required criteria, as defined and interpreted in company policies. It should fall to compliance to finalize and approve a definition of permissible and non-permissible gifts, travel and entertainment and internal controls will follow from such definition or criteria set by the company. These criteria would include the amount of the spend, localized down into increased risk such the higher risk recognized in China. Within this context, there are four general internal controls to consider. 1) Is the correct level of person approving the payment/reimbursement?; 2) Are there specific controls (and signoffs) that the gift had proper business purpose?; 3) Are the controls regarding gifts sufficiently preventative, rather than relying on detect controls?; and 4) If controls are not followed, is that failure detected? Obviously, the use of third parties can be a powerful and effective way for a business to achieve its strategic goals. This may be one of the key reasons why third parties are still one of the leading indicia of bribery and corruption. Every compliance program should regularly review its third-party service providers and evaluate internal policies and procedures to ensure compliance. Three key takeaways: GSK continues to be an example of the lack of internal controls for third-parties in an effective compliance program. General areas of review for compliance internal controls. Third parties are still the highest risk of corruption related issues. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the questions GSK faced during the bribery and corruption investigation of its Chinese operations was how an allegedly massive bribery and corruption scheme occurred? Where were the appropriate internal controls? You might think that a company as large as GSK and one that had gone through the ringer of a prior DOJ investigation resulting in charges for off-label marketing and an attendant Corporate Integrity Agreement (CIA) might have such controls in place.

It would be reasonable to expect that internal controls over gifts would be designed to ensure that all gifts satisfy the required criteria, as defined and interpreted in company policies. It should fall to compliance to finalize and approve a definition of permissible and non-permissible gifts, travel and entertainment and internal controls will follow from such definition or criteria set by the company. These criteria would include the amount of the spend, localized down into increased risk such the higher risk recognized in China. Within this context, there are four general internal controls to consider. 1) Is the correct level of person approving the payment/reimbursement?; 2) Are there specific controls (and signoffs) that the gift had proper business purpose?; 3) Are the controls regarding gifts sufficiently preventative, rather than relying on detect controls?; and 4) If controls are not followed, is that failure detected?

Obviously, the use of third parties can be a powerful and effective way for a business to achieve its strategic goals. This may be one of the key reasons why third parties are still one of the leading indicia of bribery and corruption. Every compliance program should regularly review its third-party service providers and evaluate internal policies and procedures to ensure compliance.

Three key takeaways:

  1. GSK continues to be an example of the lack of internal controls for third-parties in an effective compliance program.
  2. General areas of review for compliance internal controls.
  3. Third parties are still the highest risk of corruption related issues.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 590 no Implementing internal controls Next, I consider some ways in which a compliance professional can work to implement internal controls in a multi-national organization. The first step is to convert your company’s compliance risks into internal control objectives. The internal control objectives are then given to each business unit with instructions to develop controls, which meet the objectives. This process should allow more of a fine-tuning approach within existing systems than the development of specific controls by corporate which all business units must adopt and will give the business unit a sense of buy-in and participation in the process.  Good compliance internal controls are not some standalone protective measure. They can help to make a company run more efficiently as the internal controls that prevent FCPA violations are the same ones that prevent fraud in the workplace. The presence of good internal controls saves money by preventing fraud. It is a business best practice to prevent fraud, which includes preventing corruption. One need only consider Ethisphere and its annual survey of the world’s most ethical companies because they exceed the Standard & Poor’s index of average profits and growth by a factor of 4X. A key reason such companies have better than average profitability is that they have better internal controls. Three key takeaways: Convert your compliance risks into internal control objectives. As with many components of a best practices compliance program, tone at the top is critical. If you receive pushback from the business folks, always remember, good internal controls make for a better, more efficient and more profitable business. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 11 Sep 2020 17:00:00 -0000 Implementing internal controls full Thomas Fox In this episode, I consider some ways in which a compliance professional can work to implement internal controls in a multi-national organization. Next, I consider some ways in which a compliance professional can work to implement internal controls in a multi-national organization. The first step is to convert your company’s compliance risks into internal control objectives. The internal control objectives are then given to each business unit with instructions to develop controls, which meet the objectives. This process should allow more of a fine-tuning approach within existing systems than the development of specific controls by corporate which all business units must adopt and will give the business unit a sense of buy-in and participation in the process.  Good compliance internal controls are not some standalone protective measure. They can help to make a company run more efficiently as the internal controls that prevent FCPA violations are the same ones that prevent fraud in the workplace. The presence of good internal controls saves money by preventing fraud. It is a business best practice to prevent fraud, which includes preventing corruption. One need only consider Ethisphere and its annual survey of the world’s most ethical companies because they exceed the Standard & Poor’s index of average profits and growth by a factor of 4X. A key reason such companies have better than average profitability is that they have better internal controls. Three key takeaways: Convert your compliance risks into internal control objectives. As with many components of a best practices compliance program, tone at the top is critical. If you receive pushback from the business folks, always remember, good internal controls make for a better, more efficient and more profitable business. Learn more about your ad choices. Visit megaphone.fm/adchoices Next, I consider some ways in which a compliance professional can work to implement internal controls in a multi-national organization. The first step is to convert your company’s compliance risks into internal control objectives. The internal control objectives are then given to each business unit with instructions to develop controls, which meet the objectives. This process should allow more of a fine-tuning approach within existing systems than the development of specific controls by corporate which all business units must adopt and will give the business unit a sense of buy-in and participation in the process. 

Good compliance internal controls are not some standalone protective measure. They can help to make a company run more efficiently as the internal controls that prevent FCPA violations are the same ones that prevent fraud in the workplace. The presence of good internal controls saves money by preventing fraud. It is a business best practice to prevent fraud, which includes preventing corruption. One need only consider Ethisphere and its annual survey of the world’s most ethical companies because they exceed the Standard & Poor’s index of average profits and growth by a factor of 4X. A key reason such companies have better than average profitability is that they have better internal controls.

Three key takeaways:

  1. Convert your compliance risks into internal control objectives.
  2. As with many components of a best practices compliance program, tone at the top is critical.
  3. If you receive pushback from the business folks, always remember, good internal controls make for a better, more efficient and more profitable business.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 801 no Mapping Internal Controls As they made clear with several FCPA enforcement actions in 2020, the SEC has continued to emphasize the accounting provisions of the FCPA, specifically the internal controls provisions. Charles Cain, the Chief, FCPA Unit; Division of Enforcement of the SEC, reiterated that the SEC is committed to protecting investors in U.S. public companies and those which list other securities in the U.S., through enforcement of the accounting provisions, including internal controls provisions of the FCPA. The reason is straightforward; a company with rigorous internal compliance controls is better able to prevent, detect and remedy any FCPA violations that may occur. What can you do around the FCPA’s requirements for internal controls and continued SEC enforcement emphasis? I would suggest that you begin with an exercise where you map the internal controls your company has in place to the indicia of the Ten Hallmarks of an Effective Compliance Program, as set out in the 2012 FCPA Guidance. While most compliance practitioners are familiar with the Hallmarks, you may not be as familiar with standards for internal controls. I would suggest that you begin with the COSO 2013 Internal Controls Framework as your starting point. As a CCO or compliance practitioner, this is an exercise that you can engage in at no cost. You simply investigate and note what internal controls you have in place and how they may be a part of your anti-corruption efforts going forward. Compliance is a straightforward exercise; this does not mean that it is easy, you do have to work at it so that you will simply not have a paper, “check the box”, program. But using the excuse that you have limited resources is simply an excuse and a rather poor one at that. While the clear lesson from the BHP enforcement action is that you are required to have effective internal controls in place, by engaging in this mapping exercise you can then figure out what you have and, more importantly, what internal compliance controls that you do not have and need to institute. Three key takeaways: Learn the internal controls your company currently has in place. Map your compliance internal controls to the COSO 2013 Internal Controls Framework. Use your gap analysis as a basis for remediation. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 10 Sep 2020 17:00:00 -0000 Mapping Internal Controls full Thomas Fox What can you do around the FCPA’s requirements for internal controls and continued SEC enforcement emphasis? Find out in today's episode of 31 Days to a More Effective Compliance Program. As they made clear with several FCPA enforcement actions in 2020, the SEC has continued to emphasize the accounting provisions of the FCPA, specifically the internal controls provisions. Charles Cain, the Chief, FCPA Unit; Division of Enforcement of the SEC, reiterated that the SEC is committed to protecting investors in U.S. public companies and those which list other securities in the U.S., through enforcement of the accounting provisions, including internal controls provisions of the FCPA. The reason is straightforward; a company with rigorous internal compliance controls is better able to prevent, detect and remedy any FCPA violations that may occur. What can you do around the FCPA’s requirements for internal controls and continued SEC enforcement emphasis? I would suggest that you begin with an exercise where you map the internal controls your company has in place to the indicia of the Ten Hallmarks of an Effective Compliance Program, as set out in the 2012 FCPA Guidance. While most compliance practitioners are familiar with the Hallmarks, you may not be as familiar with standards for internal controls. I would suggest that you begin with the COSO 2013 Internal Controls Framework as your starting point. As a CCO or compliance practitioner, this is an exercise that you can engage in at no cost. You simply investigate and note what internal controls you have in place and how they may be a part of your anti-corruption efforts going forward. Compliance is a straightforward exercise; this does not mean that it is easy, you do have to work at it so that you will simply not have a paper, “check the box”, program. But using the excuse that you have limited resources is simply an excuse and a rather poor one at that. While the clear lesson from the BHP enforcement action is that you are required to have effective internal controls in place, by engaging in this mapping exercise you can then figure out what you have and, more importantly, what internal compliance controls that you do not have and need to institute. Three key takeaways: Learn the internal controls your company currently has in place. Map your compliance internal controls to the COSO 2013 Internal Controls Framework. Use your gap analysis as a basis for remediation. Learn more about your ad choices. Visit megaphone.fm/adchoices As they made clear with several FCPA enforcement actions in 2020, the SEC has continued to emphasize the accounting provisions of the FCPA, specifically the internal controls provisions. Charles Cain, the Chief, FCPA Unit; Division of Enforcement of the SEC, reiterated that the SEC is committed to protecting investors in U.S. public companies and those which list other securities in the U.S., through enforcement of the accounting provisions, including internal controls provisions of the FCPA. The reason is straightforward; a company with rigorous internal compliance controls is better able to prevent, detect and remedy any FCPA violations that may occur.

What can you do around the FCPA’s requirements for internal controls and continued SEC enforcement emphasis? I would suggest that you begin with an exercise where you map the internal controls your company has in place to the indicia of the Ten Hallmarks of an Effective Compliance Program, as set out in the 2012 FCPA Guidance. While most compliance practitioners are familiar with the Hallmarks, you may not be as familiar with standards for internal controls. I would suggest that you begin with the COSO 2013 Internal Controls Framework as your starting point.

As a CCO or compliance practitioner, this is an exercise that you can engage in at no cost. You simply investigate and note what internal controls you have in place and how they may be a part of your anti-corruption efforts going forward. Compliance is a straightforward exercise; this does not mean that it is easy, you do have to work at it so that you will simply not have a paper, “check the box”, program. But using the excuse that you have limited resources is simply an excuse and a rather poor one at that. While the clear lesson from the BHP enforcement action is that you are required to have effective internal controls in place, by engaging in this mapping exercise you can then figure out what you have and, more importantly, what internal compliance controls that you do not have and need to institute.

Three key takeaways:

  1. Learn the internal controls your company currently has in place.
  2. Map your compliance internal controls to the COSO 2013 Internal Controls Framework.
  3. Use your gap analysis as a basis for remediation.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 596 no Risk assessments and internal controls Next, I will review how to use the risk assessment you have performed as a tool to provide a structured approach to establishing effective internal controls. After preparation of the risk assessment, the next step is to prioritize the listing of the risks and which locations they are common. This begins by mapping existing internal controls to risks and then assessing whether the internal controls are sufficient to mitigate the risks.  One of the biggest risks under the FCPA is where sales are conducted through third parties. If your company is moving to new geographic markets or new products and does not plan to use an internal sales team to facilitate these new efforts it presents a high compliance risk. The compliance function should understand the corporate or business unit controls over the international business in addition to the necessary controls over agents. Some of the questions you might consider are the following: Is there a U.S. based international sales manager who is responsible for growing the business? What is the incentive compensation plan? How good are the SODs? In other words, can the international sales manager unilaterally make high-risk decisions, or must a senior officer of the business unit or the corporate home office be part of the approval process? Finally, and in a point not to be forgotten or dismissed, how are these internal controls documented? What about a situation in opposite to the above scenario, where your company’s primary sales channel uses a U.S. based sales force which only travels to locations outside the U.S. for temporary visits of generally short duration. This situation minimizes, retains and shifts some compliance risks. The minimized compliance risks come from the lessening on the reliance of third parties so that a company, at least in theory, would have more control over its own work force than those employed outside the company. The retained risks are the risks associated with gifts, travel and entertainment; approval of credit terms to customers; product pricing; special arrangements with customers such as providing product samples; knowing who the ultimate customer is and where the goods are ultimately shipped; and use of freight forwarders and customs agents. Shifted risks are created if there is no physical location outside the U.S. because the accounting must be done in the U.S. This means that compliance risks regarding the accounting function simply shift to the U.S. accounting department where transactions are processed and recorded and where the financial statements are prepared.  These identified risks need to be subject to appropriate internal controls because it is well established that the issuance of a Code of Conduct and/or compliance policy and training of said policy’s requirements is a good practice, but it does not provide reasonable assurance that employees will comply with the policies. What is needed are written procedures and work instructions, in the native language of the respective employees, that defines exactly what the procedures to be performed are and how they will be evidenced. As difficult as it is for U.S. employees to translate, by themselves, what it means to comply with policies, it may be significantly more difficult for employees outside the U.S., not only due to language but also due to traditional local business practices, cultures and customs. Three key takeaways: Third party risks are still your highest risks under the FCPA so use your internal controls appropriately to help prevent this risk from becoming a violation.  Use mapping and a gap analysis to collate risks to existing controls.  Always consider the regional and geographic variances.  Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 09 Sep 2020 17:00:00 -0000 Risk assessments and internal controls full Thomas Fox In today's episode, I will review how to use the risk assessment you have performed as a tool to provide a structured approach to establishing effective internal controls. Next, I will review how to use the risk assessment you have performed as a tool to provide a structured approach to establishing effective internal controls. After preparation of the risk assessment, the next step is to prioritize the listing of the risks and which locations they are common. This begins by mapping existing internal controls to risks and then assessing whether the internal controls are sufficient to mitigate the risks.  One of the biggest risks under the FCPA is where sales are conducted through third parties. If your company is moving to new geographic markets or new products and does not plan to use an internal sales team to facilitate these new efforts it presents a high compliance risk. The compliance function should understand the corporate or business unit controls over the international business in addition to the necessary controls over agents. Some of the questions you might consider are the following: Is there a U.S. based international sales manager who is responsible for growing the business? What is the incentive compensation plan? How good are the SODs? In other words, can the international sales manager unilaterally make high-risk decisions, or must a senior officer of the business unit or the corporate home office be part of the approval process? Finally, and in a point not to be forgotten or dismissed, how are these internal controls documented? What about a situation in opposite to the above scenario, where your company’s primary sales channel uses a U.S. based sales force which only travels to locations outside the U.S. for temporary visits of generally short duration. This situation minimizes, retains and shifts some compliance risks. The minimized compliance risks come from the lessening on the reliance of third parties so that a company, at least in theory, would have more control over its own work force than those employed outside the company. The retained risks are the risks associated with gifts, travel and entertainment; approval of credit terms to customers; product pricing; special arrangements with customers such as providing product samples; knowing who the ultimate customer is and where the goods are ultimately shipped; and use of freight forwarders and customs agents. Shifted risks are created if there is no physical location outside the U.S. because the accounting must be done in the U.S. This means that compliance risks regarding the accounting function simply shift to the U.S. accounting department where transactions are processed and recorded and where the financial statements are prepared.  These identified risks need to be subject to appropriate internal controls because it is well established that the issuance of a Code of Conduct and/or compliance policy and training of said policy’s requirements is a good practice, but it does not provide reasonable assurance that employees will comply with the policies. What is needed are written procedures and work instructions, in the native language of the respective employees, that defines exactly what the procedures to be performed are and how they will be evidenced. As difficult as it is for U.S. employees to translate, by themselves, what it means to comply with policies, it may be significantly more difficult for employees outside the U.S., not only due to language but also due to traditional local business practices, cultures and customs. Three key takeaways: Third party risks are still your highest risks under the FCPA so use your internal controls appropriately to help prevent this risk from becoming a violation.  Use mapping and a gap analysis to collate risks to existing controls.  Always consider the regional and geographic variances.  Learn more about your ad choices. Visit megaphone.fm/adchoices Next, I will review how to use the risk assessment you have performed as a tool to provide a structured approach to establishing effective internal controls. After preparation of the risk assessment, the next step is to prioritize the listing of the risks and which locations they are common. This begins by mapping existing internal controls to risks and then assessing whether the internal controls are sufficient to mitigate the risks. 

One of the biggest risks under the FCPA is where sales are conducted through third parties. If your company is moving to new geographic markets or new products and does not plan to use an internal sales team to facilitate these new efforts it presents a high compliance risk. The compliance function should understand the corporate or business unit controls over the international business in addition to the necessary controls over agents. Some of the questions you might consider are the following: Is there a U.S. based international sales manager who is responsible for growing the business? What is the incentive compensation plan? How good are the SODs? In other words, can the international sales manager unilaterally make high-risk decisions, or must a senior officer of the business unit or the corporate home office be part of the approval process? Finally, and in a point not to be forgotten or dismissed, how are these internal controls documented?

What about a situation in opposite to the above scenario, where your company’s primary sales channel uses a U.S. based sales force which only travels to locations outside the U.S. for temporary visits of generally short duration. This situation minimizes, retains and shifts some compliance risks. The minimized compliance risks come from the lessening on the reliance of third parties so that a company, at least in theory, would have more control over its own work force than those employed outside the company. The retained risks are the risks associated with gifts, travel and entertainment; approval of credit terms to customers; product pricing; special arrangements with customers such as providing product samples; knowing who the ultimate customer is and where the goods are ultimately shipped; and use of freight forwarders and customs agents. Shifted risks are created if there is no physical location outside the U.S. because the accounting must be done in the U.S. This means that compliance risks regarding the accounting function simply shift to the U.S. accounting department where transactions are processed and recorded and where the financial statements are prepared. 

These identified risks need to be subject to appropriate internal controls because it is well established that the issuance of a Code of Conduct and/or compliance policy and training of said policy’s requirements is a good practice, but it does not provide reasonable assurance that employees will comply with the policies. What is needed are written procedures and work instructions, in the native language of the respective employees, that defines exactly what the procedures to be performed are and how they will be evidenced. As difficult as it is for U.S. employees to translate, by themselves, what it means to comply with policies, it may be significantly more difficult for employees outside the U.S., not only due to language but also due to traditional local business practices, cultures and customs.

Three key takeaways:

  1. Third party risks are still your highest risks under the FCPA so use your internal controls appropriately to help prevent this risk from becoming a violation. 
  2. Use mapping and a gap analysis to collate risks to existing controls. 
  3. Always consider the regional and geographic variances. 


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 654 Assessing internal controls in international operations How should you assess your internal controls regime for international operations? It is incumbent that you need to review as much information as you can to understand the financial and operational structure of an entity and how it is integrated with the corporate headquarters, or the U.S. business unit’s financial and operation structure, if the foreign operation is part of a U.S. business unit.  You could begin with the TI-CPI to garner a sense of the reputation of the country in which your business unit is located, as well as the CPI for all other countries in which the location either markets business or has current customers. Another area for inquiry or review is the scope of your foreign operations. This means you will need to consider your sales model, whether employee based or primarily using third party representatives. You will also need to consider if such third-party representatives are coming into a commercial relationship with your company through your supply chain. Other areas of inquiry should include whether your company’s finance and accounting staff produce financial statements that are integrated into the parent’s financial statements; whether your international business locations utilize a local bank account for local sales receipts as well as funds transfers from the U.S. and whether the account has local check signers and whether dual signatures are required on the checks. You may also want to consider the extent to which disbursements are made in the local currency and, of course, is there a local petty cash fund. Three key takeaways: You must understand the financial and operational structure of your company and how that structure outside the U.S. is integrated with the corporate headquarters. Are your financial statements and reporting systems integrated? Always consider the fraud triangle.  Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 08 Sep 2020 17:00:00 -0000 Assessing internal controls in international operations full Thomas Fox How should you assess your internal controls regime for international operations? Find out in today's 31 Days to a More Effective Compliance Program. How should you assess your internal controls regime for international operations? It is incumbent that you need to review as much information as you can to understand the financial and operational structure of an entity and how it is integrated with the corporate headquarters, or the U.S. business unit’s financial and operation structure, if the foreign operation is part of a U.S. business unit.  You could begin with the TI-CPI to garner a sense of the reputation of the country in which your business unit is located, as well as the CPI for all other countries in which the location either markets business or has current customers. Another area for inquiry or review is the scope of your foreign operations. This means you will need to consider your sales model, whether employee based or primarily using third party representatives. You will also need to consider if such third-party representatives are coming into a commercial relationship with your company through your supply chain. Other areas of inquiry should include whether your company’s finance and accounting staff produce financial statements that are integrated into the parent’s financial statements; whether your international business locations utilize a local bank account for local sales receipts as well as funds transfers from the U.S. and whether the account has local check signers and whether dual signatures are required on the checks. You may also want to consider the extent to which disbursements are made in the local currency and, of course, is there a local petty cash fund. Three key takeaways: You must understand the financial and operational structure of your company and how that structure outside the U.S. is integrated with the corporate headquarters. Are your financial statements and reporting systems integrated? Always consider the fraud triangle.  Learn more about your ad choices. Visit megaphone.fm/adchoices How should you assess your internal controls regime for international operations? It is incumbent that you need to review as much information as you can to understand the financial and operational structure of an entity and how it is integrated with the corporate headquarters, or the U.S. business unit’s financial and operation structure, if the foreign operation is part of a U.S. business unit. 

You could begin with the TI-CPI to garner a sense of the reputation of the country in which your business unit is located, as well as the CPI for all other countries in which the location either markets business or has current customers. Another area for inquiry or review is the scope of your foreign operations. This means you will need to consider your sales model, whether employee based or primarily using third party representatives. You will also need to consider if such third-party representatives are coming into a commercial relationship with your company through your supply chain.

Other areas of inquiry should include whether your company’s finance and accounting staff produce financial statements that are integrated into the parent’s financial statements; whether your international business locations utilize a local bank account for local sales receipts as well as funds transfers from the U.S. and whether the account has local check signers and whether dual signatures are required on the checks. You may also want to consider the extent to which disbursements are made in the local currency and, of course, is there a local petty cash fund.

Three key takeaways:

  1. You must understand the financial and operational structure of your company and how that structure outside the U.S. is integrated with the corporate headquarters.
  2. Are your financial statements and reporting systems integrated?
  3. Always consider the fraud triangle. 


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 776 no Internal controls in international locations Next, I want to consider some of the issues around internal controls outside the U.S. and why your company’s internal controls might require changes for different countries across the globe. However, this provides an opportunity to further operationalize your compliance program through internal controls more narrowly tailored to mirror your business practices. Every CCO should consider entity-wide internal controls for a company. Under the FCPA accounting provisions, issuers can be held liable for the conduct of their foreign subsidiaries, even though the improper conduct occurred outside of the U.S. The scope of liability is based on the issuer’s incorporation of the subsidiary’s financial statements in its own records and SEC filings. So, as with the use of third-party distributors to sell product, FCPA enforcement looks past the structure of the transaction and makes enforcement decisions based upon the substance. While a CCO should expect (or at least hope) that internal controls at locations outside the U.S. are of the same effectiveness as internal controls within U.S. business units and at the U.S. corporate office; unfortunately, that might not always be the case. It is often the case that corporate level internal controls are stronger than those in foreign business units. There may well be several reasons for this. First, the CFO may be paying closer attention to the corporate level internal controls, with the idea that the corporate level internal controls are the final “filter” to detect issues. This follows partly from the focus in most companies on the controls over financial reporting, which does not include all controls needed for compliance. A second reason is that many companies were built through acquisitions, resulting in many business units (both in and outside the U.S.) having completely different accounting, ERP and internal control systems than the corporate office. There is often a tendency to leave acquired companies in the state in which they were acquired, rather than trying to integrate their controls and conform them to those of current business units. After all, the reason for the acquisition was the profitability of the acquired company and nobody wants to be accused of negatively impacting profitability. Three key takeaways: Modifying your internal controls can work to more fully operationalize your compliance program. Check the effectiveness of your internal controls for your international locations. Revisit your internal controls when a country or region experience large growth or other disruption. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 04 Sep 2020 17:00:00 -0000 Internal controls in international locations full Thomas Fox What are some of the issues around internal controls outside the U.S. and why your company’s internal controls might require changes for different countries. Next, I want to consider some of the issues around internal controls outside the U.S. and why your company’s internal controls might require changes for different countries across the globe. However, this provides an opportunity to further operationalize your compliance program through internal controls more narrowly tailored to mirror your business practices. Every CCO should consider entity-wide internal controls for a company. Under the FCPA accounting provisions, issuers can be held liable for the conduct of their foreign subsidiaries, even though the improper conduct occurred outside of the U.S. The scope of liability is based on the issuer’s incorporation of the subsidiary’s financial statements in its own records and SEC filings. So, as with the use of third-party distributors to sell product, FCPA enforcement looks past the structure of the transaction and makes enforcement decisions based upon the substance. While a CCO should expect (or at least hope) that internal controls at locations outside the U.S. are of the same effectiveness as internal controls within U.S. business units and at the U.S. corporate office; unfortunately, that might not always be the case. It is often the case that corporate level internal controls are stronger than those in foreign business units. There may well be several reasons for this. First, the CFO may be paying closer attention to the corporate level internal controls, with the idea that the corporate level internal controls are the final “filter” to detect issues. This follows partly from the focus in most companies on the controls over financial reporting, which does not include all controls needed for compliance. A second reason is that many companies were built through acquisitions, resulting in many business units (both in and outside the U.S.) having completely different accounting, ERP and internal control systems than the corporate office. There is often a tendency to leave acquired companies in the state in which they were acquired, rather than trying to integrate their controls and conform them to those of current business units. After all, the reason for the acquisition was the profitability of the acquired company and nobody wants to be accused of negatively impacting profitability. Three key takeaways: Modifying your internal controls can work to more fully operationalize your compliance program. Check the effectiveness of your internal controls for your international locations. Revisit your internal controls when a country or region experience large growth or other disruption. Learn more about your ad choices. Visit megaphone.fm/adchoices Next, I want to consider some of the issues around internal controls outside the U.S. and why your company’s internal controls might require changes for different countries across the globe. However, this provides an opportunity to further operationalize your compliance program through internal controls more narrowly tailored to mirror your business practices. Every CCO should consider entity-wide internal controls for a company. Under the FCPA accounting provisions, issuers can be held liable for the conduct of their foreign subsidiaries, even though the improper conduct occurred outside of the U.S. The scope of liability is based on the issuer’s incorporation of the subsidiary’s financial statements in its own records and SEC filings. So, as with the use of third-party distributors to sell product, FCPA enforcement looks past the structure of the transaction and makes enforcement decisions based upon the substance.

While a CCO should expect (or at least hope) that internal controls at locations outside the U.S. are of the same effectiveness as internal controls within U.S. business units and at the U.S. corporate office; unfortunately, that might not always be the case. It is often the case that corporate level internal controls are stronger than those in foreign business units. There may well be several reasons for this. First, the CFO may be paying closer attention to the corporate level internal controls, with the idea that the corporate level internal controls are the final “filter” to detect issues. This follows partly from the focus in most companies on the controls over financial reporting, which does not include all controls needed for compliance. A second reason is that many companies were built through acquisitions, resulting in many business units (both in and outside the U.S.) having completely different accounting, ERP and internal control systems than the corporate office. There is often a tendency to leave acquired companies in the state in which they were acquired, rather than trying to integrate their controls and conform them to those of current business units. After all, the reason for the acquisition was the profitability of the acquired company and nobody wants to be accused of negatively impacting profitability.

Three key takeaways:

  1. Modifying your internal controls can work to more fully operationalize your compliance program.
  2. Check the effectiveness of your internal controls for your international locations.
  3. Revisit your internal controls when a country or region experience large growth or other disruption.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 648 no The four key internal controls for compliance There are four significant controls that I would suggest the compliance practitioner implement initially. They are: 1) DOA; 2) maintenance of the vendor master file; 3) contracts with third parties; and 4) movement of cash/currency. Your DOA should reflect the impact of compliance risk including both transactions and geographic location so that a higher level of approval for matters involving third parties, for fund transfers and invoice payments to countries outside the U.S. would be required inside your company. The vendor master file, can be one of the most powerful preventativecontrol tools largely because payments to fictitious vendors are one of the most common occupational frauds. Near and dear to my heart as a lawyer are contracts with third parties. These can be a very effective internal control which works to prevent nefarious conduct rather than simply as a detect control. The Hewlett-Packard (HP) FCPA enforcement action was an excellent example of the lack of internal control over the disbursements of funds and movement of currency because you had the country manager delivering bags of cash to a Polish government official to obtain or retain business. All situations where funds can be sent outside the U.S., including such methods accounts payable computer checks, manual checks, wire transfers, replenishment of petty cash, loans or advances, should all be reviewed from the compliance risk standpoint. This means you need to identify the ways in which a country manager or a sales manager could cause funds to be transferred to their control and to conceal the true nature of the use of the funds within the accounting system. To prevent these types of activities internal controls, need to be in place. This means all wire transfers outside the U.S. should have defined approvals in the DOA, and the persons who execute the wire transfers should be required to evidence agreement of the approvals to the DOA and wire transfer requests going out of the U.S. should always require dual approvals. Lastly, wire transfer requests going outside the U.S. should be required to include a description of proper business purpose. The bottom line is that internal controls are just good financial controls. The internal controls that detail requirements for third party representatives in the compliance context will help to detect fraud, which could well lead to bribery and corruption.  Three key takeaways: Remember the top four internal controls for an effective compliance program. Effective internal controls should do more than protect but also prevent internal program violations. Effective internal compliance controls are good financial controls. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 03 Sep 2020 17:00:00 -0000 The four key internal controls for compliance full Thomas Fox What are the four key internal controls for compliance? Find out in today's episode of 31 Days to a More Effective Compliance Program. There are four significant controls that I would suggest the compliance practitioner implement initially. They are: 1) DOA; 2) maintenance of the vendor master file; 3) contracts with third parties; and 4) movement of cash/currency. Your DOA should reflect the impact of compliance risk including both transactions and geographic location so that a higher level of approval for matters involving third parties, for fund transfers and invoice payments to countries outside the U.S. would be required inside your company. The vendor master file, can be one of the most powerful preventativecontrol tools largely because payments to fictitious vendors are one of the most common occupational frauds. Near and dear to my heart as a lawyer are contracts with third parties. These can be a very effective internal control which works to prevent nefarious conduct rather than simply as a detect control. The Hewlett-Packard (HP) FCPA enforcement action was an excellent example of the lack of internal control over the disbursements of funds and movement of currency because you had the country manager delivering bags of cash to a Polish government official to obtain or retain business. All situations where funds can be sent outside the U.S., including such methods accounts payable computer checks, manual checks, wire transfers, replenishment of petty cash, loans or advances, should all be reviewed from the compliance risk standpoint. This means you need to identify the ways in which a country manager or a sales manager could cause funds to be transferred to their control and to conceal the true nature of the use of the funds within the accounting system. To prevent these types of activities internal controls, need to be in place. This means all wire transfers outside the U.S. should have defined approvals in the DOA, and the persons who execute the wire transfers should be required to evidence agreement of the approvals to the DOA and wire transfer requests going out of the U.S. should always require dual approvals. Lastly, wire transfer requests going outside the U.S. should be required to include a description of proper business purpose. The bottom line is that internal controls are just good financial controls. The internal controls that detail requirements for third party representatives in the compliance context will help to detect fraud, which could well lead to bribery and corruption.  Three key takeaways: Remember the top four internal controls for an effective compliance program. Effective internal controls should do more than protect but also prevent internal program violations. Effective internal compliance controls are good financial controls. Learn more about your ad choices. Visit megaphone.fm/adchoices There are four significant controls that I would suggest the compliance practitioner implement initially. They are: 1) DOA; 2) maintenance of the vendor master file; 3) contracts with third parties; and 4) movement of cash/currency.

Your DOA should reflect the impact of compliance risk including both transactions and geographic location so that a higher level of approval for matters involving third parties, for fund transfers and invoice payments to countries outside the U.S. would be required inside your company. The vendor master file, can be one of the most powerful preventativecontrol tools largely because payments to fictitious vendors are one of the most common occupational frauds. Near and dear to my heart as a lawyer are contracts with third parties. These can be a very effective internal control which works to prevent nefarious conduct rather than simply as a detect control. The Hewlett-Packard (HP) FCPA enforcement action was an excellent example of the lack of internal control over the disbursements of funds and movement of currency because you had the country manager delivering bags of cash to a Polish government official to obtain or retain business. All situations where funds can be sent outside the U.S., including such methods accounts payable computer checks, manual checks, wire transfers, replenishment of petty cash, loans or advances, should all be reviewed from the compliance risk standpoint. This means you need to identify the ways in which a country manager or a sales manager could cause funds to be transferred to their control and to conceal the true nature of the use of the funds within the accounting system.

To prevent these types of activities internal controls, need to be in place. This means all wire transfers outside the U.S. should have defined approvals in the DOA, and the persons who execute the wire transfers should be required to evidence agreement of the approvals to the DOA and wire transfer requests going out of the U.S. should always require dual approvals. Lastly, wire transfer requests going outside the U.S. should be required to include a description of proper business purpose.

The bottom line is that internal controls are just good financial controls. The internal controls that detail requirements for third party representatives in the compliance context will help to detect fraud, which could well lead to bribery and corruption.

 Three key takeaways:

  1. Remember the top four internal controls for an effective compliance program.
  2. Effective internal controls should do more than protect but also prevent internal program violations.
  3. Effective internal compliance controls are good financial controls.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 699 no Discipline and rigor in your internal controls New York Times columnist David Brooks’ thoughts on building and maintaining order inform the discussion on rigor in your internal controls. In internal controls, I believe it is incumbent to consider not only the most obvious risk areas for your internal controls but also the universe of potential transactions within the operations of a company. There is a clear need for rigor in your internal controls protocols and adherence to that rigor can increase operationalization around the internal controls a company should consider including gifts, travel and entertainment expenses. Brooks said, “Building and maintaining order…requires toughness of mind and rigid discipline to properly serve your own work.” By having the rigor to institute and enforce the types of internal controls Howell has identified, you can go a long way towards detecting and, more importantly, preventing a FCPA violation from occurring. Three key takeaways: You must maintain rigor around your internal controls. Controls against fraud can also help to prevent corruption. Building and maintaining good internal controls requires rigor. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 02 Sep 2020 17:00:00 -0000 Discipline and rigor in your internal controls full Thomas Fox How can you maintain discipline and rigor in your internal controls? Find out in today's episode on 31 Days to a More Effective Compliance Program. New York Times columnist David Brooks’ thoughts on building and maintaining order inform the discussion on rigor in your internal controls. In internal controls, I believe it is incumbent to consider not only the most obvious risk areas for your internal controls but also the universe of potential transactions within the operations of a company. There is a clear need for rigor in your internal controls protocols and adherence to that rigor can increase operationalization around the internal controls a company should consider including gifts, travel and entertainment expenses. Brooks said, “Building and maintaining order…requires toughness of mind and rigid discipline to properly serve your own work.” By having the rigor to institute and enforce the types of internal controls Howell has identified, you can go a long way towards detecting and, more importantly, preventing a FCPA violation from occurring. Three key takeaways: You must maintain rigor around your internal controls. Controls against fraud can also help to prevent corruption. Building and maintaining good internal controls requires rigor. Learn more about your ad choices. Visit megaphone.fm/adchoices New York Times columnist David Brooks’ thoughts on building and maintaining order inform the discussion on rigor in your internal controls. In internal controls, I believe it is incumbent to consider not only the most obvious risk areas for your internal controls but also the universe of potential transactions within the operations of a company. There is a clear need for rigor in your internal controls protocols and adherence to that rigor can increase operationalization around the internal controls a company should consider including gifts, travel and entertainment expenses.

Brooks said, “Building and maintaining order…requires toughness of mind and rigid discipline to properly serve your own work.” By having the rigor to institute and enforce the types of internal controls Howell has identified, you can go a long way towards detecting and, more importantly, preventing a FCPA violation from occurring.

Three key takeaways:

  1. You must maintain rigor around your internal controls.
  2. Controls against fraud can also help to prevent corruption.
  3. Building and maintaining good internal controls requires rigor.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 653 no What are internal controls? What specifically are internal controls in a compliance program? Internal controls are not only the foundation of a company but are also the foundation of any effective anti-corruption compliance program. Internal controls expert Joe Howell, former Executive Vice President (EVP) at Workiva, Inc., has said that internal controls are systematic measures, such as reviews, checks and balances, methods and procedures, instituted by an organization that performs several different functions. These functions include allowing a company to conduct its business in an orderly and efficient manner; to safeguard its assets and resources, to detect and deter errors, fraud, and theft; to assist an organization ensuring the accuracy and completeness of its accounting data; to enable a business to produce reliable and timely financial and management information; and to help an entity to ensure there is adherence to its policies and plans by its employees, applicable third parties and others. Howell adds that internal controls are entity wide; that is, they are not just limited to the accountants and auditors. Howell also notes that for compliance purposes, controls are those measures specifically to provide reasonable assurance any assets or resources of a company cannot be used to pay a bribe. This definition includes diversion of company assets, such as by unauthorized sales discounts or receivables write-offs as well as the distribution of assets. Three key takeaways: Effective internal controls are required under the FCPA. Internal controls are a critical part of any best practices compliance program. There are multiple FCPA enforcement actions that demonstrate the enforcement spotlight on internal controls. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 01 Sep 2020 17:00:00 -0000 What are internal controls? full Thomas Fox What are internal controls? Find out in this first episode on a new month of 31 Days to a More Effective Compliance Program. What specifically are internal controls in a compliance program? Internal controls are not only the foundation of a company but are also the foundation of any effective anti-corruption compliance program. Internal controls expert Joe Howell, former Executive Vice President (EVP) at Workiva, Inc., has said that internal controls are systematic measures, such as reviews, checks and balances, methods and procedures, instituted by an organization that performs several different functions. These functions include allowing a company to conduct its business in an orderly and efficient manner; to safeguard its assets and resources, to detect and deter errors, fraud, and theft; to assist an organization ensuring the accuracy and completeness of its accounting data; to enable a business to produce reliable and timely financial and management information; and to help an entity to ensure there is adherence to its policies and plans by its employees, applicable third parties and others. Howell adds that internal controls are entity wide; that is, they are not just limited to the accountants and auditors. Howell also notes that for compliance purposes, controls are those measures specifically to provide reasonable assurance any assets or resources of a company cannot be used to pay a bribe. This definition includes diversion of company assets, such as by unauthorized sales discounts or receivables write-offs as well as the distribution of assets. Three key takeaways: Effective internal controls are required under the FCPA. Internal controls are a critical part of any best practices compliance program. There are multiple FCPA enforcement actions that demonstrate the enforcement spotlight on internal controls. Learn more about your ad choices. Visit megaphone.fm/adchoices What specifically are internal controls in a compliance program? Internal controls are not only the foundation of a company but are also the foundation of any effective anti-corruption compliance program. Internal controls expert Joe Howell, former Executive Vice President (EVP) at Workiva, Inc., has said that internal controls are systematic measures, such as reviews, checks and balances, methods and procedures, instituted by an organization that performs several different functions. These functions include allowing a company to conduct its business in an orderly and efficient manner; to safeguard its assets and resources, to detect and deter errors, fraud, and theft; to assist an organization ensuring the accuracy and completeness of its accounting data; to enable a business to produce reliable and timely financial and management information; and to help an entity to ensure there is adherence to its policies and plans by its employees, applicable third parties and others. Howell adds that internal controls are entity wide; that is, they are not just limited to the accountants and auditors. Howell also notes that for compliance purposes, controls are those measures specifically to provide reasonable assurance any assets or resources of a company cannot be used to pay a bribe. This definition includes diversion of company assets, such as by unauthorized sales discounts or receivables write-offs as well as the distribution of assets.

Three key takeaways:

  1. Effective internal controls are required under the FCPA.
  2. Internal controls are a critical part of any best practices compliance program.
  3. There are multiple FCPA enforcement actions that demonstrate the enforcement spotlight on internal controls.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 773 no Twenty questions directors should ask about its Compliance Committee In an area of inquiry entitled Oversight, the 2020 Update asks three basic questions which we have explored throughout this chapter:  What compliance expertise has been available on the Board of Directors? Have the Board of Directors held executive or private sessions with the compliance function? What types of information has the Board of Directors examined in their exercise of oversight in the area in which the misconduct occurred? To facilitate the answers to these questions, consider this list of 20 questions to reflect the oversight role of directors. These are questions the Board should ask of both senior management and the Board should ask itself. The questions are not intended to be an exact checklist, but rather a way to provide insight and stimulate discussion on the topic of compliance. The questions provide directors with a basis for critically assessing the answers they get and digging deeper as necessary. Although the questions apply to most medium to large organizations, the answers will vary according to the size, complexity and sophistication of each individual organization. Three key takeaways: The DOJ Evaluation requires active Board of Director engagement around compliance. Board communication on compliance is a two-way street; both inbound and outbound. Has the Board built an effective Compliance Committee for itself? Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 28 Aug 2020 17:00:00 -0000 Twenty questions directors should ask about its Compliance Committee full Thomas Fox In this episode of 31 Days to a More Effective Compliance Program, we consider this list of 20 questions to reflect the oversight role of directors. In an area of inquiry entitled Oversight, the 2020 Update asks three basic questions which we have explored throughout this chapter:  What compliance expertise has been available on the Board of Directors? Have the Board of Directors held executive or private sessions with the compliance function? What types of information has the Board of Directors examined in their exercise of oversight in the area in which the misconduct occurred? To facilitate the answers to these questions, consider this list of 20 questions to reflect the oversight role of directors. These are questions the Board should ask of both senior management and the Board should ask itself. The questions are not intended to be an exact checklist, but rather a way to provide insight and stimulate discussion on the topic of compliance. The questions provide directors with a basis for critically assessing the answers they get and digging deeper as necessary. Although the questions apply to most medium to large organizations, the answers will vary according to the size, complexity and sophistication of each individual organization. Three key takeaways: The DOJ Evaluation requires active Board of Director engagement around compliance. Board communication on compliance is a two-way street; both inbound and outbound. Has the Board built an effective Compliance Committee for itself? Learn more about your ad choices. Visit megaphone.fm/adchoices In an area of inquiry entitled Oversight, the 2020 Update asks three basic questions which we have explored throughout this chapter: 

  1. What compliance expertise has been available on the Board of Directors?
  2. Have the Board of Directors held executive or private sessions with the compliance function?
  3. What types of information has the Board of Directors examined in their exercise of oversight in the area in which the misconduct occurred?


To facilitate the answers to these questions, consider this list of 20 questions to reflect the oversight role of directors. These are questions the Board should ask of both senior management and the Board should ask itself. The questions are not intended to be an exact checklist, but rather a way to provide insight and stimulate discussion on the topic of compliance. The questions provide directors with a basis for critically assessing the answers they get and digging deeper as necessary. Although the questions apply to most medium to large organizations, the answers will vary according to the size, complexity and sophistication of each individual organization.

Three key takeaways:

  1. The DOJ Evaluation requires active Board of Director engagement around compliance.
  2. Board communication on compliance is a two-way street; both inbound and outbound.
  3. Has the Board built an effective Compliance Committee for itself?


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 643 no Three areas of Board inquiry There are three core areas upon which directors should focus their attention regarding to help establish and maintain an effective compliance program: structure, culture, and risk management. Structural questions. This area consists of questions which will aid in determining the fundamental sense of a company’s overall compliance program. The questions should begin with the basics of the program through to how the program operates in action. Cultural questions. This area of inquiry should focus on the culture of the organization regarding compliance. Board members should understand what message is being communicated not only from senior management but also middle management. Equally important, the Board needs to understand what message is being heard at the lowest levels within the company. Risk management questions. Board members need to understand the company’s process being used to identify emerging risks, their evaluation and management. Such risk analysis would be broader than simply a compliance risk assessment and should be tied to other broader corporate matters. Three key takeaways: A Board of Directors should inquire into the structural component of the compliance program as it will aid in determining the fundamental sense of a company’s overall compliance program. Cultural questions should be asked to garner an understanding of what message is being communicated not only from senior management but also middle management. Risk management questions should be asked to understand the company’s process being used to identify emerging risks, their evaluation and management. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 27 Aug 2020 17:00:00 -0000 Three areas of Board inquiry full Thomas Fox Why are structure, culture, and risk management 3 key areas for BOD inquiry? Find out on this episode of 31 Days to a More Effective Compliance Program. There are three core areas upon which directors should focus their attention regarding to help establish and maintain an effective compliance program: structure, culture, and risk management. Structural questions. This area consists of questions which will aid in determining the fundamental sense of a company’s overall compliance program. The questions should begin with the basics of the program through to how the program operates in action. Cultural questions. This area of inquiry should focus on the culture of the organization regarding compliance. Board members should understand what message is being communicated not only from senior management but also middle management. Equally important, the Board needs to understand what message is being heard at the lowest levels within the company. Risk management questions. Board members need to understand the company’s process being used to identify emerging risks, their evaluation and management. Such risk analysis would be broader than simply a compliance risk assessment and should be tied to other broader corporate matters. Three key takeaways: A Board of Directors should inquire into the structural component of the compliance program as it will aid in determining the fundamental sense of a company’s overall compliance program. Cultural questions should be asked to garner an understanding of what message is being communicated not only from senior management but also middle management. Risk management questions should be asked to understand the company’s process being used to identify emerging risks, their evaluation and management. Learn more about your ad choices. Visit megaphone.fm/adchoices There are three core areas upon which directors should focus their attention regarding to help establish and maintain an effective compliance program: structure, culture, and risk management.

Structural questions. This area consists of questions which will aid in determining the fundamental sense of a company’s overall compliance program. The questions should begin with the basics of the program through to how the program operates in action.

Cultural questions. This area of inquiry should focus on the culture of the organization regarding compliance. Board members should understand what message is being communicated not only from senior management but also middle management. Equally important, the Board needs to understand what message is being heard at the lowest levels within the company.

Risk management questions. Board members need to understand the company’s process being used to identify emerging risks, their evaluation and management. Such risk analysis would be broader than simply a compliance risk assessment and should be tied to other broader corporate matters.

Three key takeaways:

  1. A Board of Directors should inquire into the structural component of the compliance program as it will aid in determining the fundamental sense of a company’s overall compliance program.
  2. Cultural questions should be asked to garner an understanding of what message is being communicated not only from senior management but also middle management.
  3. Risk management questions should be asked to understand the company’s process being used to identify emerging risks, their evaluation and management.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 760 no Areas of Board inquiry into compliance Where does “tone at the top” start? With any public and most private U.S. companies, it is at the Board of Directors. But what is the role of a company’s Board in compliance? We start with several general statements about the role of a Board in U.S. companies. First, a Board should not engage in management but should engage in oversight of a CEO and senior management. The Board does this through asking hard questions, risk assessment and identification.  A white paper by Deloitte & Touche LLP, entitled “Risk Intelligence Governance - A Practical Guide for Boards”, laid out six general principles to help guide Boards in the area of risk governance. These six areas can be summarized as follows: Define the Board’s role. There must be a mutual understanding between the Board, CEO and senior management of the Board’s responsibilities. Foster a culture of risk management. All stakeholders should understand the risks involved and manage such risks accordingly. Incorporate risk management directly into a strategy. Oversee the design and implementation of risk evaluation and analysis. Help define the company’s appetite for risk. All stakeholders need to understand the company’s appetite or lack thereof for risk. How to execute the risk management process. Maintain an approach that is continually monitored and has continuing accountability. How to benchmark and evaluate the process. Systems need to be installed which allow for evaluation and modifying the risk management process as more information becomes available or facts or assumptions change. All of these factors can be easily adapted to compliance and ethics risk management oversight. Initially it must be important that the Board receive direct access to such information on a company’s policies on this issue. Three key takeaways: The Board’s role is to keep really bad things from happening to a company. There are six general areas the point can inquire into and lead from. A Board should have direct access to information on the company’s compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 26 Aug 2020 17:00:00 -0000 Areas of Board inquiry into compliance full Thomas Fox Eric Feldman joins me to discuss some key areas of BOD inquiry into compliance. Check out this episode of 31 Days to a More Effective Compliance Program. Where does “tone at the top” start? With any public and most private U.S. companies, it is at the Board of Directors. But what is the role of a company’s Board in compliance? We start with several general statements about the role of a Board in U.S. companies. First, a Board should not engage in management but should engage in oversight of a CEO and senior management. The Board does this through asking hard questions, risk assessment and identification.  A white paper by Deloitte & Touche LLP, entitled “Risk Intelligence Governance - A Practical Guide for Boards”, laid out six general principles to help guide Boards in the area of risk governance. These six areas can be summarized as follows: Define the Board’s role. There must be a mutual understanding between the Board, CEO and senior management of the Board’s responsibilities. Foster a culture of risk management. All stakeholders should understand the risks involved and manage such risks accordingly. Incorporate risk management directly into a strategy. Oversee the design and implementation of risk evaluation and analysis. Help define the company’s appetite for risk. All stakeholders need to understand the company’s appetite or lack thereof for risk. How to execute the risk management process. Maintain an approach that is continually monitored and has continuing accountability. How to benchmark and evaluate the process. Systems need to be installed which allow for evaluation and modifying the risk management process as more information becomes available or facts or assumptions change. All of these factors can be easily adapted to compliance and ethics risk management oversight. Initially it must be important that the Board receive direct access to such information on a company’s policies on this issue. Three key takeaways: The Board’s role is to keep really bad things from happening to a company. There are six general areas the point can inquire into and lead from. A Board should have direct access to information on the company’s compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices Where does “tone at the top” start? With any public and most private U.S. companies, it is at the Board of Directors. But what is the role of a company’s Board in compliance? We start with several general statements about the role of a Board in U.S. companies. First, a Board should not engage in management but should engage in oversight of a CEO and senior management. The Board does this through asking hard questions, risk assessment and identification. 

A white paper by Deloitte & Touche LLP, entitled “Risk Intelligence Governance - A Practical Guide for Boards”, laid out six general principles to help guide Boards in the area of risk governance. These six areas can be summarized as follows:

  • Define the Board’s role. There must be a mutual understanding between the Board, CEO and senior management of the Board’s responsibilities.
  • Foster a culture of risk management. All stakeholders should understand the risks involved and manage such risks accordingly.
  • Incorporate risk management directly into a strategy. Oversee the design and implementation of risk evaluation and analysis.
  • Help define the company’s appetite for risk. All stakeholders need to understand the company’s appetite or lack thereof for risk.
  • How to execute the risk management process. Maintain an approach that is continually monitored and has continuing accountability.
  • How to benchmark and evaluate the process. Systems need to be installed which allow for evaluation and modifying the risk management process as more information becomes available or facts or assumptions change.

All of these factors can be easily adapted to compliance and ethics risk management oversight. Initially it must be important that the Board receive direct access to such information on a company’s policies on this issue.

Three key takeaways:

  1. The Board’s role is to keep really bad things from happening to a company.
  2. There are six general areas the point can inquire into and lead from.
  3. A Board should have direct access to information on the company’s compliance program.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 739 no Incorporating compliance into long-term corporate strategy How can a Board work to incorporate the compliance function into a long-term business strategy of the organization? A Board can do so by engaging with the CCO and compliance function through having a strong Board which is committed to doing business ethically and incompliance with anti-corruption laws and engaging actively with the CCO and compliance function. The questions have become even more important after the release of the 2020 Update. Under the topic, Seniority and Stature, are the following question What role has compliance played in the company’s strategic and operational decisions? The starting point for a Board of Directors is to develop a framework for incorporating compliance into your long-term strategy. To set up the framework for evaluation of the compliance into your Board’s long-term strategy is a three-step process, which you can use to determine how comprehensive the Board’s role in your compliance program is as a starting point. The Board should work to communicate the influence of compliance factors on overall corporate strategy by demonstrating how compliance was integrated into the business. Not only is this good from a business perspective and shareholder expectation but it is also, as the 2020 Update makes clear, what the government expects is the operationalization of compliance going forward. Three key takeaways: Having a long-term strategy is critical. What is the Board’s framework for assessing compliance? Create KPIs to measure senior management’s actions around compliance. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 25 Aug 2020 17:00:00 -0000 Incorporating compliance into long-term corporate strategy full Thomas Fox What is the role of a BOD in long term compliance strategy? Find out in this episode of 31 Days to a More Effective Compliance Program. How can a Board work to incorporate the compliance function into a long-term business strategy of the organization? A Board can do so by engaging with the CCO and compliance function through having a strong Board which is committed to doing business ethically and incompliance with anti-corruption laws and engaging actively with the CCO and compliance function. The questions have become even more important after the release of the 2020 Update. Under the topic, Seniority and Stature, are the following question What role has compliance played in the company’s strategic and operational decisions? The starting point for a Board of Directors is to develop a framework for incorporating compliance into your long-term strategy. To set up the framework for evaluation of the compliance into your Board’s long-term strategy is a three-step process, which you can use to determine how comprehensive the Board’s role in your compliance program is as a starting point. The Board should work to communicate the influence of compliance factors on overall corporate strategy by demonstrating how compliance was integrated into the business. Not only is this good from a business perspective and shareholder expectation but it is also, as the 2020 Update makes clear, what the government expects is the operationalization of compliance going forward. Three key takeaways: Having a long-term strategy is critical. What is the Board’s framework for assessing compliance? Create KPIs to measure senior management’s actions around compliance. Learn more about your ad choices. Visit megaphone.fm/adchoices How can a Board work to incorporate the compliance function into a long-term business strategy of the organization? A Board can do so by engaging with the CCO and compliance function through having a strong Board which is committed to doing business ethically and incompliance with anti-corruption laws and engaging actively with the CCO and compliance function. The questions have become even more important after the release of the 2020 Update. Under the topic, Seniority and Stature, are the following question What role has compliance played in the company’s strategic and operational decisions?

The starting point for a Board of Directors is to develop a framework for incorporating compliance into your long-term strategy. To set up the framework for evaluation of the compliance into your Board’s long-term strategy is a three-step process, which you can use to determine how comprehensive the Board’s role in your compliance program is as a starting point.

The Board should work to communicate the influence of compliance factors on overall corporate strategy by demonstrating how compliance was integrated into the business. Not only is this good from a business perspective and shareholder expectation but it is also, as the 2020 Update makes clear, what the government expects is the operationalization of compliance going forward.

Three key takeaways:

  1. Having a long-term strategy is critical.
  2. What is the Board’s framework for assessing compliance?
  3. Create KPIs to measure senior management’s actions around compliance.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 773 no The Board and succession planning for a CCO The 2020 Update mandated a Board of Directors ensure “the sufficiency of the personnel and resources within the compliance function, in particular, whether those responsible for compliance have: (1) sufficient seniority within the organization; (2) sufficient resources, namely, staff to effectively undertake the requisite auditing, documentation, and analysis; and (3) sufficient autonomy from management, such as direct access to the board of directors or the board’s audit committee.” Here are six steps to utilize.  Examine the key corporate documents. This includes Board review of all relevant corporate governance documents, including guidelines, the Charter for Board Governance, the director nomination policy and any relevant policies setting out the appropriate protocols and procedures. Use an assessment framework. 1) the current strengths and weaknesses of the CCO; 2) the short­ and long-term skills needs of a CCO; 3) evaluating how the Board’s assessment changes regarding departing CCOs; and 4) shifting the Board’s approach to oned based on criteria such as organization needs and director performance. Conduct due diligence. Conduct an executive level due diligence background investigation, not simply a background check. Maintain a pipeline. Every Board should maintain a pipeline of qualified candidates. Conditions may arise, such as health or other personal emergencies, that call for rapid director succession. It’s crucial that there are potential qualified candidates on hand to fill the gap quickly. Assess Board policies. Just as a company should periodically assess and reassess its policies and procedures, the Board assess their policies in this area. Disclose your succession strategy. Both a large number of institutional investors and good corporate governance advocates suggest that companies disclose their succession strategies. It provides greater transparency to stakeholders. Benchmark your succession strategy. Every Board should benchmark its succession strategy with industry peers around the use of the steps outlined and stay aligned with the evolving policies and positions of large institutional shareholders and good corporate governance advocates. Three key takeaways: Refreshment is a hot topic in corporate governance. Review your Board policies to understand what your company will need going forward. Transparency in succession planning. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 24 Aug 2020 17:00:00 -0000 The Board and succession planning for a CCO full Thomas Fox What is the BOD role in CCO succession planning? Find out in this episode of 31 Days to a More Effective Compliance Program. The 2020 Update mandated a Board of Directors ensure “the sufficiency of the personnel and resources within the compliance function, in particular, whether those responsible for compliance have: (1) sufficient seniority within the organization; (2) sufficient resources, namely, staff to effectively undertake the requisite auditing, documentation, and analysis; and (3) sufficient autonomy from management, such as direct access to the board of directors or the board’s audit committee.” Here are six steps to utilize.  Examine the key corporate documents. This includes Board review of all relevant corporate governance documents, including guidelines, the Charter for Board Governance, the director nomination policy and any relevant policies setting out the appropriate protocols and procedures. Use an assessment framework. 1) the current strengths and weaknesses of the CCO; 2) the short­ and long-term skills needs of a CCO; 3) evaluating how the Board’s assessment changes regarding departing CCOs; and 4) shifting the Board’s approach to oned based on criteria such as organization needs and director performance. Conduct due diligence. Conduct an executive level due diligence background investigation, not simply a background check. Maintain a pipeline. Every Board should maintain a pipeline of qualified candidates. Conditions may arise, such as health or other personal emergencies, that call for rapid director succession. It’s crucial that there are potential qualified candidates on hand to fill the gap quickly. Assess Board policies. Just as a company should periodically assess and reassess its policies and procedures, the Board assess their policies in this area. Disclose your succession strategy. Both a large number of institutional investors and good corporate governance advocates suggest that companies disclose their succession strategies. It provides greater transparency to stakeholders. Benchmark your succession strategy. Every Board should benchmark its succession strategy with industry peers around the use of the steps outlined and stay aligned with the evolving policies and positions of large institutional shareholders and good corporate governance advocates. Three key takeaways: Refreshment is a hot topic in corporate governance. Review your Board policies to understand what your company will need going forward. Transparency in succession planning. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2020 Update mandated a Board of Directors ensure “the sufficiency of the personnel and resources within the compliance function, in particular, whether those responsible for compliance have: (1) sufficient seniority within the organization; (2) sufficient resources, namely, staff to effectively undertake the requisite auditing, documentation, and analysis; and (3) sufficient autonomy from management, such as direct access to the board of directors or the board’s audit committee.” Here are six steps to utilize. 

Examine the key corporate documents. This includes Board review of all relevant corporate governance documents, including guidelines, the Charter for Board Governance, the director nomination policy and any relevant policies setting out the appropriate protocols and procedures.

Use an assessment framework. 1) the current strengths and weaknesses of the CCO; 2) the short­ and long-term skills needs of a CCO; 3) evaluating how the Board’s assessment changes regarding departing CCOs; and 4) shifting the Board’s approach to oned based on criteria such as organization needs and director performance.

Conduct due diligence. Conduct an executive level due diligence background investigation, not simply a background check.

Maintain a pipeline. Every Board should maintain a pipeline of qualified candidates. Conditions may arise, such as health or other personal emergencies, that call for rapid director succession. It’s crucial that there are potential qualified candidates on hand to fill the gap quickly.

Assess Board policies. Just as a company should periodically assess and reassess its policies and procedures, the Board assess their policies in this area.

Disclose your succession strategy. Both a large number of institutional investors and good corporate governance advocates suggest that companies disclose their succession strategies. It provides greater transparency to stakeholders.

Benchmark your succession strategy. Every Board should benchmark its succession strategy with industry peers around the use of the steps outlined and stay aligned with the evolving policies and positions of large institutional shareholders and good corporate governance advocates.

Three key takeaways:

  1. Refreshment is a hot topic in corporate governance.
  2. Review your Board policies to understand what your company will need going forward.
  3. Transparency in succession planning.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 609 no The Board role in hiring What is the role of a Board of Directors in hiring senior executives, CCOs and even other board members? I explored this issue with Candice Tal, who began by noting, that bad senior executive hires can cost a company much more than simply dollars. She related, the “financial costs in day-to-day operations easily can quadruple that of a regular employee, but it can also impact the company’s corporate governance and board of directors if that executive hire was found to be involved with unethical and illegal activities. Not even a signed contract can protect a company if an executive hire’s unethical actions come to the attention of the national media. Fiduciary risk and exposure for the board of directors cannot be overlooked.” She pointed to the example of Yahoo! and its hire of Scott Thompson. It turned out that Thompson had incorrect information on his online biography regarding his academic credentials. The “implications went beyond the activist shareholder accusations to reflect on the Board of Directors for not vetting his background more carefully. The company may have been exposed to claims of providing false information to the SEC and potential stockholder law suits. Thompson’s 120-day tenure at Yahoo! cost the company over $7 million and seriously tarnished the company’s reputation in the business community.” The key is that a company engages in an executive due diligence investigation rather than simply a routine or even executive-level background investigation. Tal explained that an executive background search, is “typically limited to a five-component review of: criminal records, employment verification, degree or education verification, social security validation, address verification and sometimes credit history.” Such searches are “very limited searches.” Conversely, executive due diligence, “looks in-depth at all available public records sources: criminal history, civil litigation issues, financial and legal issues, relationships with other companies and board advisory positions, reputation, misrepresented education and overstated work history, behavioral history (for example litigiousness), and, in particular, undisclosed or adverse issues.” While it is generally “more costly than executive background checks and takes more time, the information gathered is extremely valuable and can save a company substantially more. A high quality due diligence review can find important information which would not be returned in a routine executive background check.” Infortal has found that up to 20% of executive search candidates fail a deep-level due diligence investigation. Now consider how many senior executive slots your company has and add to that Board of Directors seats and you can quickly see the risk of failure to consider an executive due diligence search when promoting or hiring. Moreover, you need an executive level due diligence in other business situations as well, including the senior management of new business acquisitions brought into your organization through a merger or other acquisition, selecting new Board members, screening corporate Board of Directors and of course, for third party business partners and other agents in the sales and supply chain channels.  Three key takeaways: The costs of a bad executive hire can far exceed the dollar loss. Do not forget the differences between an executive background check and executive level due diligence. 20% of all senior executives fail an executive level due diligence check. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 21 Aug 2020 10:07:14 -0000 The Board role in hiring full Thomas Fox What is the Board of Director's role in the hiring of senior executives? Find out in this episode of 31 Days to a More Effective Compliance Program. What is the role of a Board of Directors in hiring senior executives, CCOs and even other board members? I explored this issue with Candice Tal, who began by noting, that bad senior executive hires can cost a company much more than simply dollars. She related, the “financial costs in day-to-day operations easily can quadruple that of a regular employee, but it can also impact the company’s corporate governance and board of directors if that executive hire was found to be involved with unethical and illegal activities. Not even a signed contract can protect a company if an executive hire’s unethical actions come to the attention of the national media. Fiduciary risk and exposure for the board of directors cannot be overlooked.” She pointed to the example of Yahoo! and its hire of Scott Thompson. It turned out that Thompson had incorrect information on his online biography regarding his academic credentials. The “implications went beyond the activist shareholder accusations to reflect on the Board of Directors for not vetting his background more carefully. The company may have been exposed to claims of providing false information to the SEC and potential stockholder law suits. Thompson’s 120-day tenure at Yahoo! cost the company over $7 million and seriously tarnished the company’s reputation in the business community.” The key is that a company engages in an executive due diligence investigation rather than simply a routine or even executive-level background investigation. Tal explained that an executive background search, is “typically limited to a five-component review of: criminal records, employment verification, degree or education verification, social security validation, address verification and sometimes credit history.” Such searches are “very limited searches.” Conversely, executive due diligence, “looks in-depth at all available public records sources: criminal history, civil litigation issues, financial and legal issues, relationships with other companies and board advisory positions, reputation, misrepresented education and overstated work history, behavioral history (for example litigiousness), and, in particular, undisclosed or adverse issues.” While it is generally “more costly than executive background checks and takes more time, the information gathered is extremely valuable and can save a company substantially more. A high quality due diligence review can find important information which would not be returned in a routine executive background check.” Infortal has found that up to 20% of executive search candidates fail a deep-level due diligence investigation. Now consider how many senior executive slots your company has and add to that Board of Directors seats and you can quickly see the risk of failure to consider an executive due diligence search when promoting or hiring. Moreover, you need an executive level due diligence in other business situations as well, including the senior management of new business acquisitions brought into your organization through a merger or other acquisition, selecting new Board members, screening corporate Board of Directors and of course, for third party business partners and other agents in the sales and supply chain channels.  Three key takeaways: The costs of a bad executive hire can far exceed the dollar loss. Do not forget the differences between an executive background check and executive level due diligence. 20% of all senior executives fail an executive level due diligence check. Learn more about your ad choices. Visit megaphone.fm/adchoices What is the role of a Board of Directors in hiring senior executives, CCOs and even other board members? I explored this issue with Candice Tal, who began by noting, that bad senior executive hires can cost a company much more than simply dollars. She related, the “financial costs in day-to-day operations easily can quadruple that of a regular employee, but it can also impact the company’s corporate governance and board of directors if that executive hire was found to be involved with unethical and illegal activities. Not even a signed contract can protect a company if an executive hire’s unethical actions come to the attention of the national media. Fiduciary risk and exposure for the board of directors cannot be overlooked.”

She pointed to the example of Yahoo! and its hire of Scott Thompson. It turned out that Thompson had incorrect information on his online biography regarding his academic credentials. The “implications went beyond the activist shareholder accusations to reflect on the Board of Directors for not vetting his background more carefully. The company may have been exposed to claims of providing false information to the SEC and potential stockholder law suits. Thompson’s 120-day tenure at Yahoo! cost the company over $7 million and seriously tarnished the company’s reputation in the business community.”

The key is that a company engages in an executive due diligence investigation rather than simply a routine or even executive-level background investigation. Tal explained that an executive background search, is “typically limited to a five-component review of: criminal records, employment verification, degree or education verification, social security validation, address verification and sometimes credit history.” Such searches are “very limited searches.”

Conversely, executive due diligence, “looks in-depth at all available public records sources: criminal history, civil litigation issues, financial and legal issues, relationships with other companies and board advisory positions, reputation, misrepresented education and overstated work history, behavioral history (for example litigiousness), and, in particular, undisclosed or adverse issues.” While it is generally “more costly than executive background checks and takes more time, the information gathered is extremely valuable and can save a company substantially more. A high quality due diligence review can find important information which would not be returned in a routine executive background check.”

Infortal has found that up to 20% of executive search candidates fail a deep-level due diligence investigation. Now consider how many senior executive slots your company has and add to that Board of Directors seats and you can quickly see the risk of failure to consider an executive due diligence search when promoting or hiring. Moreover, you need an executive level due diligence in other business situations as well, including the senior management of new business acquisitions brought into your organization through a merger or other acquisition, selecting new Board members, screening corporate Board of Directors and of course, for third party business partners and other agents in the sales and supply chain channels. 

Three key takeaways:

  1. The costs of a bad executive hire can far exceed the dollar loss.
  2. Do not forget the differences between an executive background check and executive level due diligence.
  3. 20% of all senior executives fail an executive level due diligence check.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 770 no  Board of Directors and doing business in China The Trump Administration’s trade war with China has highlighted the risks of both doing business in China and investing the Chinese companies which come to America to raise capital. Yet this has been a long-known and outstanding problem in the anti-corruption enforcement world. The 2014 bribery and corruption case of GlaxoSmithKline PLC (GSK), which resulted in a $490 million fine for the firm, resonated across the corporate globe. While many questions are still unanswered, one that seems to be at the forefront of the inquiry was where was the GSK Board of Directors? This matter demonstrates that the role of a Board of Directors is becoming more important and more of a critical part of any effective compliance program. In a NACD Directorship article, entitled “Corruption in China and Elsewhere Demands Board Oversight”, Eric V. Zwisler and Dean A. Yoost note, “Boards are ultimately responsible for risk oversight” any Board of a company with operations in China “needs to have a clear understanding of its duties and responsibilities under the FCPA and other international laws, such as the U.K. Bribery Act”. Why should China be on the radar of Boards? From 2010-2019, over 25% of all FCPA enforcement actions derived from China, that’s why.  FCPA enforcement actions have made clear that numerous Chinese businesses have proven adept at appearing compliant while hiding unacceptable business practices. A Board should be aware that a well-crafted compliance program must be complemented with a thorough understanding of frontline business practices and constant auditing of actual practices, not just a paper compliance program. This means that both monitoring and auditing should be visible to the Board. Three key takeaways: China presents the highest FCPA risk and after GSK, domestic law corruption risk as well. Chinese companies have been adept at hiding corrupt business practices from their western owners. A Board must be cognizant of these risks and enhance their risk management process in China and other high-risk jurisdictions.  Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 20 Aug 2020 17:20:00 -0000  Board of Directors and doing business in China full Thomas Fox What are the challenges for a Board of Directors of a company doing business in China or with Chinese companies? Find out in this episode of 31 Days to a More Effective Compliance Program. The Trump Administration’s trade war with China has highlighted the risks of both doing business in China and investing the Chinese companies which come to America to raise capital. Yet this has been a long-known and outstanding problem in the anti-corruption enforcement world. The 2014 bribery and corruption case of GlaxoSmithKline PLC (GSK), which resulted in a $490 million fine for the firm, resonated across the corporate globe. While many questions are still unanswered, one that seems to be at the forefront of the inquiry was where was the GSK Board of Directors? This matter demonstrates that the role of a Board of Directors is becoming more important and more of a critical part of any effective compliance program. In a NACD Directorship article, entitled “Corruption in China and Elsewhere Demands Board Oversight”, Eric V. Zwisler and Dean A. Yoost note, “Boards are ultimately responsible for risk oversight” any Board of a company with operations in China “needs to have a clear understanding of its duties and responsibilities under the FCPA and other international laws, such as the U.K. Bribery Act”. Why should China be on the radar of Boards? From 2010-2019, over 25% of all FCPA enforcement actions derived from China, that’s why.  FCPA enforcement actions have made clear that numerous Chinese businesses have proven adept at appearing compliant while hiding unacceptable business practices. A Board should be aware that a well-crafted compliance program must be complemented with a thorough understanding of frontline business practices and constant auditing of actual practices, not just a paper compliance program. This means that both monitoring and auditing should be visible to the Board. Three key takeaways: China presents the highest FCPA risk and after GSK, domestic law corruption risk as well. Chinese companies have been adept at hiding corrupt business practices from their western owners. A Board must be cognizant of these risks and enhance their risk management process in China and other high-risk jurisdictions.  Learn more about your ad choices. Visit megaphone.fm/adchoices The Trump Administration’s trade war with China has highlighted the risks of both doing business in China and investing the Chinese companies which come to America to raise capital. Yet this has been a long-known and outstanding problem in the anti-corruption enforcement world. The 2014 bribery and corruption case of GlaxoSmithKline PLC (GSK), which resulted in a $490 million fine for the firm, resonated across the corporate globe. While many questions are still unanswered, one that seems to be at the forefront of the inquiry was where was the GSK Board of Directors? This matter demonstrates that the role of a Board of Directors is becoming more important and more of a critical part of any effective compliance program.

In a NACD Directorship article, entitled “Corruption in China and Elsewhere Demands Board Oversight”, Eric V. Zwisler and Dean A. Yoost note, “Boards are ultimately responsible for risk oversight” any Board of a company with operations in China “needs to have a clear understanding of its duties and responsibilities under the FCPA and other international laws, such as the U.K. Bribery Act”. Why should China be on the radar of Boards? From 2010-2019, over 25% of all FCPA enforcement actions derived from China, that’s why. 

FCPA enforcement actions have made clear that numerous Chinese businesses have proven adept at appearing compliant while hiding unacceptable business practices. A Board should be aware that a well-crafted compliance program must be complemented with a thorough understanding of frontline business practices and constant auditing of actual practices, not just a paper compliance program. This means that both monitoring and auditing should be visible to the Board.

Three key takeaways:

  1. China presents the highest FCPA risk and after GSK, domestic law corruption risk as well.
  2. Chinese companies have been adept at hiding corrupt business practices from their western owners.
  3. A Board must be cognizant of these risks and enhance their risk management process in China and other high-risk jurisdictions. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 770 no  Board failures in compliance Next, consider a couple of landmark failures at the Board level around bribery and corruption. VimpelCom Ltd. In 2015 (now Veon Ltd.), the DOJ alleged that Dutch telecom VimpelCom sought to enter the telecom market through the acquisition of a local player, Unitel, as an entrée into the Uzbekistan market. Unitel made clear to VimpelCom that to have access to, obtain and retain business in the Uzbeki telecom space, VimpelCom would have to, according to the DPA, “regularly pay Foreign Officials millions of dollars” to Gulnara Karimova, the daughter of the then President of the country. VimpelCom also acquired another entity Butzel, that was at least partially owned by an Uzbeki government official, who hid their interest through a shell company, which was known to VimpelCom. VimpelCom did not articulate a legitimate business reason for the deal and paid $60 million for Buztel. Ultimately, VimpelCom agreed to pay approximately $800 million in fines for these activities in 2016.  BizJet. Another FCPA enforcement action involved the Tulsa-based company BizJet International Sales and Support Inc. (BizJet), which had four senior executives convicted for their participation in a bribery scheme. But this case also involved the Board of Directions. In the Criminal Information it stated that in November 2005: …at a Board of Directors meeting of the BizJet Board, Executive A and Executive B discussed with the Board that the decision of where an aircraft is sent for maintenance work is generally made by the potential customer’s director of maintenance or chief pilot, that these individuals are demanding $30,000 to $40,000 in commissions, and that BizJet would pay referral fees in order to gain market share. In both cases, this is where the rubber hits the road. If a company is willing to commit bribery and engage in corruption to secure business, no amount of doing compliance is going to help. If senior management is ready, willing and able to lie, cheat and steal, the Board is the final backstop to prevent such conduct. Both the VimpelCom and BizJet Boards sorely failed in their compliance duties. Three key takeaways: Board liability will be severe based upon similar conduct going forward. Board members must critically challenge management on its conduct. The Board is the ultimate backstop against bribery and corruption. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 19 Aug 2020 17:00:00 -0000  Board failures in compliance full Thomas Fox What were some catastrophic Board of Director failures in compliance? Find out in today's 31 Days to a More Effective Compliance Program Next, consider a couple of landmark failures at the Board level around bribery and corruption. VimpelCom Ltd. In 2015 (now Veon Ltd.), the DOJ alleged that Dutch telecom VimpelCom sought to enter the telecom market through the acquisition of a local player, Unitel, as an entrée into the Uzbekistan market. Unitel made clear to VimpelCom that to have access to, obtain and retain business in the Uzbeki telecom space, VimpelCom would have to, according to the DPA, “regularly pay Foreign Officials millions of dollars” to Gulnara Karimova, the daughter of the then President of the country. VimpelCom also acquired another entity Butzel, that was at least partially owned by an Uzbeki government official, who hid their interest through a shell company, which was known to VimpelCom. VimpelCom did not articulate a legitimate business reason for the deal and paid $60 million for Buztel. Ultimately, VimpelCom agreed to pay approximately $800 million in fines for these activities in 2016.  BizJet. Another FCPA enforcement action involved the Tulsa-based company BizJet International Sales and Support Inc. (BizJet), which had four senior executives convicted for their participation in a bribery scheme. But this case also involved the Board of Directions. In the Criminal Information it stated that in November 2005: …at a Board of Directors meeting of the BizJet Board, Executive A and Executive B discussed with the Board that the decision of where an aircraft is sent for maintenance work is generally made by the potential customer’s director of maintenance or chief pilot, that these individuals are demanding $30,000 to $40,000 in commissions, and that BizJet would pay referral fees in order to gain market share. In both cases, this is where the rubber hits the road. If a company is willing to commit bribery and engage in corruption to secure business, no amount of doing compliance is going to help. If senior management is ready, willing and able to lie, cheat and steal, the Board is the final backstop to prevent such conduct. Both the VimpelCom and BizJet Boards sorely failed in their compliance duties. Three key takeaways: Board liability will be severe based upon similar conduct going forward. Board members must critically challenge management on its conduct. The Board is the ultimate backstop against bribery and corruption. Learn more about your ad choices. Visit megaphone.fm/adchoices Next, consider a couple of landmark failures at the Board level around bribery and corruption.

VimpelCom Ltd. In 2015 (now Veon Ltd.), the DOJ alleged that Dutch telecom VimpelCom sought to enter the telecom market through the acquisition of a local player, Unitel, as an entrée into the Uzbekistan market. Unitel made clear to VimpelCom that to have access to, obtain and retain business in the Uzbeki telecom space, VimpelCom would have to, according to the DPA, “regularly pay Foreign Officials millions of dollars” to Gulnara Karimova, the daughter of the then President of the country. VimpelCom also acquired another entity Butzel, that was at least partially owned by an Uzbeki government official, who hid their interest through a shell company, which was known to VimpelCom. VimpelCom did not articulate a legitimate business reason for the deal and paid $60 million for Buztel.

Ultimately, VimpelCom agreed to pay approximately $800 million in fines for these activities in 2016. 

BizJet. Another FCPA enforcement action involved the Tulsa-based company BizJet International Sales and Support Inc. (BizJet), which had four senior executives convicted for their participation in a bribery scheme. But this case also involved the Board of Directions. In the Criminal Information it stated that in November 2005:

…at a Board of Directors meeting of the BizJet Board, Executive A and Executive B discussed with the Board that the decision of where an aircraft is sent for maintenance work is generally made by the potential customer’s director of maintenance or chief pilot, that these individuals are demanding $30,000 to $40,000 in commissions, and that BizJet would pay referral fees in order to gain market share.

In both cases, this is where the rubber hits the road. If a company is willing to commit bribery and engage in corruption to secure business, no amount of doing compliance is going to help. If senior management is ready, willing and able to lie, cheat and steal, the Board is the final backstop to prevent such conduct. Both the VimpelCom and BizJet Boards sorely failed in their compliance duties.

Three key takeaways:

  1. Board liability will be severe based upon similar conduct going forward.
  2. Board members must critically challenge management on its conduct.
  3. The Board is the ultimate backstop against bribery and corruption.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 814 no Board Metrics for Compliance What are metrics for a Board of Directors around compliance? Former Assistant Attorney General Leslie Caldwell laid out some that the Department of Justice (DOJ) would consider in a review of compliance programs. These metrics are: Does the institution ensure that its directors and senior managers provide strong, explicit and visible support for its corporate compliance policies? Does the Board maintain a material role in overseeing a company’s overall compliance framework? These requirements move beyond simply having the correct tone at the top, which every Board should articulate. The 2020 Update to the Evaluation of Corporate Compliance Programs added the following, under Oversight by posing the following questions: What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions? What types of information have the board of directors and senior management examined in their exercise of oversight in the area in which the misconduct occurred? Based on the foregoing, when determining the Board’s role, begin with two questions. First, does the Board of Directors exercise independent review of a company’s compliance program? Second, is the Board of Directors provided information sufficient to enable the exercise of independent judgment? Three key takeaways: The DOJ expects active engagement by a Board around compliance. Does the Board exercise independent review of the compliance program? The convergence of the Yates Memo, Caldwell’s metrics, the Evaluation and FCPA Corporate Enforcement Policy mandate Board metrics around compliance.   Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 18 Aug 2020 17:00:00 -0000 Board Metrics for Compliance full Thomas Fox What are some Board metrics around compliance? Find out in today's 31 Days to a More Effective Compliance Program. What are metrics for a Board of Directors around compliance? Former Assistant Attorney General Leslie Caldwell laid out some that the Department of Justice (DOJ) would consider in a review of compliance programs. These metrics are: Does the institution ensure that its directors and senior managers provide strong, explicit and visible support for its corporate compliance policies? Does the Board maintain a material role in overseeing a company’s overall compliance framework? These requirements move beyond simply having the correct tone at the top, which every Board should articulate. The 2020 Update to the Evaluation of Corporate Compliance Programs added the following, under Oversight by posing the following questions: What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions? What types of information have the board of directors and senior management examined in their exercise of oversight in the area in which the misconduct occurred? Based on the foregoing, when determining the Board’s role, begin with two questions. First, does the Board of Directors exercise independent review of a company’s compliance program? Second, is the Board of Directors provided information sufficient to enable the exercise of independent judgment? Three key takeaways: The DOJ expects active engagement by a Board around compliance. Does the Board exercise independent review of the compliance program? The convergence of the Yates Memo, Caldwell’s metrics, the Evaluation and FCPA Corporate Enforcement Policy mandate Board metrics around compliance.   Learn more about your ad choices. Visit megaphone.fm/adchoices What are metrics for a Board of Directors around compliance? Former Assistant Attorney General Leslie Caldwell laid out some that the Department of Justice (DOJ) would consider in a review of compliance programs. These metrics are:

  • Does the institution ensure that its directors and senior managers provide strong, explicit and visible support for its corporate compliance policies?
  • Does the Board maintain a material role in overseeing a company’s overall compliance framework?

These requirements move beyond simply having the correct tone at the top, which every Board should articulate. The 2020 Update to the Evaluation of Corporate Compliance Programs added the following, under Oversight by posing the following questions: What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions? What types of information have the board of directors and senior management examined in their exercise of oversight in the area in which the misconduct occurred?

Based on the foregoing, when determining the Board’s role, begin with two questions. First, does the Board of Directors exercise independent review of a company’s compliance program? Second, is the Board of Directors provided information sufficient to enable the exercise of independent judgment?

Three key takeaways:

  1. The DOJ expects active engagement by a Board around compliance.
  2. Does the Board exercise independent review of the compliance program?
  3. The convergence of the Yates Memo, Caldwell’s metrics, the Evaluation and FCPA Corporate Enforcement Policy mandate Board metrics around compliance.


 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 708 no What leads to a successful Board investigation? Once again, referencing the article, “Successful Board Investigations”, David Bayless and Tammy Albarrán, offered seven considerations to facilitate a successful Board investigation.  Consider whether you need independent outside counsel.  Consider hiring an experienced investigator to lead the internal investigation.  Consider the need to retain outside experts.  Analyze potential conflicts of interest at the outset and during the investigation.  Carefully evaluate whistleblower allegations.  Request regular updates from outside counsel, without limiting the investigation.  Consider whether an oral report at the conclusion of the investigation is sufficient.  The authors conclude their piece by stating, “By keeping in mind the issues addressed above, the Board will be better prepared for the investigation and readily able to exercise good judgment throughout the review. A well-conducted investigation by the Board may spare the company further disruption and costs associated with follow-on investigations by the regulators, or at the very least minimize the company’s exposure.” Three key takeaways: Retain the right counsel. Consider conflicts and appearance. Carefully evaluate all whistleblower allegations and reject retaliation. Consider receiving oral reports on an ongoing basis and one lengthy oral report at the end of the investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 17 Aug 2020 17:00:00 -0000 What leads to a successful Board investigation? full Thomas Fox What are the 7 factors to a successful Board investigation? Find out in today's edition of 31 Days to a More Effective Compliance Program. Once again, referencing the article, “Successful Board Investigations”, David Bayless and Tammy Albarrán, offered seven considerations to facilitate a successful Board investigation.  Consider whether you need independent outside counsel.  Consider hiring an experienced investigator to lead the internal investigation.  Consider the need to retain outside experts.  Analyze potential conflicts of interest at the outset and during the investigation.  Carefully evaluate whistleblower allegations.  Request regular updates from outside counsel, without limiting the investigation.  Consider whether an oral report at the conclusion of the investigation is sufficient.  The authors conclude their piece by stating, “By keeping in mind the issues addressed above, the Board will be better prepared for the investigation and readily able to exercise good judgment throughout the review. A well-conducted investigation by the Board may spare the company further disruption and costs associated with follow-on investigations by the regulators, or at the very least minimize the company’s exposure.” Three key takeaways: Retain the right counsel. Consider conflicts and appearance. Carefully evaluate all whistleblower allegations and reject retaliation. Consider receiving oral reports on an ongoing basis and one lengthy oral report at the end of the investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Once again, referencing the article, “Successful Board Investigations”, David Bayless and Tammy Albarrán, offered seven considerations to facilitate a successful Board investigation. 

  • Consider whether you need independent outside counsel. 
  • Consider hiring an experienced investigator to lead the internal investigation. 
  • Consider the need to retain outside experts. 
  • Analyze potential conflicts of interest at the outset and during the investigation. 
  • Carefully evaluate whistleblower allegations. 
  • Request regular updates from outside counsel, without limiting the investigation. 
  • Consider whether an oral report at the conclusion of the investigation is sufficient. 


The authors conclude their piece by stating, “By keeping in mind the issues addressed above, the Board will be better prepared for the investigation and readily able to exercise good judgment throughout the review. A well-conducted investigation by the Board may spare the company further disruption and costs associated with follow-on investigations by the regulators, or at the very least minimize the company’s exposure.”

Three key takeaways:

  1. Retain the right counsel. Consider conflicts and appearance.
  2. Carefully evaluate all whistleblower allegations and reject retaliation.
  3. Consider receiving oral reports on an ongoing basis and one lengthy oral report at the end of the investigation.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 572 no What Is Your Board's Investigation Protocol Many companies have an investigation protocol in place when a potential Foreign Corruption Practices Act (FCPA) or other legal issue arises? However, many Boards of Directors do not have the same rigor when it comes to an investigation, which should be conducted or led by the Board itself. The consequences of this lack of foresight can be problematic, because if a Board of Directors does not get an investigation which it handles right, the consequences to the company, its reputation and value can all be quite severe. In an article in the Corporate Board magazine, entitled “Successful Board Investigations”; David Bayless and Tammy Albarrán, wrote about five key goals that any investigation led by a Board of Directors must meet. They are: Thoroughness - The authors believe that one of the key, and most critical, questions that any regulator might pose is just how thorough is an investigation; to test whether they can rely on the facts discovered without hav­ing to repeat the investigation themselves. Regulators tend to be skeptical of investigations where limits are placed (expressly or otherwise) on the investigators, in terms of what is investigated, or how the investigation is conducted. Objectivity - Here the authors write that any “investigation must follow the facts wherever they lead, regardless of the conse­quences. This includes how the findings may impact senior management or other company employees. An investigation seen as lacking objectivity will be viewed by outsiders as inadequate or deficient.” Accuracy - As in any part of a best practices anti-corruption compliance program, the three most important things are Document, Document and Document. This means that the factual findings of an investiga­tion must be well supported. For if the developed facts are not well supported, the authors believe that the investigation is “open to collateral attack by skeptical prosecutors and regulators. If that happens, the time and money spent on the internal investigation will have been wasted, because the government will end up conducting its own investigation of the same issues.” Timeliness - This has become even more necessary with the tight deadlines set under the Dodd-Frank Act Whistleblower provisions. But there are other considerations for a public company such as an impending Securities and Exchange Commission (SEC) quarterly or annual report that may need to be deferred absent as a timely resolution of the matter. Lastly, the Department of Justice (DOJ) or SEC may view delaying an investigation as simply a part of document spoliation. So timeliness is crucial. Credibility - One of the realities of any FCPA investigation is that a Board of Directors led investigation is reviewed after the fact by not only skeptical third parties but also sometimes years after the initial events and investigation. So not only is there the opportunity for Monday-Morning Quarterbacking but quite a bit of post event analysis. So the authors believe that any Board of Directors led investigation “must be (and must be perceived as) credible as to what was done, how it was done, and who did it. Otherwise, the board’s work will have been for naught.” Three Key Takeaways The Board should have a written protocol for investigations prepared in advance. This gives cover to a Board when regulators come knocking or other third parties seek review. Remember the 5 goals of any Board led investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 14 Aug 2020 17:00:00 -0000 What Is Your Board's Investigation Protocol full Thomas Fox Why should a Board of Directors have an investigation protocol in place? Find out on this episode of 31 Days to a More Effective Compliance Program. Many companies have an investigation protocol in place when a potential Foreign Corruption Practices Act (FCPA) or other legal issue arises? However, many Boards of Directors do not have the same rigor when it comes to an investigation, which should be conducted or led by the Board itself. The consequences of this lack of foresight can be problematic, because if a Board of Directors does not get an investigation which it handles right, the consequences to the company, its reputation and value can all be quite severe. In an article in the Corporate Board magazine, entitled “Successful Board Investigations”; David Bayless and Tammy Albarrán, wrote about five key goals that any investigation led by a Board of Directors must meet. They are: Thoroughness - The authors believe that one of the key, and most critical, questions that any regulator might pose is just how thorough is an investigation; to test whether they can rely on the facts discovered without hav­ing to repeat the investigation themselves. Regulators tend to be skeptical of investigations where limits are placed (expressly or otherwise) on the investigators, in terms of what is investigated, or how the investigation is conducted. Objectivity - Here the authors write that any “investigation must follow the facts wherever they lead, regardless of the conse­quences. This includes how the findings may impact senior management or other company employees. An investigation seen as lacking objectivity will be viewed by outsiders as inadequate or deficient.” Accuracy - As in any part of a best practices anti-corruption compliance program, the three most important things are Document, Document and Document. This means that the factual findings of an investiga­tion must be well supported. For if the developed facts are not well supported, the authors believe that the investigation is “open to collateral attack by skeptical prosecutors and regulators. If that happens, the time and money spent on the internal investigation will have been wasted, because the government will end up conducting its own investigation of the same issues.” Timeliness - This has become even more necessary with the tight deadlines set under the Dodd-Frank Act Whistleblower provisions. But there are other considerations for a public company such as an impending Securities and Exchange Commission (SEC) quarterly or annual report that may need to be deferred absent as a timely resolution of the matter. Lastly, the Department of Justice (DOJ) or SEC may view delaying an investigation as simply a part of document spoliation. So timeliness is crucial. Credibility - One of the realities of any FCPA investigation is that a Board of Directors led investigation is reviewed after the fact by not only skeptical third parties but also sometimes years after the initial events and investigation. So not only is there the opportunity for Monday-Morning Quarterbacking but quite a bit of post event analysis. So the authors believe that any Board of Directors led investigation “must be (and must be perceived as) credible as to what was done, how it was done, and who did it. Otherwise, the board’s work will have been for naught.” Three Key Takeaways The Board should have a written protocol for investigations prepared in advance. This gives cover to a Board when regulators come knocking or other third parties seek review. Remember the 5 goals of any Board led investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Many companies have an investigation protocol in place when a potential Foreign Corruption Practices Act (FCPA) or other legal issue arises? However, many Boards of Directors do not have the same rigor when it comes to an investigation, which should be conducted or led by the Board itself. The consequences of this lack of foresight can be problematic, because if a Board of Directors does not get an investigation which it handles right, the consequences to the company, its reputation and value can all be quite severe.

In an article in the Corporate Board magazine, entitled “Successful Board Investigations”; David Bayless and Tammy Albarrán, wrote about five key goals that any investigation led by a Board of Directors must meet. They are:

  • Thoroughness - The authors believe that one of the key, and most critical, questions that any regulator might pose is just how thorough is an investigation; to test whether they can rely on the facts discovered without hav­ing to repeat the investigation themselves. Regulators tend to be skeptical of investigations where limits are placed (expressly or otherwise) on the investigators, in terms of what is investigated, or how the investigation is conducted.
  • Objectivity - Here the authors write that any “investigation must follow the facts wherever they lead, regardless of the conse­quences. This includes how the findings may impact senior management or other company employees. An investigation seen as lacking objectivity will be viewed by outsiders as inadequate or deficient.”
  • Accuracy - As in any part of a best practices anti-corruption compliance program, the three most important things are Document, Document and Document. This means that the factual findings of an investiga­tion must be well supported. For if the developed facts are not well supported, the authors believe that the investigation is “open to collateral attack by skeptical prosecutors and regulators. If that happens, the time and money spent on the internal investigation will have been wasted, because the government will end up conducting its own investigation of the same issues.”
  • Timeliness - This has become even more necessary with the tight deadlines set under the Dodd-Frank Act Whistleblower provisions. But there are other considerations for a public company such as an impending Securities and Exchange Commission (SEC) quarterly or annual report that may need to be deferred absent as a timely resolution of the matter. Lastly, the Department of Justice (DOJ) or SEC may view delaying an investigation as simply a part of document spoliation. So timeliness is crucial.
  • Credibility - One of the realities of any FCPA investigation is that a Board of Directors led investigation is reviewed after the fact by not only skeptical third parties but also sometimes years after the initial events and investigation. So not only is there the opportunity for Monday-Morning Quarterbacking but quite a bit of post event analysis. So the authors believe that any Board of Directors led investigation “must be (and must be perceived as) credible as to what was done, how it was done, and who did it. Otherwise, the board’s work will have been for naught.”

Three Key Takeaways

  1. The Board should have a written protocol for investigations prepared in advance.
  2. This gives cover to a Board when regulators come knocking or other third parties seek review.
  3. Remember the 5 goals of any Board led investigation.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 664 no Board Governance and Risk Oversight One of the ongoing questions from members of Board of Directors is how to resolve the tension between oversight and managing. I recently had the opportunity to visit with Joe Howell, the Executive Vice President (EVP) of Workiva, Inc. on this subject. Howell has worked on and with Boards of Directors at various companies and I wanted to garner his understanding of the role of a Board and both senior management and a Chief Compliance Officer (CCO). Howell had a short response which I thought was an excellent starting point to understand the role; put sand in the shoes of management. The key to such a metaphor succeeding is that a Board of Directors, “by continuing to challenge management on these scenarios that management has considered and the stories management is telling itself about what could go wrong”, can “help get management out of its comfort zone by and large executive teams begin to believe themselves when they talk about how well they’re doing. The independent challenge that the board can offer putting the little bit of sand in the shoe to make sure that you’re thinking about things carefully can cause you to step back and really focus your resources where they're needed.” Howell noted the role of the Board is not management but oversight, focusing on governance. To do so, an effective Board should challenge senior management not only on what they have planned for but what they may not have considered or may not even know about. He said, “one very good example is the whole, the reputation of those stakeholders involved in the company and that can be the management team itself, the employees, and the board members themselves.” This is because reputational damage hurts everyone. Howell went on to state, “it’s very important as we go through some of the ways the board can help management in that role. I think the things that really make a difference to management is when the board is able to be an effective devil’s advocate. Not managing management but helping them in their governing role by helping management to step back and think critically of their own underlying assumptions and biases.” A Board is not simply there to be a rubber stamp for senior management. It must exercise independent judgment, action and oversight. Further, it is the Board’s role to ask hard, difficult and probing questions to make sure management is not only doing its job but has considered other risk possibilities. Three Key Takeaways Boards should force management to open up the company to itself. Boards should be a grain of sand in the shoe of management. Boards should make sure senior management is aware of and planning for both known and unknown risks. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 13 Aug 2020 17:00:00 -0000 Board Governance and Risk Overisght full Thomas Fox What is the role of the board of Directors in risk Overisght? Find out as I am joined by special guest Joe Howell on this episode of 31 Days to a More Effective Compliance Program. One of the ongoing questions from members of Board of Directors is how to resolve the tension between oversight and managing. I recently had the opportunity to visit with Joe Howell, the Executive Vice President (EVP) of Workiva, Inc. on this subject. Howell has worked on and with Boards of Directors at various companies and I wanted to garner his understanding of the role of a Board and both senior management and a Chief Compliance Officer (CCO). Howell had a short response which I thought was an excellent starting point to understand the role; put sand in the shoes of management. The key to such a metaphor succeeding is that a Board of Directors, “by continuing to challenge management on these scenarios that management has considered and the stories management is telling itself about what could go wrong”, can “help get management out of its comfort zone by and large executive teams begin to believe themselves when they talk about how well they’re doing. The independent challenge that the board can offer putting the little bit of sand in the shoe to make sure that you’re thinking about things carefully can cause you to step back and really focus your resources where they're needed.” Howell noted the role of the Board is not management but oversight, focusing on governance. To do so, an effective Board should challenge senior management not only on what they have planned for but what they may not have considered or may not even know about. He said, “one very good example is the whole, the reputation of those stakeholders involved in the company and that can be the management team itself, the employees, and the board members themselves.” This is because reputational damage hurts everyone. Howell went on to state, “it’s very important as we go through some of the ways the board can help management in that role. I think the things that really make a difference to management is when the board is able to be an effective devil’s advocate. Not managing management but helping them in their governing role by helping management to step back and think critically of their own underlying assumptions and biases.” A Board is not simply there to be a rubber stamp for senior management. It must exercise independent judgment, action and oversight. Further, it is the Board’s role to ask hard, difficult and probing questions to make sure management is not only doing its job but has considered other risk possibilities. Three Key Takeaways Boards should force management to open up the company to itself. Boards should be a grain of sand in the shoe of management. Boards should make sure senior management is aware of and planning for both known and unknown risks. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the ongoing questions from members of Board of Directors is how to resolve the tension between oversight and managing. I recently had the opportunity to visit with Joe Howell, the Executive Vice President (EVP) of Workiva, Inc. on this subject. Howell has worked on and with Boards of Directors at various companies and I wanted to garner his understanding of the role of a Board and both senior management and a Chief Compliance Officer (CCO). Howell had a short response which I thought was an excellent starting point to understand the role; put sand in the shoes of management.

The key to such a metaphor succeeding is that a Board of Directors, “by continuing to challenge management on these scenarios that management has considered and the stories management is telling itself about what could go wrong”, can “help get management out of its comfort zone by and large executive teams begin to believe themselves when they talk about how well they’re doing. The independent challenge that the board can offer putting the little bit of sand in the shoe to make sure that you’re thinking about things carefully can cause you to step back and really focus your resources where they're needed.”

Howell noted the role of the Board is not management but oversight, focusing on governance. To do so, an effective Board should challenge senior management not only on what they have planned for but what they may not have considered or may not even know about. He said, “one very good example is the whole, the reputation of those stakeholders involved in the company and that can be the management team itself, the employees, and the board members themselves.” This is because reputational damage hurts everyone. Howell went on to state, “it’s very important as we go through some of the ways the board can help management in that role. I think the things that really make a difference to management is when the board is able to be an effective devil’s advocate. Not managing management but helping them in their governing role by helping management to step back and think critically of their own underlying assumptions and biases.”

A Board is not simply there to be a rubber stamp for senior management. It must exercise independent judgment, action and oversight. Further, it is the Board’s role to ask hard, difficult and probing questions to make sure management is not only doing its job but has considered other risk possibilities.

Three Key Takeaways

  1. Boards should force management to open up the company to itself.
  2. Boards should be a grain of sand in the shoe of management.
  3. Boards should make sure senior management is aware of and planning for both known and unknown risks.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 803 no The Board as an Internal Control James Doty, former Commissioner of the Public Company Accounting Oversight Board (PCAOB) was once asked if the Board or its sub-committee which handles audits was a part of a company’s internal financial controls. He answered that yes, he believed that was one of the roles of an Audit Committee or full Board. I had never thought of the Board as an internal control but the more I thought about it, the more I realized it was an important insight for any Chief Compliance Officer or compliance practitioner as it also applies as a compliance internal control. In the FCPA Resource Guide, 2nd edition, in the Hallmarks of an Effective Compliance Program, there are two specific references to the obligations of a Board. The first in Hallmark No. 1 , which states, “Within a business organization, compliance begins with the board of directors and senior executives setting the proper tone for the rest of the company.” The second is found under Hallmark No. 3, entitled “Oversight, Autonomy and Resources”, where it discusses that the CCO should have “direct access to an organization’s governing authority, such as the board of directors and committees of the board of directors (e.g., the audit committee).” Further, under the US Sentencing Guidelines, the Board must exercise reasonable oversight on the effectiveness of a company’s compliance program. The Department of Justice’s (DOJ) Prosecution Standards posed the following queries: (1) Do the Directors exercise independent review of a company’s compliance program? and (2) Are Directors provided information sufficient to enable the exercise of independent judgment? Doty’s remarks drove home to me the absolute requirement for Board participation in any best practices or even effective anti-corruption compliance program. A Board’s oversight is part of effective compliance controls, then the failure to do so may result in something far worse than bad governance. Such inattention could directly lead to a FCPA violation and could even form the basis of an independent SOX violation as to the Board. Three Key Takeaways A Board must engage in active oversight. A Board should review the design of internal controls on a regular basis. Failure to do so could form the basis for an independent legal violation under SOX. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 12 Aug 2020 17:00:00 -0000 The Board as an Internal Control full Thomas Fox How does a Board of Directors act as an Internal Control? James Doty, former Commissioner of the Public Company Accounting Oversight Board (PCAOB) was once asked if the Board or its sub-committee which handles audits was a part of a company’s internal financial controls. He answered that yes, he believed that was one of the roles of an Audit Committee or full Board. I had never thought of the Board as an internal control but the more I thought about it, the more I realized it was an important insight for any Chief Compliance Officer or compliance practitioner as it also applies as a compliance internal control. In the FCPA Resource Guide, 2nd edition, in the Hallmarks of an Effective Compliance Program, there are two specific references to the obligations of a Board. The first in Hallmark No. 1 , which states, “Within a business organization, compliance begins with the board of directors and senior executives setting the proper tone for the rest of the company.” The second is found under Hallmark No. 3, entitled “Oversight, Autonomy and Resources”, where it discusses that the CCO should have “direct access to an organization’s governing authority, such as the board of directors and committees of the board of directors (e.g., the audit committee).” Further, under the US Sentencing Guidelines, the Board must exercise reasonable oversight on the effectiveness of a company’s compliance program. The Department of Justice’s (DOJ) Prosecution Standards posed the following queries: (1) Do the Directors exercise independent review of a company’s compliance program? and (2) Are Directors provided information sufficient to enable the exercise of independent judgment? Doty’s remarks drove home to me the absolute requirement for Board participation in any best practices or even effective anti-corruption compliance program. A Board’s oversight is part of effective compliance controls, then the failure to do so may result in something far worse than bad governance. Such inattention could directly lead to a FCPA violation and could even form the basis of an independent SOX violation as to the Board. Three Key Takeaways A Board must engage in active oversight. A Board should review the design of internal controls on a regular basis. Failure to do so could form the basis for an independent legal violation under SOX. Learn more about your ad choices. Visit megaphone.fm/adchoices James Doty, former Commissioner of the Public Company Accounting Oversight Board (PCAOB) was once asked if the Board or its sub-committee which handles audits was a part of a company’s internal financial controls. He answered that yes, he believed that was one of the roles of an Audit Committee or full Board. I had never thought of the Board as an internal control but the more I thought about it, the more I realized it was an important insight for any Chief Compliance Officer or compliance practitioner as it also applies as a compliance internal control.

In the FCPA Resource Guide, 2nd edition, in the Hallmarks of an Effective Compliance Program, there are two specific references to the obligations of a Board. The first in Hallmark No. 1 , which states, “Within a business organization, compliance begins with the board of directors and senior executives setting the proper tone for the rest of the company.” The second is found under Hallmark No. 3, entitled “Oversight, Autonomy and Resources”, where it discusses that the CCO should have “direct access to an organization’s governing authority, such as the board of directors and committees of the board of directors (e.g., the audit committee).” Further, under the US Sentencing Guidelines, the Board must exercise reasonable oversight on the effectiveness of a company’s compliance program. The Department of Justice’s (DOJ) Prosecution Standards posed the following queries: (1) Do the Directors exercise independent review of a company’s compliance program? and (2) Are Directors provided information sufficient to enable the exercise of independent judgment? Doty’s remarks drove home to me the absolute requirement for Board participation in any best practices or even effective anti-corruption compliance program.

A Board’s oversight is part of effective compliance controls, then the failure to do so may result in something far worse than bad governance. Such inattention could directly lead to a FCPA violation and could even form the basis of an independent SOX violation as to the Board.

Three Key Takeaways

  1. A Board must engage in active oversight.
  2. A Board should review the design of internal controls on a regular basis.
  3. Failure to do so could form the basis for an independent legal violation under SOX.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 770 no The Board's Role with Internal Controls The basic framework for internal controls is derived from the COSO Model developed by the Committee of Sponsoring Organizations of the Treadway Commission in 1992 (COSO). This model has become the standard for an internal control framework and provides a structure to ensure companies address the key elements that should result in an effective system of internal controls. Using the COSO Model, as modified in 2013, provides a very supportable approach when regulators challenge whether a company has effective internal controls. The COSO Model defines internal controls in a pyramid, from bottom to top, as follows: (a) Control environment, (b) Risk assessment, (c) Control activities, (d) Information and communication, and (e) Monitoring. Internal controls for a Board or Board Compliance Committee should be broken down into five concepts: Risk Assessment – A Board should assess the compliance risks associated with its business. Corporate Compliance Policy and Code of Conduct – A Board should have an overall governance document which will inform the company, its employees, stakeholders and third parties of the conduct the company expects from an employee. If the company is global/multi-national, this document should be translated into the relevant languages as appropriate. Implementing Procedures – A Board should determine if the company has a written set of procedures in place that instructs employees on the details of how to comply with the company’s compliance policy. Training – There are two levels of Board training. The first should be that the Board has a general understanding of what the FCPA is and it should also understand its role in an effective compliance program. Monitor Compliance – A Board should independently test, assess and audit to determine if its compliance policies and procedures are a ‘living and breathing program’ and not just a paper tiger. Three Key Takeaways Has your company implemented COSO 2013? What was the Board’s involvement? What is your documentation? Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 11 Aug 2020 17:00:00 -0000 The Board's Role with Internal Controls full Thomas Fox What is the Board of Director's role with internal controls? Find out in this episode of 31 Days to a More Effective Compliance Program. The basic framework for internal controls is derived from the COSO Model developed by the Committee of Sponsoring Organizations of the Treadway Commission in 1992 (COSO). This model has become the standard for an internal control framework and provides a structure to ensure companies address the key elements that should result in an effective system of internal controls. Using the COSO Model, as modified in 2013, provides a very supportable approach when regulators challenge whether a company has effective internal controls. The COSO Model defines internal controls in a pyramid, from bottom to top, as follows: (a) Control environment, (b) Risk assessment, (c) Control activities, (d) Information and communication, and (e) Monitoring. Internal controls for a Board or Board Compliance Committee should be broken down into five concepts: Risk Assessment – A Board should assess the compliance risks associated with its business. Corporate Compliance Policy and Code of Conduct – A Board should have an overall governance document which will inform the company, its employees, stakeholders and third parties of the conduct the company expects from an employee. If the company is global/multi-national, this document should be translated into the relevant languages as appropriate. Implementing Procedures – A Board should determine if the company has a written set of procedures in place that instructs employees on the details of how to comply with the company’s compliance policy. Training – There are two levels of Board training. The first should be that the Board has a general understanding of what the FCPA is and it should also understand its role in an effective compliance program. Monitor Compliance – A Board should independently test, assess and audit to determine if its compliance policies and procedures are a ‘living and breathing program’ and not just a paper tiger. Three Key Takeaways Has your company implemented COSO 2013? What was the Board’s involvement? What is your documentation? Learn more about your ad choices. Visit megaphone.fm/adchoices The basic framework for internal controls is derived from the COSO Model developed by the Committee of Sponsoring Organizations of the Treadway Commission in 1992 (COSO). This model has become the standard for an internal control framework and provides a structure to ensure companies address the key elements that should result in an effective system of internal controls. Using the COSO Model, as modified in 2013, provides a very supportable approach when regulators challenge whether a company has effective internal controls. The COSO Model defines internal controls in a pyramid, from bottom to top, as follows: (a) Control environment, (b) Risk assessment, (c) Control activities, (d) Information and communication, and (e) Monitoring.

Internal controls for a Board or Board Compliance Committee should be broken down into five concepts:

  1. Risk Assessment – A Board should assess the compliance risks associated with its business.
  2. Corporate Compliance Policy and Code of Conduct – A Board should have an overall governance document which will inform the company, its employees, stakeholders and third parties of the conduct the company expects from an employee. If the company is global/multi-national, this document should be translated into the relevant languages as appropriate.
  3. Implementing Procedures – A Board should determine if the company has a written set of procedures in place that instructs employees on the details of how to comply with the company’s compliance policy.
  4. Training – There are two levels of Board training. The first should be that the Board has a general understanding of what the FCPA is and it should also understand its role in an effective compliance program.
  5. Monitor Compliance – A Board should independently test, assess and audit to determine if its compliance policies and procedures are a ‘living and breathing program’ and not just a paper tiger.

Three Key Takeaways

  1. Has your company implemented COSO 2013?
  2. What was the Board’s involvement?
  3. What is your documentation?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 770 no Inquiring up and down Where does “tone at the top” start? With any public and most private U.S. companies, it is at the Board of Directors. But what is the role of a company’s Board in compliance? First a Board should not engage in management but should engage in oversight of a CEO and senior management. The Board does this through asking hard questions, risk assessment and identification. Initially it must be important that the Board receive direct access to such information on a company’s policies on this issue. The Board must have quarterly or semi-annual reports from a company’s CCO to either the Audit Committee or the Compliance Committee. Every Board should create a Compliance Committee to deal with compliance issues, as an Audit Committee may more appropriately deal with financial audit issues. A Board Compliance Committee can devote itself exclusively to non-financial compliance. The Board’s oversight role should be to receive such regular reports on the structure of the company’s compliance program, its actions and self-evaluations. From this information the Board can give oversight to any modifications to managing FCPA risk that should be implemented. CCO reporting to the Compliance Committee must be structured carefully to promote ethics and compliance. Three key takeaways: A Board Compliance Committee should provide oversight not management. A CCO should use multiple reports to communicate with the Board Compliance Committee. Board Compliance Committee oversight makes companies more efficient and at the end of the day more profitable. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 10 Aug 2020 17:00:00 -0000 Inquiring up and down full Thomas Fox What is the role of a company’s Board in compliance? Find out in this episode of 31 Days to a More Effective Compliance Program. Where does “tone at the top” start? With any public and most private U.S. companies, it is at the Board of Directors. But what is the role of a company’s Board in compliance? First a Board should not engage in management but should engage in oversight of a CEO and senior management. The Board does this through asking hard questions, risk assessment and identification. Initially it must be important that the Board receive direct access to such information on a company’s policies on this issue. The Board must have quarterly or semi-annual reports from a company’s CCO to either the Audit Committee or the Compliance Committee. Every Board should create a Compliance Committee to deal with compliance issues, as an Audit Committee may more appropriately deal with financial audit issues. A Board Compliance Committee can devote itself exclusively to non-financial compliance. The Board’s oversight role should be to receive such regular reports on the structure of the company’s compliance program, its actions and self-evaluations. From this information the Board can give oversight to any modifications to managing FCPA risk that should be implemented. CCO reporting to the Compliance Committee must be structured carefully to promote ethics and compliance. Three key takeaways: A Board Compliance Committee should provide oversight not management. A CCO should use multiple reports to communicate with the Board Compliance Committee. Board Compliance Committee oversight makes companies more efficient and at the end of the day more profitable. Learn more about your ad choices. Visit megaphone.fm/adchoices Where does “tone at the top” start? With any public and most private U.S. companies, it is at the Board of Directors. But what is the role of a company’s Board in compliance? First a Board should not engage in management but should engage in oversight of a CEO and senior management. The Board does this through asking hard questions, risk assessment and identification.

Initially it must be important that the Board receive direct access to such information on a company’s policies on this issue. The Board must have quarterly or semi-annual reports from a company’s CCO to either the Audit Committee or the Compliance Committee. Every Board should create a Compliance Committee to deal with compliance issues, as an Audit Committee may more appropriately deal with financial audit issues. A Board Compliance Committee can devote itself exclusively to non-financial compliance. The Board’s oversight role should be to receive such regular reports on the structure of the company’s compliance program, its actions and self-evaluations. From this information the Board can give oversight to any modifications to managing FCPA risk that should be implemented. CCO reporting to the Compliance Committee must be structured carefully to promote ethics and compliance.

Three key takeaways:

  1. A Board Compliance Committee should provide oversight not management.
  2. A CCO should use multiple reports to communicate with the Board Compliance Committee.
  3. Board Compliance Committee oversight makes companies more efficient and at the end of the day more profitable.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 545 no OIG Guidance for Boards Regarding Compliance The OIG white paper “Practical Guidance for Health Care Governing Boards on Compliance Oversight” (OIG Guidance), provides an excellent road map for thinking about how to structure a Compliance Committee for your Board and a Board’s obligations. As an introduction, the OIG Guidance states that a Board must act in good faith around its obligations regarding compliance. This means that there must be both a corporation information and reporting system and that such reporting mechanisms provide appropriate information to a Board. It states: The existence of a corporate reporting system is a key compliance program element, which not only keeps the Board informed of the activities of the organization, but also enables an organization to evaluate and respond to issues of potentially illegal or otherwise inappropriate activity. The OIG Guidance sets out four areas of Board oversight and review of a compliance function: Roles of, and relationships between, the organization’s audit, compliance, and legal departments; Mechanism and process for issue-reporting within an organization; Approach to identifying regulatory risk; and Methods of encouraging enterprise-wide accountability for achievement of compliance goals and objectives. The OIG Guidance is an excellent review for not only compliance professionals and others in the healthcare industry but a good primer for Boards around their own duties under a best practices compliance program. The U.S. Sentencing Guidelines, the Hallmarks of an Effective Compliance Program, the OIG Guidance, and OIG Corporate Integrity Agreements can be used as baseline assessment tools for Boards and management in determining what specific functions may be necessary to meet the requirements of an effective compliance program. Three key takeaways: Information flow up to the Board is critical. Compliance should be institutionalized in your company as a way of life. A Board needs to consider all risks. This month's sponsor is Affiliated Monitors, Inc.  Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 07 Aug 2020 17:00:00 -0000 OIG Guidance for Boards Regarding Compliance full Thomas Fox The OIG white paper “Practical Guidance for Health Care Governing Boards on Compliance Oversight” (OIG Guidance), provides an excellent road map for thinking about how to structure a Compliance Committee for your Board and a Board’s obligations The OIG white paper “Practical Guidance for Health Care Governing Boards on Compliance Oversight” (OIG Guidance), provides an excellent road map for thinking about how to structure a Compliance Committee for your Board and a Board’s obligations. As an introduction, the OIG Guidance states that a Board must act in good faith around its obligations regarding compliance. This means that there must be both a corporation information and reporting system and that such reporting mechanisms provide appropriate information to a Board. It states: The existence of a corporate reporting system is a key compliance program element, which not only keeps the Board informed of the activities of the organization, but also enables an organization to evaluate and respond to issues of potentially illegal or otherwise inappropriate activity. The OIG Guidance sets out four areas of Board oversight and review of a compliance function: Roles of, and relationships between, the organization’s audit, compliance, and legal departments; Mechanism and process for issue-reporting within an organization; Approach to identifying regulatory risk; and Methods of encouraging enterprise-wide accountability for achievement of compliance goals and objectives. The OIG Guidance is an excellent review for not only compliance professionals and others in the healthcare industry but a good primer for Boards around their own duties under a best practices compliance program. The U.S. Sentencing Guidelines, the Hallmarks of an Effective Compliance Program, the OIG Guidance, and OIG Corporate Integrity Agreements can be used as baseline assessment tools for Boards and management in determining what specific functions may be necessary to meet the requirements of an effective compliance program. Three key takeaways: Information flow up to the Board is critical. Compliance should be institutionalized in your company as a way of life. A Board needs to consider all risks. This month's sponsor is Affiliated Monitors, Inc.  Learn more about your ad choices. Visit megaphone.fm/adchoices The OIG white paper “Practical Guidance for Health Care Governing Boards on Compliance Oversight” (OIG Guidance), provides an excellent road map for thinking about how to structure a Compliance Committee for your Board and a Board’s obligations. As an introduction, the OIG Guidance states that a Board must act in good faith around its obligations regarding compliance. This means that there must be both a corporation information and reporting system and that such reporting mechanisms provide appropriate information to a Board. It states: The existence of a corporate reporting system is a key compliance program element, which not only keeps the Board informed of the activities of the organization, but also enables an organization to evaluate and respond to issues of potentially illegal or otherwise inappropriate activity.

The OIG Guidance sets out four areas of Board oversight and review of a compliance function:

  1. Roles of, and relationships between, the organization’s audit, compliance, and legal departments;
  2. Mechanism and process for issue-reporting within an organization;
  3. Approach to identifying regulatory risk; and
  4. Methods of encouraging enterprise-wide accountability for achievement of compliance goals and objectives.

The OIG Guidance is an excellent review for not only compliance professionals and others in the healthcare industry but a good primer for Boards around their own duties under a best practices compliance program. The U.S. Sentencing Guidelines, the Hallmarks of an Effective Compliance Program, the OIG Guidance, and OIG Corporate Integrity Agreements can be used as baseline assessment tools for Boards and management in determining what specific functions may be necessary to meet the requirements of an effective compliance program.

Three key takeaways:

  1. Information flow up to the Board is critical.
  2. Compliance should be institutionalized in your company as a way of life.
  3. A Board needs to consider all risks.

This month's sponsor is Affiliated Monitors, Inc. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 773 no Compliance expertise on the Board Every Board of Directors need a true compliance expert sitting at the table. Almost every Board has a former CFO, former head of Internal Audit or persons with a similar background and often times these are also the Audit Committee members of the Board. Such a background brings a level of sophistication, training and SME that can help all companies with their financial reporting and other finance-based issues. So why is there not such compliance SME at the Board level? This requirement was set out in 2017 in the FCPA Corporate Enforcement Policy, where one of the criteria to be evaluated in compliance program is “the availability of compliance expertise to the board;”. Finally, in the 2020 Update to the Evaluation of Corporate Compliance Programs, under the section entitled Oversight, it posed the following questions What compliance expertise has been available on the board of directors? The DOJ and Securities and Exchange Commission brought this concept forward into the FCPA Resource Guide, 2ndedition. This means that when your company is evaluated by the DOJ, under the factors set out in the 2020 Update and the FCPA Corporate Enforcement Policy, to retrospectively determine if your company had a best practices compliance program in place at the time of any violation, you need to have not only the structure of the Board-level Compliance Committee but also the specific SME on the Board and on that committee. Three key takeaways: Boards must have compliance expertise. Government regulators and shareholder groups have both called for greater compliance expertise at the Board. Compliance expertise at the Board works up and down as such expertise can be a resource to both the CCO and Compliance Department. This month's sponsor is Affiliated Monitors, Inc.  Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 06 Aug 2020 17:00:00 -0000 Compliance expertise on the Board full Thomas Fox Why does a Board of Directors need compliance expertise on it? Find out in this episode of 31 Days to a More Effective Compliance Program. Every Board of Directors need a true compliance expert sitting at the table. Almost every Board has a former CFO, former head of Internal Audit or persons with a similar background and often times these are also the Audit Committee members of the Board. Such a background brings a level of sophistication, training and SME that can help all companies with their financial reporting and other finance-based issues. So why is there not such compliance SME at the Board level? This requirement was set out in 2017 in the FCPA Corporate Enforcement Policy, where one of the criteria to be evaluated in compliance program is “the availability of compliance expertise to the board;”. Finally, in the 2020 Update to the Evaluation of Corporate Compliance Programs, under the section entitled Oversight, it posed the following questions What compliance expertise has been available on the board of directors? The DOJ and Securities and Exchange Commission brought this concept forward into the FCPA Resource Guide, 2ndedition. This means that when your company is evaluated by the DOJ, under the factors set out in the 2020 Update and the FCPA Corporate Enforcement Policy, to retrospectively determine if your company had a best practices compliance program in place at the time of any violation, you need to have not only the structure of the Board-level Compliance Committee but also the specific SME on the Board and on that committee. Three key takeaways: Boards must have compliance expertise. Government regulators and shareholder groups have both called for greater compliance expertise at the Board. Compliance expertise at the Board works up and down as such expertise can be a resource to both the CCO and Compliance Department. This month's sponsor is Affiliated Monitors, Inc.  Learn more about your ad choices. Visit megaphone.fm/adchoices Every Board of Directors need a true compliance expert sitting at the table. Almost every Board has a former CFO, former head of Internal Audit or persons with a similar background and often times these are also the Audit Committee members of the Board. Such a background brings a level of sophistication, training and SME that can help all companies with their financial reporting and other finance-based issues. So why is there not such compliance SME at the Board level?

This requirement was set out in 2017 in the FCPA Corporate Enforcement Policy, where one of the criteria to be evaluated in compliance program is “the availability of compliance expertise to the board;”. Finally, in the 2020 Update to the Evaluation of Corporate Compliance Programs, under the section entitled Oversight, it posed the following questions What compliance expertise has been available on the board of directors?

The DOJ and Securities and Exchange Commission brought this concept forward into the FCPA Resource Guide, 2ndedition. This means that when your company is evaluated by the DOJ, under the factors set out in the 2020 Update and the FCPA Corporate Enforcement Policy, to retrospectively determine if your company had a best practices compliance program in place at the time of any violation, you need to have not only the structure of the Board-level Compliance Committee but also the specific SME on the Board and on that committee.

Three key takeaways:

  1. Boards must have compliance expertise.
  2. Government regulators and shareholder groups have both called for greater compliance expertise at the Board.
  3. Compliance expertise at the Board works up and down as such expertise can be a resource to both the CCO and Compliance Department.

This month's sponsor is Affiliated Monitors, Inc. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 765 no BOD Compliance Committee Under the U.S. Sentencing Guidelines, the Board must exercise reasonable oversight on the effectiveness of a company’s compliance program. The DOJ Prosecution Standards posed the following queries: 1) Do the directors exercise independent review of a company’s compliance program? and 2) Are directors provided information sufficient to enable the exercise of independent judgment? Moreover, the FCPA Resource Guide, 2nd edition required a CCO to have direct access to the Board or an appropriate sub-committee and requires a tangible commitment from the top levels of an organization, starting with the Board of Directors, that the company creates an ethical culture. This requirement was brought forward in 2017 in the FCPA Corporate Enforcement Policy. Finally, nn the 2020 Update to the Evaluation of Corporate Compliance Programs, under the section entitled Oversight, it posed the following questions What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions? Today’s regulatory climate and hyper-transparency in social media make a Board Compliance Committee’s task seem Herculean. But more than simply the regulatory climate, shareholders are taking a much more active role in asserting their rights against Boards of Directors. It is incumbent that Boards seek out and obtain sufficient information to fulfill their legal obligations and keep their company off the front page of the New York Times, Wall Street Journal or Financial Times, just to name a few, to prevent serious reputational damage. A Board Compliance Committee is a good place to start. Three key takeaways: The Board Compliance Committee exists to provide oversight and assist the CCO, not to substitute its judgment for that of the CCO. The Board Compliance Committee should work to hold the CCO accountable to hit appropriate metrics. The Board Compliance Committee is ideal for leading the efforts around strategic planning. This month's sponsor is Affiliated Monitors, Inc.  Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 05 Aug 2020 17:00:00 -0000 BOD Compliance Committee full Thomas Fox What is the role of the Board of Directors Compliance Committee? Find out in this episode of 31 Days to a More Effective Compliance Program. Under the U.S. Sentencing Guidelines, the Board must exercise reasonable oversight on the effectiveness of a company’s compliance program. The DOJ Prosecution Standards posed the following queries: 1) Do the directors exercise independent review of a company’s compliance program? and 2) Are directors provided information sufficient to enable the exercise of independent judgment? Moreover, the FCPA Resource Guide, 2nd edition required a CCO to have direct access to the Board or an appropriate sub-committee and requires a tangible commitment from the top levels of an organization, starting with the Board of Directors, that the company creates an ethical culture. This requirement was brought forward in 2017 in the FCPA Corporate Enforcement Policy. Finally, nn the 2020 Update to the Evaluation of Corporate Compliance Programs, under the section entitled Oversight, it posed the following questions What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions? Today’s regulatory climate and hyper-transparency in social media make a Board Compliance Committee’s task seem Herculean. But more than simply the regulatory climate, shareholders are taking a much more active role in asserting their rights against Boards of Directors. It is incumbent that Boards seek out and obtain sufficient information to fulfill their legal obligations and keep their company off the front page of the New York Times, Wall Street Journal or Financial Times, just to name a few, to prevent serious reputational damage. A Board Compliance Committee is a good place to start. Three key takeaways: The Board Compliance Committee exists to provide oversight and assist the CCO, not to substitute its judgment for that of the CCO. The Board Compliance Committee should work to hold the CCO accountable to hit appropriate metrics. The Board Compliance Committee is ideal for leading the efforts around strategic planning. This month's sponsor is Affiliated Monitors, Inc.  Learn more about your ad choices. Visit megaphone.fm/adchoices Under the U.S. Sentencing Guidelines, the Board must exercise reasonable oversight on the effectiveness of a company’s compliance program. The DOJ Prosecution Standards posed the following queries: 1) Do the directors exercise independent review of a company’s compliance program? and 2) Are directors provided information sufficient to enable the exercise of independent judgment? Moreover, the FCPA Resource Guide, 2nd edition required a CCO to have direct access to the Board or an appropriate sub-committee and requires a tangible commitment from the top levels of an organization, starting with the Board of Directors, that the company creates an ethical culture.

This requirement was brought forward in 2017 in the FCPA Corporate Enforcement Policy. Finally, nn the 2020 Update to the Evaluation of Corporate Compliance Programs, under the section entitled Oversight, it posed the following questions What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions?

Today’s regulatory climate and hyper-transparency in social media make a Board Compliance Committee’s task seem Herculean. But more than simply the regulatory climate, shareholders are taking a much more active role in asserting their rights against Boards of Directors. It is incumbent that Boards seek out and obtain sufficient information to fulfill their legal obligations and keep their company off the front page of the New York Times, Wall Street Journal or Financial Times, just to name a few, to prevent serious reputational damage. A Board Compliance Committee is a good place to start.

Three key takeaways:

  1. The Board Compliance Committee exists to provide oversight and assist the CCO, not to substitute its judgment for that of the CCO.
  2. The Board Compliance Committee should work to hold the CCO accountable to hit appropriate metrics.
  3. The Board Compliance Committee is ideal for leading the efforts around strategic planning.

This month's sponsor is Affiliated Monitors, Inc. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 755 no Prudent discharge of compliance obligations What are the obligations of a Board member regarding the FCPA? Are the obligations of the Compliance Committee under the FCPA at odds with a director’s “prudent discharge of duties to shareholders”? Do the words prudent discharge even appear anywhere in the FCPA? In the the case of Stone v. Ritter is found the proposition that “a duty to attempt in good faith to assure that a corporate information and reporting system, which the board concludes is adequate exists.” From the case of In re Walt Disney Company Derivative Litigation, she drew the principle that directors should follow the best practices in the area of ethics and compliance. The Board has the role of monitoring the performance of the compliance function, including monitoring the performance of it using customary economic metrics, and by overseeing compliance with applicable laws and regulations. While the Board is not responsible for auditing or ferreting out compliance problems, it is responsible for determining that the company has an appropriate system of internal controls. The Board should also monitor company policies and practices that address compliance and matters affecting the public perception and reputation of the company. Every company should ensure that it conducts appropriate compliance training for employees and conducts regular compliance assessments. Finally, the Board must take appropriate action if and when it becomes aware of a material problem that it believes management is not properly handling. There is no reference to prudent discharge in the FCPA itself. However, a Board member might well think more than twice about the prudent discharge of duties to the shareholders as both the DOJ and SEC now might well wish to look into a Board’s prudent discharge of duties under the FCPA. Three key takeaways: What is prudent discharge? What is your process for doing compliance at the Board level? A Board must have active rather than passive engagement around compliance. This month's sponsor is Affiliated Monitors, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 04 Aug 2020 17:00:00 -0000 Prudent discharge of compliance obligations full Thomas Fox What is a Board's prudent discharge of duties to shareholders under its compliance obligations. Find out in this episode of 31 Days to a More Effective Compliance Program. What are the obligations of a Board member regarding the FCPA? Are the obligations of the Compliance Committee under the FCPA at odds with a director’s “prudent discharge of duties to shareholders”? Do the words prudent discharge even appear anywhere in the FCPA? In the the case of Stone v. Ritter is found the proposition that “a duty to attempt in good faith to assure that a corporate information and reporting system, which the board concludes is adequate exists.” From the case of In re Walt Disney Company Derivative Litigation, she drew the principle that directors should follow the best practices in the area of ethics and compliance. The Board has the role of monitoring the performance of the compliance function, including monitoring the performance of it using customary economic metrics, and by overseeing compliance with applicable laws and regulations. While the Board is not responsible for auditing or ferreting out compliance problems, it is responsible for determining that the company has an appropriate system of internal controls. The Board should also monitor company policies and practices that address compliance and matters affecting the public perception and reputation of the company. Every company should ensure that it conducts appropriate compliance training for employees and conducts regular compliance assessments. Finally, the Board must take appropriate action if and when it becomes aware of a material problem that it believes management is not properly handling. There is no reference to prudent discharge in the FCPA itself. However, a Board member might well think more than twice about the prudent discharge of duties to the shareholders as both the DOJ and SEC now might well wish to look into a Board’s prudent discharge of duties under the FCPA. Three key takeaways: What is prudent discharge? What is your process for doing compliance at the Board level? A Board must have active rather than passive engagement around compliance. This month's sponsor is Affiliated Monitors, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

What are the obligations of a Board member regarding the FCPA? Are the obligations of the Compliance Committee under the FCPA at odds with a director’s “prudent discharge of duties to shareholders”? Do the words prudent discharge even appear anywhere in the FCPA? In the the case of Stone v. Ritter is found the proposition that “a duty to attempt in good faith to assure that a corporate information and reporting system, which the board concludes is adequate exists.” From the case of In re Walt Disney Company Derivative Litigation, she drew the principle that directors should follow the best practices in the area of ethics and compliance. The Board has the role of monitoring the performance of the compliance function, including monitoring the performance of it using customary economic metrics, and by overseeing compliance with applicable laws and regulations. While the Board is not responsible for auditing or ferreting out compliance problems, it is responsible for determining that the company has an appropriate system of internal controls. The Board should also monitor company policies and practices that address compliance and matters affecting the public perception and reputation of the company. Every company should ensure that it conducts appropriate compliance training for employees and conducts regular compliance assessments. Finally, the Board must take appropriate action if and when it becomes aware of a material problem that it believes management is not properly handling.

There is no reference to prudent discharge in the FCPA itself. However, a Board member might well think more than twice about the prudent discharge of duties to the shareholders as both the DOJ and SEC now might well wish to look into a Board’s prudent discharge of duties under the FCPA.

Three key takeaways:

  1. What is prudent discharge?
  2. What is your process for doing compliance at the Board level?
  3. A Board must have active rather than passive engagement around compliance.


This month's sponsor is Affiliated Monitors, Inc.



Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 762 no Legal requirements of the Board regarding compliance Welcome to this month's offer of 31 Days to a More Effective Compliance Program. This month I will focus on the Board of Directors and its role in an effective compliance program. At the end of August, you will not only have a good summary of the basics of a best practices compliance program for a Board of Directors but information that you can incorporate into your compliance regime. Case law. As to the specific role of best practices in the area of general compliance and ethics, one can look to Delaware corporate law for guidance. The case of In Re Caremark International Inc., 698 A.2d 959, (Del. SCt. 1996) was the first case to hold that a Board’s obligation “includes a duty to attempt in good faith to assure that a corporate information and reporting system, which the board concludes is adequate, exists, and that failure to do so under some circumstances may, in theory at least, render a director liable for losses caused by non-compliance with applicable legal standards.” 2020 FCPA Resource Guide, 2nd edition and U.S. Sentencing Guidelines. A Board’s duty under the FCPA is well-known. In the FCPA Resource Guide, 2nd edition, there are two specific references to the obligations of a Board. The first, in Hallmark No. 1, states: “Within a business organization, compliance begins with the board of directors and senior executives setting the proper tone for the rest of the company.” The second is found under Hallmark No. 3 and notes that the CCO should have “direct access to an organization’s governing authority, such as the board of directors and committees of the board of directors (e.g., the audit committee).” Further, under the U.S. Sentencing Guidelines, the Board must exercise reasonable oversight on the effectiveness of a company’s compliance program. The DOJ’s Prosecution Standards posed the following queries: 1) Do the Directors exercise independent review of a company’s compliance program? and 2) Are Directors provided information sufficient to enable the exercise of independent judgment? From the Delaware cases, a Board must not only have a corporate compliance program in place but actively oversee that function. Further, if a company’s business plan includes a high-risk proposition, there should be additional oversight. In other words, there is an affirmative duty to ask the tough questions. The specific obligations set out regarding the FCPA drive home these general legal obligations down to the specific level of the statute. Three key takeaways: The Delaware courts have led the way with the In Re Caremark and Stone v. Ritter decisions. Note the obligations of the Board under the Ten Hallmarks of an Effective Compliance Program. The U.S. Sentencing Guidelines also require Board involvement and oversight. A special thanks to this month's sponsor, Affiliated Monitors, Inc.  Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 03 Aug 2020 17:00:00 -0000 Legal requirements of the Board regarding compliance full Thomas Fox Welcome to this month's offer of 31 Days to a More Effective Compliance Program. This month I will focus on the Board of Directors and its role in an effective compliance program.  Welcome to this month's offer of 31 Days to a More Effective Compliance Program. This month I will focus on the Board of Directors and its role in an effective compliance program. At the end of August, you will not only have a good summary of the basics of a best practices compliance program for a Board of Directors but information that you can incorporate into your compliance regime. Case law. As to the specific role of best practices in the area of general compliance and ethics, one can look to Delaware corporate law for guidance. The case of In Re Caremark International Inc., 698 A.2d 959, (Del. SCt. 1996) was the first case to hold that a Board’s obligation “includes a duty to attempt in good faith to assure that a corporate information and reporting system, which the board concludes is adequate, exists, and that failure to do so under some circumstances may, in theory at least, render a director liable for losses caused by non-compliance with applicable legal standards.” 2020 FCPA Resource Guide, 2nd edition and U.S. Sentencing Guidelines. A Board’s duty under the FCPA is well-known. In the FCPA Resource Guide, 2nd edition, there are two specific references to the obligations of a Board. The first, in Hallmark No. 1, states: “Within a business organization, compliance begins with the board of directors and senior executives setting the proper tone for the rest of the company.” The second is found under Hallmark No. 3 and notes that the CCO should have “direct access to an organization’s governing authority, such as the board of directors and committees of the board of directors (e.g., the audit committee).” Further, under the U.S. Sentencing Guidelines, the Board must exercise reasonable oversight on the effectiveness of a company’s compliance program. The DOJ’s Prosecution Standards posed the following queries: 1) Do the Directors exercise independent review of a company’s compliance program? and 2) Are Directors provided information sufficient to enable the exercise of independent judgment? From the Delaware cases, a Board must not only have a corporate compliance program in place but actively oversee that function. Further, if a company’s business plan includes a high-risk proposition, there should be additional oversight. In other words, there is an affirmative duty to ask the tough questions. The specific obligations set out regarding the FCPA drive home these general legal obligations down to the specific level of the statute. Three key takeaways: The Delaware courts have led the way with the In Re Caremark and Stone v. Ritter decisions. Note the obligations of the Board under the Ten Hallmarks of an Effective Compliance Program. The U.S. Sentencing Guidelines also require Board involvement and oversight. A special thanks to this month's sponsor, Affiliated Monitors, Inc.  Learn more about your ad choices. Visit megaphone.fm/adchoices Welcome to this month's offer of 31 Days to a More Effective Compliance Program. This month I will focus on the Board of Directors and its role in an effective compliance program. At the end of August, you will not only have a good summary of the basics of a best practices compliance program for a Board of Directors but information that you can incorporate into your compliance regime.

Case law. As to the specific role of best practices in the area of general compliance and ethics, one can look to Delaware corporate law for guidance. The case of In Re Caremark International Inc., 698 A.2d 959, (Del. SCt. 1996) was the first case to hold that a Board’s obligation “includes a duty to attempt in good faith to assure that a corporate information and reporting system, which the board concludes is adequate, exists, and that failure to do so under some circumstances may, in theory at least, render a director liable for losses caused by non-compliance with applicable legal standards.”

2020 FCPA Resource Guide, 2nd edition and U.S. Sentencing Guidelines. A Board’s duty under the FCPA is well-known. In the FCPA Resource Guide, 2nd edition, there are two specific references to the obligations of a Board. The first, in Hallmark No. 1, states: “Within a business organization, compliance begins with the board of directors and senior executives setting the proper tone for the rest of the company.” The second is found under Hallmark No. 3 and notes that the CCO should have “direct access to an organization’s governing authority, such as the board of directors and committees of the board of directors (e.g., the audit committee).” Further, under the U.S. Sentencing Guidelines, the Board must exercise reasonable oversight on the effectiveness of a company’s compliance program. The DOJ’s Prosecution Standards posed the following queries: 1) Do the Directors exercise independent review of a company’s compliance program? and 2) Are Directors provided information sufficient to enable the exercise of independent judgment?

From the Delaware cases, a Board must not only have a corporate compliance program in place but actively oversee that function. Further, if a company’s business plan includes a high-risk proposition, there should be additional oversight. In other words, there is an affirmative duty to ask the tough questions. The specific obligations set out regarding the FCPA drive home these general legal obligations down to the specific level of the statute.

Three key takeaways:

  1. The Delaware courts have led the way with the In Re Caremark and Stone v. Ritter decisions.
  2. Note the obligations of the Board under the Ten Hallmarks of an Effective Compliance Program.
  3. The U.S. Sentencing Guidelines also require Board involvement and oversight.

A special thanks to this month's sponsor, Affiliated Monitors, Inc. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 762 no Wrap up of 3rd Party Management and Preview of Boards of Directors In this final episode for the month of July on 31 Days to a More Effective Compliance Program, I review the past month's offerings and preview the month of August where I take up the topic of Boards of Directors and Compliance.  Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 31 Jul 2020 16:55:47 -0000 Wrap up of 3rd Party Management and Preview of Boards of Directors full Thomas Fox In this final episode for the month of July on 31 Days to a More Effective Compliance Program, I review the past month's offerings and preview the month of August where I take up the topic of Boards of Directors and Compliance.  In this final episode for the month of July on 31 Days to a More Effective Compliance Program, I review the past month's offerings and preview the month of August where I take up the topic of Boards of Directors and Compliance.  Learn more about your ad choices. Visit megaphone.fm/adchoices In this final episode for the month of July on 31 Days to a More Effective Compliance Program, I review the past month's offerings and preview the month of August where I take up the topic of Boards of Directors and Compliance. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 555 no Use of Data to Manage Third-Parties In today's edition of 31 Days to a More Effective Compliance Program, I am joined by Vin DiCianni, founder of Affiliated Monitors. Vin provides insights into how the use of data can facilitate the management of third-parties after the contract is signed. 3 Key Takeaways the process of collecting data cleans up much risk and provides cost savings. More reliable data about third-parties will facilitate their more effective management. Using data to management third-parties will further operationalize your compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 29 Jul 2020 17:00:00 -0000 Use of Data to Manage Third-Parties full Thomas Fox How can you utilize data in the management of third-parties? Find out in today's episode of 31 Days to a More Effective Compliance Program. In today's edition of 31 Days to a More Effective Compliance Program, I am joined by Vin DiCianni, founder of Affiliated Monitors. Vin provides insights into how the use of data can facilitate the management of third-parties after the contract is signed. 3 Key Takeaways the process of collecting data cleans up much risk and provides cost savings. More reliable data about third-parties will facilitate their more effective management. Using data to management third-parties will further operationalize your compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices In today's edition of 31 Days to a More Effective Compliance Program, I am joined by Vin DiCianni, founder of Affiliated Monitors. Vin provides insights into how the use of data can facilitate the management of third-parties after the contract is signed.

3 Key Takeaways

  1. the process of collecting data cleans up much risk and provides cost savings.
  2. More reliable data about third-parties will facilitate their more effective management.
  3. Using data to management third-parties will further operationalize your compliance program.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 573 no Risk ranking in the Supply Chain One of the areas many companies do not focus on enough is possible corruption in their supply chain for goods and services provided on a company’s behalf. The FCPA risks can be just as great through those entry points as it can be through the sales side of an organization. You need to know who your company is doing business with through this channel as much as you need to know your agents seeking business opportunities on your behalf. Most companies have exponentially more vendors than sales agents, so this task may seem daunting. However, a well thought out plan to risk rank your company’s third-parties on the supply chain side can go a long way towards ameliorating this issue. The key is to set reasonable parameters and then management those third-parties which present true corruption risk to your organization. This determination of the level of due diligence and categorization of a supplier should depend on a variety of factors, including, such factors as whether the supplier is (1) located, or will operate, in a high risk country; (2) associated, or recommended or required by, a government official; (3) currently under corruption investigation, or has been recently convicted of any form of corruption; (4) a multinational publicly traded corporation with a recognized exemplary system of compliance and internal controls; or (5) a provider of widely available services and products that are not industry specific. You should note that any supplier, which has foreign government touch points, should move up into a higher level of scrutiny. My suggestion is that you create a three-tiered risk matrix consisting of (1) high-risk suppliers, (2) low-risk suppliers, and (3) minimal-risk suppliers. Below this final category is another category for providers of goods which are commonly available and pose almost no corruption risk. You need to risk rank the third-parties which your supply chain might engage with for FCPA exposure. It should be based on your company’s experience and risk going forward. As with all other third-party risk management issues, you must “Document, Document, and Document”. Three key takeaways: Risk rank your supply chain based on well-conceived strata. Consider not only the compliance risk but also your business risk. Only manage those suppliers which present a corruption risk. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 28 Jul 2020 17:00:00 -0000 Risk ranking in the Supply Chain full Thomas Fox How can you risk rank company's in your Supply Chain? Find out on this episode of 31 Days to a More Effective Compliance Program. One of the areas many companies do not focus on enough is possible corruption in their supply chain for goods and services provided on a company’s behalf. The FCPA risks can be just as great through those entry points as it can be through the sales side of an organization. You need to know who your company is doing business with through this channel as much as you need to know your agents seeking business opportunities on your behalf. Most companies have exponentially more vendors than sales agents, so this task may seem daunting. However, a well thought out plan to risk rank your company’s third-parties on the supply chain side can go a long way towards ameliorating this issue. The key is to set reasonable parameters and then management those third-parties which present true corruption risk to your organization. This determination of the level of due diligence and categorization of a supplier should depend on a variety of factors, including, such factors as whether the supplier is (1) located, or will operate, in a high risk country; (2) associated, or recommended or required by, a government official; (3) currently under corruption investigation, or has been recently convicted of any form of corruption; (4) a multinational publicly traded corporation with a recognized exemplary system of compliance and internal controls; or (5) a provider of widely available services and products that are not industry specific. You should note that any supplier, which has foreign government touch points, should move up into a higher level of scrutiny. My suggestion is that you create a three-tiered risk matrix consisting of (1) high-risk suppliers, (2) low-risk suppliers, and (3) minimal-risk suppliers. Below this final category is another category for providers of goods which are commonly available and pose almost no corruption risk. You need to risk rank the third-parties which your supply chain might engage with for FCPA exposure. It should be based on your company’s experience and risk going forward. As with all other third-party risk management issues, you must “Document, Document, and Document”. Three key takeaways: Risk rank your supply chain based on well-conceived strata. Consider not only the compliance risk but also your business risk. Only manage those suppliers which present a corruption risk. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the areas many companies do not focus on enough is possible corruption in their supply chain for goods and services provided on a company’s behalf. The FCPA risks can be just as great through those entry points as it can be through the sales side of an organization. You need to know who your company is doing business with through this channel as much as you need to know your agents seeking business opportunities on your behalf. Most companies have exponentially more vendors than sales agents, so this task may seem daunting. However, a well thought out plan to risk rank your company’s third-parties on the supply chain side can go a long way towards ameliorating this issue. The key is to set reasonable parameters and then management those third-parties which present true corruption risk to your organization.

This determination of the level of due diligence and categorization of a supplier should depend on a variety of factors, including, such factors as whether the supplier is (1) located, or will operate, in a high risk country; (2) associated, or recommended or required by, a government official; (3) currently under corruption investigation, or has been recently convicted of any form of corruption; (4) a multinational publicly traded corporation with a recognized exemplary system of compliance and internal controls; or (5) a provider of widely available services and products that are not industry specific. You should note that any supplier, which has foreign government touch points, should move up into a higher level of scrutiny.

My suggestion is that you create a three-tiered risk matrix consisting of (1) high-risk suppliers, (2) low-risk suppliers, and (3) minimal-risk suppliers. Below this final category is another category for providers of goods which are commonly available and pose almost no corruption risk.

You need to risk rank the third-parties which your supply chain might engage with for FCPA exposure. It should be based on your company’s experience and risk going forward. As with all other third-party risk management issues, you must “Document, Document, and Document”.

Three key takeaways:

  1. Risk rank your supply chain based on well-conceived strata.
  2. Consider not only the compliance risk but also your business risk.
  3. Only manage those suppliers which present a corruption risk.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 Freight forwarders The FCPA world is littered with cases involving freight forwarders, brokers and agents in the shipping and express delivery arena. Both the DOJ and SEC have aggressively pursued third-party business relationships where bribery and corruption have been found. This is particularly true where companies are required to deliver goods into a foreign country through the assistance of a freight forwarder or express delivery service. If you utilize the services of a third-party for as a freight forwarders, brokers and agents in the shipping and express delivery arena, that company’s actions will go a long way in determining your company’s FCPA liability. You must have a thoughtful process and document that process. Three key takeaways: Express delivery services and freight forwarders present unique compliance risks. There must be a business justification to bring on new express delivery services or freight forwarders in high risk jurisdictions. Consider constructing a risk matrix in this area. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 27 Jul 2020 17:00:00 -0000 Freight forwarders full Thomas Fox How can you construct a risk matrix for freight forwarders, brokers and agents in the shipping and express delivery arena. Find out today's episode of 31 Days to a More Effective Compliance Program. The FCPA world is littered with cases involving freight forwarders, brokers and agents in the shipping and express delivery arena. Both the DOJ and SEC have aggressively pursued third-party business relationships where bribery and corruption have been found. This is particularly true where companies are required to deliver goods into a foreign country through the assistance of a freight forwarder or express delivery service. If you utilize the services of a third-party for as a freight forwarders, brokers and agents in the shipping and express delivery arena, that company’s actions will go a long way in determining your company’s FCPA liability. You must have a thoughtful process and document that process. Three key takeaways: Express delivery services and freight forwarders present unique compliance risks. There must be a business justification to bring on new express delivery services or freight forwarders in high risk jurisdictions. Consider constructing a risk matrix in this area. Learn more about your ad choices. Visit megaphone.fm/adchoices The FCPA world is littered with cases involving freight forwarders, brokers and agents in the shipping and express delivery arena. Both the DOJ and SEC have aggressively pursued third-party business relationships where bribery and corruption have been found. This is particularly true where companies are required to deliver goods into a foreign country through the assistance of a freight forwarder or express delivery service.

If you utilize the services of a third-party for as a freight forwarders, brokers and agents in the shipping and express delivery arena, that company’s actions will go a long way in determining your company’s FCPA liability. You must have a thoughtful process and document that process.

Three key takeaways:

  1. Express delivery services and freight forwarders present unique compliance risks.
  2. There must be a business justification to bring on new express delivery services or freight forwarders in high risk jurisdictions.
  3. Consider constructing a risk matrix in this area.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no What is your distributor compensation protocol? One of the issues in any compliance program is the compensation paid to a third-party as FCPA exposure arises when companies pay money, either directly or indirectly, to fund bribe payments. Another area that leads to exposure from third-parties is with distributors. In a distributor relationship, the distributor purchases a product; taking risk of loss and title, at a discount from a manufacturer. The distributor resells at an uplift and that spread between purchase price and sales price is the distributor’s income. If a product is purchased at an inflated discounted rate and then sold, the difference between the purchase price and resale value could be used for corrupt purposes. Commission payments and excessive distributor discounts can be channeled to pay bribes. The FCPA Resource Guide, 2nd edition noted that common red flags associated with third-parties include “unreasonably large discounts to third-party distributors.” When companies grant distributors uncommonly steep discounts, bribes can result either: 1) because the distributor is instructed by the company to use the excess amounts to fund corrupt payments; or 2) because the distributor pays bribes on its own, without the express direction or implicit suggestion from the company, to gain some business advantage.  Three key takeaways: The creation of well-thought out process which operationalizes your compliance program around distributor compensation, in a manner which documents your decision-making calculus is key. Require multiple levels of approval for an out of range distributor discount. Tracking distributor discounts globally make your company more efficient. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 24 Jul 2020 17:00:00 -0000 What is your distributor compensation protocol? full Thomas Fox What is your distributor compensation protocol? Find out why you need one in 31 Days to a More Effective Compliance Program. One of the issues in any compliance program is the compensation paid to a third-party as FCPA exposure arises when companies pay money, either directly or indirectly, to fund bribe payments. Another area that leads to exposure from third-parties is with distributors. In a distributor relationship, the distributor purchases a product; taking risk of loss and title, at a discount from a manufacturer. The distributor resells at an uplift and that spread between purchase price and sales price is the distributor’s income. If a product is purchased at an inflated discounted rate and then sold, the difference between the purchase price and resale value could be used for corrupt purposes. Commission payments and excessive distributor discounts can be channeled to pay bribes. The FCPA Resource Guide, 2nd edition noted that common red flags associated with third-parties include “unreasonably large discounts to third-party distributors.” When companies grant distributors uncommonly steep discounts, bribes can result either: 1) because the distributor is instructed by the company to use the excess amounts to fund corrupt payments; or 2) because the distributor pays bribes on its own, without the express direction or implicit suggestion from the company, to gain some business advantage.  Three key takeaways: The creation of well-thought out process which operationalizes your compliance program around distributor compensation, in a manner which documents your decision-making calculus is key. Require multiple levels of approval for an out of range distributor discount. Tracking distributor discounts globally make your company more efficient. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the issues in any compliance program is the compensation paid to a third-party as FCPA exposure arises when companies pay money, either directly or indirectly, to fund bribe payments. Another area that leads to exposure from third-parties is with distributors. In a distributor relationship, the distributor purchases a product; taking risk of loss and title, at a discount from a manufacturer. The distributor resells at an uplift and that spread between purchase price and sales price is the distributor’s income. If a product is purchased at an inflated discounted rate and then sold, the difference between the purchase price and resale value could be used for corrupt purposes. Commission payments and excessive distributor discounts can be channeled to pay bribes.

The FCPA Resource Guide, 2nd edition noted that common red flags associated with third-parties include “unreasonably large discounts to third-party distributors.” When companies grant distributors uncommonly steep discounts, bribes can result either: 1) because the distributor is instructed by the company to use the excess amounts to fund corrupt payments; or 2) because the distributor pays bribes on its own, without the express direction or implicit suggestion from the company, to gain some business advantage. 

Three key takeaways:

  1. The creation of well-thought out process which operationalizes your compliance program around distributor compensation, in a manner which documents your decision-making calculus is key.
  2. Require multiple levels of approval for an out of range distributor discount.
  3. Tracking distributor discounts globally make your company more efficient.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no Terminating a third-party At some point, you will be required to terminate a third-party and there will be multiple legal, compliance and business issues to navigate through. If you are stuck doing it in the middle of a FCPA or U.K. Bribery Act investigation, there may well be some tension to do so and do so quickly. If you have not thought through this issue and created a process to follow before a crisis occurs, you may well be in for a very tough road. Yet the 2020 Update specifically asked that question in the section entitled Real Actions and Consequences, when it posed the query Has a similar third party been suspended, terminated, or audited as a result of compliance issues?  Although rarely considered, the termination of a third-party relationship can be as important a step as any other in the management of the third-party lifecycle. While having the contractual right to terminate is a good starting point, it is only the starting point. You not only need to have a compliance and legal plan in place but a business plan as well. If you do not, the cost in both monetary and potential business reputation can be quite high. Three key takeaways: Termination of third-parties is an oft-neglected part of the third-party risk management process. Make certain you have the contractual right to terminate third-parties written into your compliance terms and conditions. Have a strategy in place for termination before a crisis arises. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 23 Jul 2020 17:00:00 -0000 Terminating a third-party full Thomas Fox Although rarely considered, the termination of a third-party relationship can be as important a step as any other in the management of the third-party lifecycle. At some point, you will be required to terminate a third-party and there will be multiple legal, compliance and business issues to navigate through. If you are stuck doing it in the middle of a FCPA or U.K. Bribery Act investigation, there may well be some tension to do so and do so quickly. If you have not thought through this issue and created a process to follow before a crisis occurs, you may well be in for a very tough road. Yet the 2020 Update specifically asked that question in the section entitled Real Actions and Consequences, when it posed the query Has a similar third party been suspended, terminated, or audited as a result of compliance issues?  Although rarely considered, the termination of a third-party relationship can be as important a step as any other in the management of the third-party lifecycle. While having the contractual right to terminate is a good starting point, it is only the starting point. You not only need to have a compliance and legal plan in place but a business plan as well. If you do not, the cost in both monetary and potential business reputation can be quite high. Three key takeaways: Termination of third-parties is an oft-neglected part of the third-party risk management process. Make certain you have the contractual right to terminate third-parties written into your compliance terms and conditions. Have a strategy in place for termination before a crisis arises. Learn more about your ad choices. Visit megaphone.fm/adchoices At some point, you will be required to terminate a third-party and there will be multiple legal, compliance and business issues to navigate through. If you are stuck doing it in the middle of a FCPA or U.K. Bribery Act investigation, there may well be some tension to do so and do so quickly. If you have not thought through this issue and created a process to follow before a crisis occurs, you may well be in for a very tough road. Yet the 2020 Update specifically asked that question in the section entitled Real Actions and Consequences, when it posed the query Has a similar third party been suspended, terminated, or audited as a result of compliance issues?

 Although rarely considered, the termination of a third-party relationship can be as important a step as any other in the management of the third-party lifecycle. While having the contractual right to terminate is a good starting point, it is only the starting point. You not only need to have a compliance and legal plan in place but a business plan as well. If you do not, the cost in both monetary and potential business reputation can be quite high.

Three key takeaways:

  1. Termination of third-parties is an oft-neglected part of the third-party risk management process.
  2. Make certain you have the contractual right to terminate third-parties written into your compliance terms and conditions.
  3. Have a strategy in place for termination before a crisis arises.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no Third-Party Risk Expansion What is third-party risk expansion and why is it a risk in compliance? Historically, people talked about simply an entity outside of your organization as a third party. However, that definition is broadening, to mean really that entity with which your company works. Obviously, this can be a supplier or vendor, it can be a service provider, a customer, a joint-venture (JV) partner and/or an intercompany affiliate. A broader view could include intercompany affiliates as third parties, even though many people would see them as just being another entity inside of a business. As the definition of third parties expands, this only makes life more complicated for anyone trying to do third party risk assessments and then the tiering just creates an exponential change.  Previously, a tier one supplier was a direct counterparties to your organization, directly through the sales channel. Next a tier two was one that your company’s tier one counterparty is working through. This means for risk managers assessing the various risks now have to go deeper and deeper. One way to do so is through trying to understand the connection between tiers one, two, three, four and so on. The problem is there are many risks that companies do not manage this risk because they cannot identify which companies are taking risks, alleged on their behalf. One of the most difficult issues for compliance professionals and risk managers is trying to get their arms around how to handle this issue. You should begin with mapping out and understanding the third-parties whose exposure needs to be assessed by your organization. Obviously, this includes both direct and indirect third-parties but in terms of the tiering, the best way for anyone to understand the risk is to have really good communication with their tier one third-parties to be able to discuss the risks to both businesses. Three key takeaways: Has your third-party risk management program expanded with your third-parties? Why is transparency a key for third-party risk management? What is the financial health of your third-parties? Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 22 Jul 2020 17:00:00 -0000 Third-Party Risk Expansion full Thomas Fox What is third-party risk expansion and why is it a risk in compliance? Find out in today's edition of 31 Days to a More Effective Compliance Program. What is third-party risk expansion and why is it a risk in compliance? Historically, people talked about simply an entity outside of your organization as a third party. However, that definition is broadening, to mean really that entity with which your company works. Obviously, this can be a supplier or vendor, it can be a service provider, a customer, a joint-venture (JV) partner and/or an intercompany affiliate. A broader view could include intercompany affiliates as third parties, even though many people would see them as just being another entity inside of a business. As the definition of third parties expands, this only makes life more complicated for anyone trying to do third party risk assessments and then the tiering just creates an exponential change.  Previously, a tier one supplier was a direct counterparties to your organization, directly through the sales channel. Next a tier two was one that your company’s tier one counterparty is working through. This means for risk managers assessing the various risks now have to go deeper and deeper. One way to do so is through trying to understand the connection between tiers one, two, three, four and so on. The problem is there are many risks that companies do not manage this risk because they cannot identify which companies are taking risks, alleged on their behalf. One of the most difficult issues for compliance professionals and risk managers is trying to get their arms around how to handle this issue. You should begin with mapping out and understanding the third-parties whose exposure needs to be assessed by your organization. Obviously, this includes both direct and indirect third-parties but in terms of the tiering, the best way for anyone to understand the risk is to have really good communication with their tier one third-parties to be able to discuss the risks to both businesses. Three key takeaways: Has your third-party risk management program expanded with your third-parties? Why is transparency a key for third-party risk management? What is the financial health of your third-parties? Learn more about your ad choices. Visit megaphone.fm/adchoices What is third-party risk expansion and why is it a risk in compliance? Historically, people talked about simply an entity outside of your organization as a third party. However, that definition is broadening, to mean really that entity with which your company works. Obviously, this can be a supplier or vendor, it can be a service provider, a customer, a joint-venture (JV) partner and/or an intercompany affiliate. A broader view could include intercompany affiliates as third parties, even though many people would see them as just being another entity inside of a business. As the definition of third parties expands, this only makes life more complicated for anyone trying to do third party risk assessments and then the tiering just creates an exponential change. 

Previously, a tier one supplier was a direct counterparties to your organization, directly through the sales channel. Next a tier two was one that your company’s tier one counterparty is working through. This means for risk managers assessing the various risks now have to go deeper and deeper. One way to do so is through trying to understand the connection between tiers one, two, three, four and so on. The problem is there are many risks that companies do not manage this risk because they cannot identify which companies are taking risks, alleged on their behalf. One of the most difficult issues for compliance professionals and risk managers is trying to get their arms around how to handle this issue.

You should begin with mapping out and understanding the third-parties whose exposure needs to be assessed by your organization. Obviously, this includes both direct and indirect third-parties but in terms of the tiering, the best way for anyone to understand the risk is to have really good communication with their tier one third-parties to be able to discuss the risks to both businesses.

Three key takeaways:

  1. Has your third-party risk management program expanded with your third-parties?
  2. Why is transparency a key for third-party risk management?
  3. What is the financial health of your third-parties?


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no Third-parties as compliance innovation partners It is universally recognized that third-parties are your highest FCPA risk. What if you could turn your third-party from a liability under the FCPA to an innovation partner to your compliance program? This is an area that not many compliance professionals have mined but once again in compliance, you are only limited by your imagination. In a 2015 Supply Chain Management Review article by Jennifer Blackhurst, Pam Manhart and Emily Kohnke, entitled “The Five Key Components for Supply Chain Innovation”, the authors identified five components common to the most successful innovation partnerships. They are:  Don’t settle for the status quo. This means that you should not settle for simply the status quo in compliance. Hit the road in order to hit your metrics. To truly understand your compliance risk from third-parties, you must get out of the ivory tower and hit the road. Send prospectors, not auditors. While an audit clause is critical in any third-party contract, both from a commercial and FCPA compliance perspective; you can establish a “point of contact as an innovation manager for your third-parties.” Show and tell. As with all relationships, trust plays an important role in third-party compliance innovation, as “Firms in successful innovations discussed a willingness to share resources and rewards and to develop their partners’ capabilities.” Who’s running the show? This means “who is doing what, but also what each firm is bringing to the relationship in terms of resources and capabilities.” Three key takeaways: Use your third-parties as innovators to assist your compliance program. Change your thinking about third-parties and make them your partners. Do not settle for the status quo. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 21 Jul 2020 14:37:58 -0000 Third-parties as compliance innovation partners full Thomas Fox How can 3rd parties be innovation partners in your compliance program? Find out in today's episode of 31 Days to a More Effective Compliance Program. It is universally recognized that third-parties are your highest FCPA risk. What if you could turn your third-party from a liability under the FCPA to an innovation partner to your compliance program? This is an area that not many compliance professionals have mined but once again in compliance, you are only limited by your imagination. In a 2015 Supply Chain Management Review article by Jennifer Blackhurst, Pam Manhart and Emily Kohnke, entitled “The Five Key Components for Supply Chain Innovation”, the authors identified five components common to the most successful innovation partnerships. They are:  Don’t settle for the status quo. This means that you should not settle for simply the status quo in compliance. Hit the road in order to hit your metrics. To truly understand your compliance risk from third-parties, you must get out of the ivory tower and hit the road. Send prospectors, not auditors. While an audit clause is critical in any third-party contract, both from a commercial and FCPA compliance perspective; you can establish a “point of contact as an innovation manager for your third-parties.” Show and tell. As with all relationships, trust plays an important role in third-party compliance innovation, as “Firms in successful innovations discussed a willingness to share resources and rewards and to develop their partners’ capabilities.” Who’s running the show? This means “who is doing what, but also what each firm is bringing to the relationship in terms of resources and capabilities.” Three key takeaways: Use your third-parties as innovators to assist your compliance program. Change your thinking about third-parties and make them your partners. Do not settle for the status quo. Learn more about your ad choices. Visit megaphone.fm/adchoices It is universally recognized that third-parties are your highest FCPA risk. What if you could turn your third-party from a liability under the FCPA to an innovation partner to your compliance program? This is an area that not many compliance professionals have mined but once again in compliance, you are only limited by your imagination. In a 2015 Supply Chain Management Review article by Jennifer Blackhurst, Pam Manhart and Emily Kohnke, entitled “The Five Key Components for Supply Chain Innovation”, the authors identified five components common to the most successful innovation partnerships. They are: 

Don’t settle for the status quo. This means that you should not settle for simply the status quo in compliance.

Hit the road in order to hit your metrics. To truly understand your compliance risk from third-parties, you must get out of the ivory tower and hit the road.

Send prospectors, not auditors. While an audit clause is critical in any third-party contract, both from a commercial and FCPA compliance perspective; you can establish a “point of contact as an innovation manager for your third-parties.”

Show and tell. As with all relationships, trust plays an important role in third-party compliance innovation, as “Firms in successful innovations discussed a willingness to share resources and rewards and to develop their partners’ capabilities.”

Who’s running the show? This means “who is doing what, but also what each firm is bringing to the relationship in terms of resources and capabilities.”

Three key takeaways:

  1. Use your third-parties as innovators to assist your compliance program.
  2. Change your thinking about third-parties and make them your partners.
  3. Do not settle for the status quo.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 552 Third-party risk management ROI One area that has bedeviled CCOs and compliance practitioners is how to determine the ROI for your compliance program regarding third-parties. While it is still clear that third-parties are the greatest risk in FCPA enforcement actions, senior management often wants to know what is the monetary benefit to the company for this type of risk management.  When you couple the request for ROI with the 2020 Update, it may seem like a doubly daunting task. However, the requirement for operationalization of your compliance program actually lends itself to formulating ROI around the risk management of third-parties. This is because if you move third-party compliance into the organization as a business process, with a technological solution, the ROI becomes not only clearer but easier to calculate going forward. Three key takeaways: Why is it important to demonstrate ROI on your third-party risk management program? Determining ROI helps to demonstrate operationalizing your compliance program. Determining third-party management program ROI can help to tear down compliance siloes. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 20 Jul 2020 17:00:00 -0000 Third-party risk management ROI full Thomas Fox How can you consider the ROI of 3rd party risk management? Find out with special guest Linda Justice on this episode of 31 Days to a More Effective Compliance Program. One area that has bedeviled CCOs and compliance practitioners is how to determine the ROI for your compliance program regarding third-parties. While it is still clear that third-parties are the greatest risk in FCPA enforcement actions, senior management often wants to know what is the monetary benefit to the company for this type of risk management.  When you couple the request for ROI with the 2020 Update, it may seem like a doubly daunting task. However, the requirement for operationalization of your compliance program actually lends itself to formulating ROI around the risk management of third-parties. This is because if you move third-party compliance into the organization as a business process, with a technological solution, the ROI becomes not only clearer but easier to calculate going forward. Three key takeaways: Why is it important to demonstrate ROI on your third-party risk management program? Determining ROI helps to demonstrate operationalizing your compliance program. Determining third-party management program ROI can help to tear down compliance siloes. Learn more about your ad choices. Visit megaphone.fm/adchoices One area that has bedeviled CCOs and compliance practitioners is how to determine the ROI for your compliance program regarding third-parties. While it is still clear that third-parties are the greatest risk in FCPA enforcement actions, senior management often wants to know what is the monetary benefit to the company for this type of risk management.

 When you couple the request for ROI with the 2020 Update, it may seem like a doubly daunting task. However, the requirement for operationalization of your compliance program actually lends itself to formulating ROI around the risk management of third-parties. This is because if you move third-party compliance into the organization as a business process, with a technological solution, the ROI becomes not only clearer but easier to calculate going forward.

Three key takeaways:

  1. Why is it important to demonstrate ROI on your third-party risk management program?
  2. Determining ROI helps to demonstrate operationalizing your compliance program.
  3. Determining third-party management program ROI can help to tear down compliance siloes.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 668 no Ongoing monitoring of third-parties One of the key themes from the 2020 Update was the use of data and data analytics in a best practices compliance program. This has specific application to third-parties. In the section entitled, Risk-Tailored Resource Allocation, the following question was posed, Does the company devote a disproportionate amount of time to policing low-risk areas instead of high-risk areas, such as questionable payments to third-party consultants, suspicious trading activity, or excessive discounts to resellers and distributors? Under the section entitled, Control Testing, the following question was posed, Has the company reviewed and audited its compliance program in the area relating to the misconduct? More generally, what testing of controls, collection and analysis of compliance data, and interviews of employees and third parties does the company undertake? Finally, under the section entitled, Payment Systems was the following query, How was the misconduct in question funded (e.g., purchase orders, employee reimbursements, discounts, petty cash)? What processes could have prevented or detected improper access to these funds? Have those processes been improved?  All of these questions make clear that the DOJ expects data analytics to be used to help detect or prevent bribery and corruption where the primary sales force used by a company is third-parties. A clear majority of FCPA violations and related enforcement actions have come from the use of third-parties. While sham contracting (i.e., using a third-party to channel the payment of a bribe) has lessened in recent years, there are related data analysis that can be performed to ascertain whether a third-party is likely performing legitimate services for your company and is not a sham. There are several more complex analytics that can be run in combination to identify suspicious third-parties, and some of the simplest can be to look for duplicate or erroneous payments. This final concept of finding patterns that can be discerned through the aggregation of huge amounts of transactions, is the next step for compliance functions. Yet data analysis does far more than simply allowing you to follow the money. It can be a part of your third-party ongoing monitoring as well by allowing you to partner the information on third-parties who might come into your company where there was no proper compliance vetting. Such capabilities are clearly where you need to be heading.  Three key takeaways: Always remember to follow the money to see where a pot of money could be created to fund a bribe. Transaction monitoring techniques around fraud monitoring translate to data analysis for compliance. Do not forget to check names against known PEP and SDN lists. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 17 Jul 2020 17:00:00 -0000 Ongoing monitoring of third-parties full Thomas Fox Why is ongoing monitoring of 3rd parties so critical? Find out in today's episode of 31 Days to a More Effective Compliance Program. One of the key themes from the 2020 Update was the use of data and data analytics in a best practices compliance program. This has specific application to third-parties. In the section entitled, Risk-Tailored Resource Allocation, the following question was posed, Does the company devote a disproportionate amount of time to policing low-risk areas instead of high-risk areas, such as questionable payments to third-party consultants, suspicious trading activity, or excessive discounts to resellers and distributors? Under the section entitled, Control Testing, the following question was posed, Has the company reviewed and audited its compliance program in the area relating to the misconduct? More generally, what testing of controls, collection and analysis of compliance data, and interviews of employees and third parties does the company undertake? Finally, under the section entitled, Payment Systems was the following query, How was the misconduct in question funded (e.g., purchase orders, employee reimbursements, discounts, petty cash)? What processes could have prevented or detected improper access to these funds? Have those processes been improved?  All of these questions make clear that the DOJ expects data analytics to be used to help detect or prevent bribery and corruption where the primary sales force used by a company is third-parties. A clear majority of FCPA violations and related enforcement actions have come from the use of third-parties. While sham contracting (i.e., using a third-party to channel the payment of a bribe) has lessened in recent years, there are related data analysis that can be performed to ascertain whether a third-party is likely performing legitimate services for your company and is not a sham. There are several more complex analytics that can be run in combination to identify suspicious third-parties, and some of the simplest can be to look for duplicate or erroneous payments. This final concept of finding patterns that can be discerned through the aggregation of huge amounts of transactions, is the next step for compliance functions. Yet data analysis does far more than simply allowing you to follow the money. It can be a part of your third-party ongoing monitoring as well by allowing you to partner the information on third-parties who might come into your company where there was no proper compliance vetting. Such capabilities are clearly where you need to be heading.  Three key takeaways: Always remember to follow the money to see where a pot of money could be created to fund a bribe. Transaction monitoring techniques around fraud monitoring translate to data analysis for compliance. Do not forget to check names against known PEP and SDN lists. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the key themes from the 2020 Update was the use of data and data analytics in a best practices compliance program. This has specific application to third-parties. In the section entitled, Risk-Tailored Resource Allocation, the following question was posed, Does the company devote a disproportionate amount of time to policing low-risk areas instead of high-risk areas, such as questionable payments to third-party consultants, suspicious trading activity, or excessive discounts to resellers and distributors? Under the section entitled, Control Testing, the following question was posed, Has the company reviewed and audited its compliance program in the area relating to the misconduct? More generally, what testing of controls, collection and analysis of compliance data, and interviews of employees and third parties does the company undertake? Finally, under the section entitled, Payment Systems was the following query, How was the misconduct in question funded (e.g., purchase orders, employee reimbursements, discounts, petty cash)? What processes could have prevented or detected improper access to these funds? Have those processes been improved?

 All of these questions make clear that the DOJ expects data analytics to be used to help detect or prevent bribery and corruption where the primary sales force used by a company is third-parties. A clear majority of FCPA violations and related enforcement actions have come from the use of third-parties. While sham contracting (i.e., using a third-party to channel the payment of a bribe) has lessened in recent years, there are related data analysis that can be performed to ascertain whether a third-party is likely performing legitimate services for your company and is not a sham. There are several more complex analytics that can be run in combination to identify suspicious third-parties, and some of the simplest can be to look for duplicate or erroneous payments. This final concept of finding patterns that can be discerned through the aggregation of huge amounts of transactions, is the next step for compliance functions. Yet data analysis does far more than simply allowing you to follow the money. It can be a part of your third-party ongoing monitoring as well by allowing you to partner the information on third-parties who might come into your company where there was no proper compliance vetting. Such capabilities are clearly where you need to be heading. 

Three key takeaways:

  1. Always remember to follow the money to see where a pot of money could be created to fund a bribe.
  2. Transaction monitoring techniques around fraud monitoring translate to data analysis for compliance.
  3. Do not forget to check names against known PEP and SDN lists.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no Auditing of third-parties Auditing of third-parties is critical to any best practices compliance program and an important tool in operationalizing your compliance program. This is a key manner in which a company can manage the third-party relationship after the contract is signed and one which the government will expect you to engage in going forward. As stated in the 2020 Update, under the section entitled, Management of Relationships, is the following query, Does the company have audit rights to analyze the books and accounts of third parties, and has the company exercised those rights in the past? This means you must not only have audit rights but also exercise them.  You should plan out the audit four to six weeks in advance, you should perform the audit with your legal counsel’s lead to preserve privilege, work with the Relationship Manager to establish key business contacts, discuss audit rights and processes with the third-party, you should prepare initial document request lists for financial information queries, take the time to review findings from previous audits and resolutions and also review details of opened and closed internal investigations, if there are any Code of Conduct questionnaires available take care to review and, finally, be cognizant of any related DOJ and SEC enforcement actions. Three key takeaways: Be prepared. It is not an investigative interview but an audit interview. Listen, listen, and listen. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 16 Jul 2020 17:00:00 -0000 Auditing of third-parties full Thomas Fox Auditing of third-parties is critical in any best practices compliance program. Find out more in today's episode of 31 Days to a More Effective Compliance Program. Auditing of third-parties is critical to any best practices compliance program and an important tool in operationalizing your compliance program. This is a key manner in which a company can manage the third-party relationship after the contract is signed and one which the government will expect you to engage in going forward. As stated in the 2020 Update, under the section entitled, Management of Relationships, is the following query, Does the company have audit rights to analyze the books and accounts of third parties, and has the company exercised those rights in the past? This means you must not only have audit rights but also exercise them.  You should plan out the audit four to six weeks in advance, you should perform the audit with your legal counsel’s lead to preserve privilege, work with the Relationship Manager to establish key business contacts, discuss audit rights and processes with the third-party, you should prepare initial document request lists for financial information queries, take the time to review findings from previous audits and resolutions and also review details of opened and closed internal investigations, if there are any Code of Conduct questionnaires available take care to review and, finally, be cognizant of any related DOJ and SEC enforcement actions. Three key takeaways: Be prepared. It is not an investigative interview but an audit interview. Listen, listen, and listen. Learn more about your ad choices. Visit megaphone.fm/adchoices Auditing of third-parties is critical to any best practices compliance program and an important tool in operationalizing your compliance program. This is a key manner in which a company can manage the third-party relationship after the contract is signed and one which the government will expect you to engage in going forward. As stated in the 2020 Update, under the section entitled, Management of Relationships, is the following query, Does the company have audit rights to analyze the books and accounts of third parties, and has the company exercised those rights in the past? This means you must not only have audit rights but also exercise them.

 You should plan out the audit four to six weeks in advance, you should perform the audit with your legal counsel’s lead to preserve privilege, work with the Relationship Manager to establish key business contacts, discuss audit rights and processes with the third-party, you should prepare initial document request lists for financial information queries, take the time to review findings from previous audits and resolutions and also review details of opened and closed internal investigations, if there are any Code of Conduct questionnaires available take care to review and, finally, be cognizant of any related DOJ and SEC enforcement actions.

Three key takeaways:

  1. Be prepared.
  2. It is not an investigative interview but an audit interview.
  3. Listen, listen, and listen.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no Managing third-parties The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the lifecycle management of third-parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation and compliance terms and conditions in contracts. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also the one where the rubber meets the road of operationalizing compliance. The key is to have a strategic approach to how you structure and manage your third-party relationships during the full lifecycle of the contract. This may mean more closely partnering with your third-parties to help manage the anti-corruption compliance risk. It would certainly lead towards enabling your company to manage the bribery and corruption risk while optimizing the performance of your third-parties.  Three key takeaways: Have a strategic approach to third-party risk management. Keep track of the financial stability of your third-parties. Rank third-parties based upon a variety of factors including compliance and business performance, length of relationship, benchmarking metrics and KPIs. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 15 Jul 2020 17:00:00 -0000 Managing third-parties full Thomas Fox What are the key steps in managing a third party after the contract is signed? Find out in today's episode of 31 Days to a More Effective Compliance Program. The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the lifecycle management of third-parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation and compliance terms and conditions in contracts. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also the one where the rubber meets the road of operationalizing compliance. The key is to have a strategic approach to how you structure and manage your third-party relationships during the full lifecycle of the contract. This may mean more closely partnering with your third-parties to help manage the anti-corruption compliance risk. It would certainly lead towards enabling your company to manage the bribery and corruption risk while optimizing the performance of your third-parties.  Three key takeaways: Have a strategic approach to third-party risk management. Keep track of the financial stability of your third-parties. Rank third-parties based upon a variety of factors including compliance and business performance, length of relationship, benchmarking metrics and KPIs. Learn more about your ad choices. Visit megaphone.fm/adchoices The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the lifecycle management of third-parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation and compliance terms and conditions in contracts. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also the one where the rubber meets the road of operationalizing compliance.

The key is to have a strategic approach to how you structure and manage your third-party relationships during the full lifecycle of the contract. This may mean more closely partnering with your third-parties to help manage the anti-corruption compliance risk. It would certainly lead towards enabling your company to manage the bribery and corruption risk while optimizing the performance of your third-parties. 

Three key takeaways:

  1. Have a strategic approach to third-party risk management.
  2. Keep track of the financial stability of your third-parties.
  3. Rank third-parties based upon a variety of factors including compliance and business performance, length of relationship, benchmarking metrics and KPIs.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no Metrics on third-party management In a 2015 speech before the SIFMA Compliance and Legal Society New York Regional Seminar, former Assistant Attorney General Leslie Caldwell for the first time, laid out metrics the DOJ would consider in evaluating a corporate compliance program around third-parties. Caldwell began with the following question, “Does the institution sensitize third-parties like vendors, agents or consultants to the company’s expectation that its partners are also serious about compliance?” This inquiry was brought forward into the DOJ’s 2017 Evaluation and all subsequent updates. In addition to monitoring and oversight of your third-parties, you should periodically review the health of your third-party management program. The robustness of your program will go a long way towards preventing, detecting and remediating any compliance issue before it becomes a full-blown FCPA violation. As with all the steps laid out herein, you need to fully document the steps you have taken so that any regulator can test your metrics. Caldwell’s remarks around compliance metrics portended the Evaluation and what the DOJ will be reviewing and evaluating going forward, so it is clear what will be expected from your company’s compliance program. You should also use these metrics to conduct a self-assessment on the state of your compliance program.  Three key takeaways: It all starts with a Relationship Manager. Have company oversight of all third-parties. Audit, monitor, and remediate on an ongoing basis. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 14 Jul 2020 17:00:00 -0000 Metrics on third-party management full Thomas Fox What are some of the key metrics on managing a 3rd party relationship? Find out in today's episode of 31 Days to a More Effective Compliance Program. In a 2015 speech before the SIFMA Compliance and Legal Society New York Regional Seminar, former Assistant Attorney General Leslie Caldwell for the first time, laid out metrics the DOJ would consider in evaluating a corporate compliance program around third-parties. Caldwell began with the following question, “Does the institution sensitize third-parties like vendors, agents or consultants to the company’s expectation that its partners are also serious about compliance?” This inquiry was brought forward into the DOJ’s 2017 Evaluation and all subsequent updates. In addition to monitoring and oversight of your third-parties, you should periodically review the health of your third-party management program. The robustness of your program will go a long way towards preventing, detecting and remediating any compliance issue before it becomes a full-blown FCPA violation. As with all the steps laid out herein, you need to fully document the steps you have taken so that any regulator can test your metrics. Caldwell’s remarks around compliance metrics portended the Evaluation and what the DOJ will be reviewing and evaluating going forward, so it is clear what will be expected from your company’s compliance program. You should also use these metrics to conduct a self-assessment on the state of your compliance program.  Three key takeaways: It all starts with a Relationship Manager. Have company oversight of all third-parties. Audit, monitor, and remediate on an ongoing basis. Learn more about your ad choices. Visit megaphone.fm/adchoices In a 2015 speech before the SIFMA Compliance and Legal Society New York Regional Seminar, former Assistant Attorney General Leslie Caldwell for the first time, laid out metrics the DOJ would consider in evaluating a corporate compliance program around third-parties. Caldwell began with the following question, “Does the institution sensitize third-parties like vendors, agents or consultants to the company’s expectation that its partners are also serious about compliance?” This inquiry was brought forward into the DOJ’s 2017 Evaluation and all subsequent updates.

In addition to monitoring and oversight of your third-parties, you should periodically review the health of your third-party management program. The robustness of your program will go a long way towards preventing, detecting and remediating any compliance issue before it becomes a full-blown FCPA violation. As with all the steps laid out herein, you need to fully document the steps you have taken so that any regulator can test your metrics. Caldwell’s remarks around compliance metrics portended the Evaluation and what the DOJ will be reviewing and evaluating going forward, so it is clear what will be expected from your company’s compliance program. You should also use these metrics to conduct a self-assessment on the state of your compliance program.

 Three key takeaways:

  1. It all starts with a Relationship Manager.
  2. Have company oversight of all third-parties.
  3. Audit, monitor, and remediate on an ongoing basis.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no The “how” question in due diligence What is satisfactory due diligence under the FCPA? That question seems to be more important after the story on Unaoil S.A.M. and the subsequent release of the Panama and Paradise Papers. However, both events largely focused on the “who” part of due diligence and the need to know with whom you are doing business with going forward. However, there is another important question which does not come up as often in due diligence, which is how? How does a third-party perform its services with or for your company? If it is on the sales side of things, howcan a third-party help you make sales? If a third-party comes through the supply chain, how do their products or services meet the needs of your company? If the third-party has a closer business relationship, such as a JV, teaming agreement or other similar arrangement, you may well need a much deeper understand of how this third-party does business because the relationship may well become so close you will be intertwined with the party. It may mean more than simply how does their product work but how does this third-party conduct themselves and their business? Under the FCPA, most companies understand the need to know with whom they contract for sales or vendor services. They also understand the need to know why they should do business with a proposed third-party (i.e., a business justification). However, the need to perform an investigation into how the third-party can actually deliver the contracted services is equally important. Three key takeaways: The how question can be as critical as the who question. The more integrated a third-party is into your operations the more important this question becomes. Incorporate a how question into not only your due diligence but also your ongoing monitoring and auditing, after the contract is signed. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 13 Jul 2020 17:00:00 -0000 The “how” question in due diligence full Thomas Fox The how question is as important as the who or where question in due diligence. What is satisfactory due diligence under the FCPA? That question seems to be more important after the story on Unaoil S.A.M. and the subsequent release of the Panama and Paradise Papers. However, both events largely focused on the “who” part of due diligence and the need to know with whom you are doing business with going forward. However, there is another important question which does not come up as often in due diligence, which is how? How does a third-party perform its services with or for your company? If it is on the sales side of things, howcan a third-party help you make sales? If a third-party comes through the supply chain, how do their products or services meet the needs of your company? If the third-party has a closer business relationship, such as a JV, teaming agreement or other similar arrangement, you may well need a much deeper understand of how this third-party does business because the relationship may well become so close you will be intertwined with the party. It may mean more than simply how does their product work but how does this third-party conduct themselves and their business? Under the FCPA, most companies understand the need to know with whom they contract for sales or vendor services. They also understand the need to know why they should do business with a proposed third-party (i.e., a business justification). However, the need to perform an investigation into how the third-party can actually deliver the contracted services is equally important. Three key takeaways: The how question can be as critical as the who question. The more integrated a third-party is into your operations the more important this question becomes. Incorporate a how question into not only your due diligence but also your ongoing monitoring and auditing, after the contract is signed. Learn more about your ad choices. Visit megaphone.fm/adchoices What is satisfactory due diligence under the FCPA? That question seems to be more important after the story on Unaoil S.A.M. and the subsequent release of the Panama and Paradise Papers. However, both events largely focused on the “who” part of due diligence and the need to know with whom you are doing business with going forward. However, there is another important question which does not come up as often in due diligence, which is how?

How does a third-party perform its services with or for your company? If it is on the sales side of things, howcan a third-party help you make sales? If a third-party comes through the supply chain, how do their products or services meet the needs of your company? If the third-party has a closer business relationship, such as a JV, teaming agreement or other similar arrangement, you may well need a much deeper understand of how this third-party does business because the relationship may well become so close you will be intertwined with the party. It may mean more than simply how does their product work but how does this third-party conduct themselves and their business?

Under the FCPA, most companies understand the need to know with whom they contract for sales or vendor services. They also understand the need to know why they should do business with a proposed third-party (i.e., a business justification). However, the need to perform an investigation into how the third-party can actually deliver the contracted services is equally important.

Three key takeaways:

  1. The how question can be as critical as the who question.
  2. The more integrated a third-party is into your operations the more important this question becomes.
  3. Incorporate a how question into not only your due diligence but also your ongoing monitoring and auditing, after the contract is signed.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no Compliance Terms and Conditions The 2020 Resource Guide stated, “In addition to considering a company’s due diligence on third parties, DOJ and SEC also assess whether the company has informed third parties of the company’s compliance program and commitment to ethical and lawful business practices and, where appropriate, whether it has sought assurances from third parties, through certifications and otherwise, of reciprocal commitments. These can be meaningful ways to mitigate third-party risk.”  You should incorporate appropriate compliance terms and conditions into in every contract with third-parties. I would suggest that you prepare a template, which can be used as a starting point for your negotiations. The advantages of such a template are several and they include: (1) the contract language is tested against real events; (2) the contract language assists the company in managing its compliance risks; (3) the contract language fits into a series of related contracts; (4) the contract language is straight-forward to administer; and (5) the contract language helps to manage the expectations of both contracting parties regarding anti-bribery and anti-corruption. Many do not believe that they will be able to get the third-party to agree to such compliance terms and conditions. I have found that while it may not be easy, it is relatively simple to get a third-party to agree to these or similar terms and conditions. One approach to take is that they are not negotiable. When faced with such a position on non-commercial terms many third-parties will not fight such a position. There is some flexibility, but the DOJ will require the minimum compliance terms and conditions. But the best position I have found is that if a third-party agrees with these terms and conditions, they can then use that as a market differentiator. Three key takeaways: Compliance terms and conditions are mandatory for any best practices compliance program. A key clause is the right to audit clause. Third-parties can favor robust compliance terms and conditions as a market differentiator. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 10 Jul 2020 17:00:00 -0000 Compliance Terms and Conditions full Thomas Fox You should incorporate appropriate compliance terms and conditions into in every contract with third-parties. The 2020 Resource Guide stated, “In addition to considering a company’s due diligence on third parties, DOJ and SEC also assess whether the company has informed third parties of the company’s compliance program and commitment to ethical and lawful business practices and, where appropriate, whether it has sought assurances from third parties, through certifications and otherwise, of reciprocal commitments. These can be meaningful ways to mitigate third-party risk.”  You should incorporate appropriate compliance terms and conditions into in every contract with third-parties. I would suggest that you prepare a template, which can be used as a starting point for your negotiations. The advantages of such a template are several and they include: (1) the contract language is tested against real events; (2) the contract language assists the company in managing its compliance risks; (3) the contract language fits into a series of related contracts; (4) the contract language is straight-forward to administer; and (5) the contract language helps to manage the expectations of both contracting parties regarding anti-bribery and anti-corruption. Many do not believe that they will be able to get the third-party to agree to such compliance terms and conditions. I have found that while it may not be easy, it is relatively simple to get a third-party to agree to these or similar terms and conditions. One approach to take is that they are not negotiable. When faced with such a position on non-commercial terms many third-parties will not fight such a position. There is some flexibility, but the DOJ will require the minimum compliance terms and conditions. But the best position I have found is that if a third-party agrees with these terms and conditions, they can then use that as a market differentiator. Three key takeaways: Compliance terms and conditions are mandatory for any best practices compliance program. A key clause is the right to audit clause. Third-parties can favor robust compliance terms and conditions as a market differentiator. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2020 Resource Guide stated, “In addition to considering a company’s due diligence on third parties, DOJ and SEC also assess whether the company has informed third parties of the company’s compliance program and commitment to ethical and lawful business practices and, where appropriate, whether it has sought assurances from third parties, through certifications and otherwise, of reciprocal commitments. These can be meaningful ways to mitigate third-party risk.”

 You should incorporate appropriate compliance terms and conditions into in every contract with third-parties. I would suggest that you prepare a template, which can be used as a starting point for your negotiations. The advantages of such a template are several and they include: (1) the contract language is tested against real events; (2) the contract language assists the company in managing its compliance risks; (3) the contract language fits into a series of related contracts; (4) the contract language is straight-forward to administer; and (5) the contract language helps to manage the expectations of both contracting parties regarding anti-bribery and anti-corruption.

Many do not believe that they will be able to get the third-party to agree to such compliance terms and conditions. I have found that while it may not be easy, it is relatively simple to get a third-party to agree to these or similar terms and conditions. One approach to take is that they are not negotiable. When faced with such a position on non-commercial terms many third-parties will not fight such a position. There is some flexibility, but the DOJ will require the minimum compliance terms and conditions. But the best position I have found is that if a third-party agrees with these terms and conditions, they can then use that as a market differentiator.

Three key takeaways:

  1. Compliance terms and conditions are mandatory for any best practices compliance program.
  2. A key clause is the right to audit clause.
  3. Third-parties can favor robust compliance terms and conditions as a market differentiator.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Evaluation of due diligence and clearing red flags An important part of the job duties of any compliance practitioner is clearing red flags which might appear for a proposed third-party relationship during the due diligence process. It is mandatory that not only must all red flags be cleared but there also be evidence of the decision-making process to show to a regulator if one comes knocking. Around third-parties, consider what risks you face in both your sales and supply chain. If there is a key player several tiers down the line who creates or builds a key component or delivers a critical service, you may want to put more management around that relationship from the compliance perspective. For anything below a tier 2; you may be able to manage your risks through having your direct tier one counter-party take the lead in managing such compliance risks. But make sure that the expectation is communicated to your direct counter-party so that if the government comes knocking you can show that not only did you contractually obligate your direct counter-party to do so but that you provided them the tools and training to do so. Finally, you will need to be able to show that your direct counter-party did so. Three key takeaways: There is no set formula for clearing of red flags or the evaluation of due diligence. Know when to say enough has been done. You must “Document, Document, and Document” your evaluation of any red flags. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 09 Jul 2020 17:00:00 -0000 Evaluation of due diligence and clearing red flags full Thomas Fox How do you evaluation due diligence and clear red flags? Find out in this edition of 31 Days to a More Effective Compliance Program. An important part of the job duties of any compliance practitioner is clearing red flags which might appear for a proposed third-party relationship during the due diligence process. It is mandatory that not only must all red flags be cleared but there also be evidence of the decision-making process to show to a regulator if one comes knocking. Around third-parties, consider what risks you face in both your sales and supply chain. If there is a key player several tiers down the line who creates or builds a key component or delivers a critical service, you may want to put more management around that relationship from the compliance perspective. For anything below a tier 2; you may be able to manage your risks through having your direct tier one counter-party take the lead in managing such compliance risks. But make sure that the expectation is communicated to your direct counter-party so that if the government comes knocking you can show that not only did you contractually obligate your direct counter-party to do so but that you provided them the tools and training to do so. Finally, you will need to be able to show that your direct counter-party did so. Three key takeaways: There is no set formula for clearing of red flags or the evaluation of due diligence. Know when to say enough has been done. You must “Document, Document, and Document” your evaluation of any red flags. Learn more about your ad choices. Visit megaphone.fm/adchoices An important part of the job duties of any compliance practitioner is clearing red flags which might appear for a proposed third-party relationship during the due diligence process. It is mandatory that not only must all red flags be cleared but there also be evidence of the decision-making process to show to a regulator if one comes knocking.

Around third-parties, consider what risks you face in both your sales and supply chain. If there is a key player several tiers down the line who creates or builds a key component or delivers a critical service, you may want to put more management around that relationship from the compliance perspective. For anything below a tier 2; you may be able to manage your risks through having your direct tier one counter-party take the lead in managing such compliance risks. But make sure that the expectation is communicated to your direct counter-party so that if the government comes knocking you can show that not only did you contractually obligate your direct counter-party to do so but that you provided them the tools and training to do so. Finally, you will need to be able to show that your direct counter-party did so.

Three key takeaways:

  1. There is no set formula for clearing of red flags or the evaluation of due diligence.
  2. Know when to say enough has been done.
  3. You must “Document, Document, and Document” your evaluation of any red flags.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Levels of due diligence Due diligence is generally recognized in three levels, each of which is appropriate for a different level of corruption risk. The key is for you to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward.  There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions into your program. The Level I, II and III trichotomy appears to have the greatest favor and one that you should be able to implement in a straightforward manner. But the key is that you must assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence.  Three key takeaways: A Level I due diligence should only be used where there is a low risk of corruption. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to clear. Level III due diligence is deep dive, boots on the ground investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 08 Jul 2020 17:00:00 -0000 Levels of due diligence full Thomas Fox What are the levels of due diligence and how should you navigate them? Find out in this episode of 31 Days to a More Effective Compliance Program. Due diligence is generally recognized in three levels, each of which is appropriate for a different level of corruption risk. The key is for you to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward.  There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions into your program. The Level I, II and III trichotomy appears to have the greatest favor and one that you should be able to implement in a straightforward manner. But the key is that you must assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence.  Three key takeaways: A Level I due diligence should only be used where there is a low risk of corruption. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to clear. Level III due diligence is deep dive, boots on the ground investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Due diligence is generally recognized in three levels, each of which is appropriate for a different level of corruption risk. The key is for you to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward.

 There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions into your program. The Level I, II and III trichotomy appears to have the greatest favor and one that you should be able to implement in a straightforward manner. But the key is that you must assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence. 

Three key takeaways:

  1. A Level I due diligence should only be used where there is a low risk of corruption.
  2. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to clear.
  3. Level III due diligence is deep dive, boots on the ground investigation.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Due diligence Most companies fully understand the need to comply with the requirements around third-parties as they represent the greatest risks for bribery and corruption. However, most companies are not created out of new cloth but are ongoing enterprises with a fully up and running business in place. This means they may need to bring resources to bear to do so while continuing operating an ongoing business. This can be particularly true in the area of performing due diligence on third-parties. Many companies understand the need for a robust due diligence program to investigate third-parties but have struggled with how to create an inventory to define the basis of third-party risk and, thereby, perform the requisite due diligence required.  Getting your arms around due diligence can sometimes seem bewildering for the compliance practitioner. The information that you gathered in Steps 1-Business Justification and 2-Questionnaire of the third-party management process should provide you with the initial information to consider the level of due diligence needed. This leads to Step 3 of the third-party management process: due diligence. The 2020 Resource Guide stated, “as part of risk-based due diligence, companies should understand the qualifications and associations of its third-party partners, including its business reputation, and relationship, if any, with foreign officials. The degree of scrutiny should increase as red flags surface.” Three key takeaways: Risk rank your third-parties and use this as a basis to begin with an adequate level of due diligence.  Any red flags which appear must be cleared and there must be documented evidence of such clearance. There must be documented evidence of review of the due diligence. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 07 Jul 2020 17:00:00 -0000 Due diligence full Thomas Fox Getting your arms around due diligence can sometimes seem bewildering for the compliance practitioner. Find out more on this episode of 31 Days to a More Effective Compliance Program. Most companies fully understand the need to comply with the requirements around third-parties as they represent the greatest risks for bribery and corruption. However, most companies are not created out of new cloth but are ongoing enterprises with a fully up and running business in place. This means they may need to bring resources to bear to do so while continuing operating an ongoing business. This can be particularly true in the area of performing due diligence on third-parties. Many companies understand the need for a robust due diligence program to investigate third-parties but have struggled with how to create an inventory to define the basis of third-party risk and, thereby, perform the requisite due diligence required.  Getting your arms around due diligence can sometimes seem bewildering for the compliance practitioner. The information that you gathered in Steps 1-Business Justification and 2-Questionnaire of the third-party management process should provide you with the initial information to consider the level of due diligence needed. This leads to Step 3 of the third-party management process: due diligence. The 2020 Resource Guide stated, “as part of risk-based due diligence, companies should understand the qualifications and associations of its third-party partners, including its business reputation, and relationship, if any, with foreign officials. The degree of scrutiny should increase as red flags surface.” Three key takeaways: Risk rank your third-parties and use this as a basis to begin with an adequate level of due diligence.  Any red flags which appear must be cleared and there must be documented evidence of such clearance. There must be documented evidence of review of the due diligence. Learn more about your ad choices. Visit megaphone.fm/adchoices Most companies fully understand the need to comply with the requirements around third-parties as they represent the greatest risks for bribery and corruption. However, most companies are not created out of new cloth but are ongoing enterprises with a fully up and running business in place. This means they may need to bring resources to bear to do so while continuing operating an ongoing business. This can be particularly true in the area of performing due diligence on third-parties. Many companies understand the need for a robust due diligence program to investigate third-parties but have struggled with how to create an inventory to define the basis of third-party risk and, thereby, perform the requisite due diligence required. 

Getting your arms around due diligence can sometimes seem bewildering for the compliance practitioner. The information that you gathered in Steps 1-Business Justification and 2-Questionnaire of the third-party management process should provide you with the initial information to consider the level of due diligence needed. This leads to Step 3 of the third-party management process: due diligence. The 2020 Resource Guide stated, “as part of risk-based due diligence, companies should understand the qualifications and associations of its third-party partners, including its business reputation, and relationship, if any, with foreign officials. The degree of scrutiny should increase as red flags surface.”

Three key takeaways:

  1. Risk rank your third-parties and use this as a basis to begin with an adequate level of due diligence. 
  2. Any red flags which appear must be cleared and there must be documented evidence of such clearance.
  3. There must be documented evidence of review of the due diligence.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 Questionnaire The next step in the five-step process is the questionnaire. The term ‘questionnaire’ is mentioned several times in the 2020 FCPA Resource Guide. It is generally recognized as one of the tools that a company should complete in its investigation to better understand with whom it is doing business. The questionnaire should be mandatory step for any third-party that desires to work with your company as it mandates the proposed business partner, commit to certain required information in writing prior to beginning the due diligence process. Remember if a third-party does not want to fill out the questionnaire or will not fill it out completely you should not walk but run away from doing business with such a party. One of the key requirements of any successful compliance program is that a company must make an initial assessment of a proposed third-party. The size of a company does not matter as small businesses can face quite significant risks and will need more extensive procedures than other businesses facing limited risks. The level of risk that companies face will also vary with the type and nature of the third-parties with which it may have business relationships. For example, a company that properly assesses that there is no risk of bribery on the part of one group of its third-parties will require nothing in the way of procedures to prevent bribery in the context of those relationships. By the same token the bribery risks associated with reliance on a third-party agent representing a company in negotiations with foreign government officials may be assessed as significant and, accordingly, requires much more in the way of procedures to mitigate those risks. The questionnaire fills several key roles in your overall management of third-parties. Obviously, it provides key information that you need to know about who you are doing business with and whether they have the capabilities to fulfill your commercial needs. Just as important is what is said if the questionnaire is not completed or is only partially completed, such as the lack of awareness of the FCPA, U.K. Bribery Act or anti-corruption/anti-bribery programs generally. Lastly, the information provided (or not provided) in the questionnaire will assist you in determining what level of due diligence to perform. Three key takeaways: You must have enough information to fully identify the owners, UBOs and related parties to determine if there is foreign official involvement. All commentary on best practices compliance programs requires questionnaires. If a third-party refuses to fully respond to your questionnaire, run, don’t walk away from the proposed relationship. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 06 Jul 2020 14:56:46 -0000 Questionnaire full Thomas Fox Remember if a third-party does not want to fill out the questionnaire or will not fill it out completely you should not walk but run away from doing business with such a party. The next step in the five-step process is the questionnaire. The term ‘questionnaire’ is mentioned several times in the 2020 FCPA Resource Guide. It is generally recognized as one of the tools that a company should complete in its investigation to better understand with whom it is doing business. The questionnaire should be mandatory step for any third-party that desires to work with your company as it mandates the proposed business partner, commit to certain required information in writing prior to beginning the due diligence process. Remember if a third-party does not want to fill out the questionnaire or will not fill it out completely you should not walk but run away from doing business with such a party. One of the key requirements of any successful compliance program is that a company must make an initial assessment of a proposed third-party. The size of a company does not matter as small businesses can face quite significant risks and will need more extensive procedures than other businesses facing limited risks. The level of risk that companies face will also vary with the type and nature of the third-parties with which it may have business relationships. For example, a company that properly assesses that there is no risk of bribery on the part of one group of its third-parties will require nothing in the way of procedures to prevent bribery in the context of those relationships. By the same token the bribery risks associated with reliance on a third-party agent representing a company in negotiations with foreign government officials may be assessed as significant and, accordingly, requires much more in the way of procedures to mitigate those risks. The questionnaire fills several key roles in your overall management of third-parties. Obviously, it provides key information that you need to know about who you are doing business with and whether they have the capabilities to fulfill your commercial needs. Just as important is what is said if the questionnaire is not completed or is only partially completed, such as the lack of awareness of the FCPA, U.K. Bribery Act or anti-corruption/anti-bribery programs generally. Lastly, the information provided (or not provided) in the questionnaire will assist you in determining what level of due diligence to perform. Three key takeaways: You must have enough information to fully identify the owners, UBOs and related parties to determine if there is foreign official involvement. All commentary on best practices compliance programs requires questionnaires. If a third-party refuses to fully respond to your questionnaire, run, don’t walk away from the proposed relationship. Learn more about your ad choices. Visit megaphone.fm/adchoices The next step in the five-step process is the questionnaire. The term ‘questionnaire’ is mentioned several times in the 2020 FCPA Resource Guide. It is generally recognized as one of the tools that a company should complete in its investigation to better understand with whom it is doing business. The questionnaire should be mandatory step for any third-party that desires to work with your company as it mandates the proposed business partner, commit to certain required information in writing prior to beginning the due diligence process. Remember if a third-party does not want to fill out the questionnaire or will not fill it out completely you should not walk but run away from doing business with such a party.

One of the key requirements of any successful compliance program is that a company must make an initial assessment of a proposed third-party. The size of a company does not matter as small businesses can face quite significant risks and will need more extensive procedures than other businesses facing limited risks. The level of risk that companies face will also vary with the type and nature of the third-parties with which it may have business relationships. For example, a company that properly assesses that there is no risk of bribery on the part of one group of its third-parties will require nothing in the way of procedures to prevent bribery in the context of those relationships. By the same token the bribery risks associated with reliance on a third-party agent representing a company in negotiations with foreign government officials may be assessed as significant and, accordingly, requires much more in the way of procedures to mitigate those risks.

The questionnaire fills several key roles in your overall management of third-parties. Obviously, it provides key information that you need to know about who you are doing business with and whether they have the capabilities to fulfill your commercial needs. Just as important is what is said if the questionnaire is not completed or is only partially completed, such as the lack of awareness of the FCPA, U.K. Bribery Act or anti-corruption/anti-bribery programs generally. Lastly, the information provided (or not provided) in the questionnaire will assist you in determining what level of due diligence to perform.

Three key takeaways:

  1. You must have enough information to fully identify the owners, UBOs and related parties to determine if there is foreign official involvement.
  2. All commentary on best practices compliance programs requires questionnaires.
  3. If a third-party refuses to fully respond to your questionnaire, run, don’t walk away from the proposed relationship.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no The business rationale The 2020 Update stated, “Prosecutors should also assess whether the company knows the business rationale for needing the third party in the transaction, and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials.” This standard articulates one of the most basic tools to operationalize your compliance program and should form the basis of your third-party risk management process. Indeed this is viewed as an internal control with the 2020 Update going on to pose the following question, “How does the company ensure there is an appropriate business rationale for the use of third parties?” Another way to think about this issue is by considering the competence of a foreign business partner to provide services to your organization. Such considerations include a review of the qualifications of the third-party candidate for SME, the resources to perform the services for which they are being considered and the third-party’s expected activities for your company. More detailed inquiries include requiring the relevant business unit which desires to obtain the services of any third-party to provide you with a business rationale including current opportunities in territory, how the candidate was identified and why no currently existing third-party relationships can provide the requested services. Your next inquiry should focus on the terms of the engagement, including the commission rate, the term of the agreement, what territory may be covered by the agreement and if such relationship will be exclusive. Remember, the purpose of the business rationale is to document the satisfactoriness of the business case to retain a third-party. The business rationale should be included in the compliance review file assembled on every third-party at the time of initial certification and again if the third-party relationship is renewed. This means “Document, Document, and Document”. Three key takeaways: You should always have a business reason for using a third-party which is articulated by the business folks, not compliance. A Relationship Manager is the key going forward in operationalizing your compliance program through the life of the third-party relationship with your company. Always remember to “Document, Document, and Document”. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 02 Jul 2020 17:00:00 -0000 The business rationale full Thomas Fox Why is the business rationale critical in the management of third-party risk? Find out in today's episode of 31 Days to More Effective Compliance Program. The 2020 Update stated, “Prosecutors should also assess whether the company knows the business rationale for needing the third party in the transaction, and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials.” This standard articulates one of the most basic tools to operationalize your compliance program and should form the basis of your third-party risk management process. Indeed this is viewed as an internal control with the 2020 Update going on to pose the following question, “How does the company ensure there is an appropriate business rationale for the use of third parties?” Another way to think about this issue is by considering the competence of a foreign business partner to provide services to your organization. Such considerations include a review of the qualifications of the third-party candidate for SME, the resources to perform the services for which they are being considered and the third-party’s expected activities for your company. More detailed inquiries include requiring the relevant business unit which desires to obtain the services of any third-party to provide you with a business rationale including current opportunities in territory, how the candidate was identified and why no currently existing third-party relationships can provide the requested services. Your next inquiry should focus on the terms of the engagement, including the commission rate, the term of the agreement, what territory may be covered by the agreement and if such relationship will be exclusive. Remember, the purpose of the business rationale is to document the satisfactoriness of the business case to retain a third-party. The business rationale should be included in the compliance review file assembled on every third-party at the time of initial certification and again if the third-party relationship is renewed. This means “Document, Document, and Document”. Three key takeaways: You should always have a business reason for using a third-party which is articulated by the business folks, not compliance. A Relationship Manager is the key going forward in operationalizing your compliance program through the life of the third-party relationship with your company. Always remember to “Document, Document, and Document”. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2020 Update stated, “Prosecutors should also assess whether the company knows the business rationale for needing the third party in the transaction, and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials.” This standard articulates one of the most basic tools to operationalize your compliance program and should form the basis of your third-party risk management process. Indeed this is viewed as an internal control with the 2020 Update going on to pose the following question, “How does the company ensure there is an appropriate business rationale for the use of third parties?”

Another way to think about this issue is by considering the competence of a foreign business partner to provide services to your organization. Such considerations include a review of the qualifications of the third-party candidate for SME, the resources to perform the services for which they are being considered and the third-party’s expected activities for your company. More detailed inquiries include requiring the relevant business unit which desires to obtain the services of any third-party to provide you with a business rationale including current opportunities in territory, how the candidate was identified and why no currently existing third-party relationships can provide the requested services. Your next inquiry should focus on the terms of the engagement, including the commission rate, the term of the agreement, what territory may be covered by the agreement and if such relationship will be exclusive.

Remember, the purpose of the business rationale is to document the satisfactoriness of the business case to retain a third-party. The business rationale should be included in the compliance review file assembled on every third-party at the time of initial certification and again if the third-party relationship is renewed. This means “Document, Document, and Document”.

Three key takeaways:

  1. You should always have a business reason for using a third-party which is articulated by the business folks, not compliance.
  2. A Relationship Manager is the key going forward in operationalizing your compliance program through the life of the third-party relationship with your company.
  3. Always remember to “Document, Document, and Document”.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Introduction to 3rd Party Risk Management Over the month of July, I will consider the risk management of third-parties in an operationalized compliance program. As every compliance practitioner is aware, third-parties still present the highest risk under the FCPA. You must assess whether the company has a business rationale for needing the third party in the transaction, and the risks posed by third-parties, including their reputations and relationships, if any, with foreign government officials. You should ensure that contract terms with third parties specifically describe the services to be performed, the third party is actually performing the work, and that its compensation is commensurate with the work being provided in that industry and geographical region.   Finally you must engage in ongoing monitoring of the third-party relationships, through updated due diligence, training, audits, and/or annual compliance certifications by the third party.  A well-designed compliance program should apply risk-based due diligence to its third- party relationships. As the DOJ noted “the need for, and degree of, appropriate due diligence may vary based on the size and nature of the company, transaction, and third party, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.” This means your compliance must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party management. Business Justification; Questionnaire to third-party; Due diligence on third-party; Compliance terms and conditions, including payment terms; and Management and oversight of third-parties after contract signing. I will be exploring each of these steps in detail, so you will be able to fully operationalize your third-party risk management program. Three key takeaways: Use the full five-step process for third-party management. Make sure you have Business Development involvement and buy-in. Operationalize all steps going forward by including business unit representatives. For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit this month’s sponsor Affiliated Monitors at www.affiliatedmonitors.com.  Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 01 Jul 2020 17:17:49 -0000 Introduction to 3rd Party Risk Management full Thomas Fox Over the month of July, I will consider the risk management of third-parties in an operationalized compliance program. Over the month of July, I will consider the risk management of third-parties in an operationalized compliance program. As every compliance practitioner is aware, third-parties still present the highest risk under the FCPA. You must assess whether the company has a business rationale for needing the third party in the transaction, and the risks posed by third-parties, including their reputations and relationships, if any, with foreign government officials. You should ensure that contract terms with third parties specifically describe the services to be performed, the third party is actually performing the work, and that its compensation is commensurate with the work being provided in that industry and geographical region.   Finally you must engage in ongoing monitoring of the third-party relationships, through updated due diligence, training, audits, and/or annual compliance certifications by the third party.  A well-designed compliance program should apply risk-based due diligence to its third- party relationships. As the DOJ noted “the need for, and degree of, appropriate due diligence may vary based on the size and nature of the company, transaction, and third party, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.” This means your compliance must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party management. Business Justification; Questionnaire to third-party; Due diligence on third-party; Compliance terms and conditions, including payment terms; and Management and oversight of third-parties after contract signing. I will be exploring each of these steps in detail, so you will be able to fully operationalize your third-party risk management program. Three key takeaways: Use the full five-step process for third-party management. Make sure you have Business Development involvement and buy-in. Operationalize all steps going forward by including business unit representatives. For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit this month’s sponsor Affiliated Monitors at www.affiliatedmonitors.com.  Learn more about your ad choices. Visit megaphone.fm/adchoices Over the month of July, I will consider the risk management of third-parties in an operationalized compliance program. As every compliance practitioner is aware, third-parties still present the highest risk under the FCPA. You must assess whether the company has a business rationale for needing the third party in the transaction, and the risks posed by third-parties, including their reputations and relationships, if any, with foreign government officials. You should ensure that contract terms with third parties specifically describe the services to be performed, the third party is actually performing the work, and that its compensation is commensurate with the work being provided in that industry and geographical region.   Finally you must engage in ongoing monitoring of the third-party relationships, through updated due diligence, training, audits, and/or annual compliance certifications by the third party.

 A well-designed compliance program should apply risk-based due diligence to its third- party relationships. As the DOJ noted “the need for, and degree of, appropriate due diligence may vary based on the size and nature of the company, transaction, and third party, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.” This means your compliance must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party management.

  1. Business Justification;
  2. Questionnaire to third-party;
  3. Due diligence on third-party;
  4. Compliance terms and conditions, including payment terms; and
  5. Management and oversight of third-parties after contract signing.

I will be exploring each of these steps in detail, so you will be able to fully operationalize your third-party risk management program.

Three key takeaways:

  1. Use the full five-step process for third-party management.
  2. Make sure you have Business Development involvement and buy-in.
  3. Operationalize all steps going forward by including business unit representatives.


For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit this month’s sponsor Affiliated Monitors at www.affiliatedmonitors.com. 


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no The parameters of privileges The concept of privilege in an internal investigation is critical. Two important privileges are the attorney-client privilege and the work product privilege. Unfortunately, both are often misunderstood, miss-applied and consequently lost. To determine whether you have a valid privilege claim, it is incumbent to understand the parameters of the attorney-client privilege. In presentation, entitled “Attorney-Client Privilege ”, David E. Keltner, Kelly Hart & Hallman LLP, Elizabeth Brummett and Adrienne Parham, both from University of Texas Law School, wrote that under U.S. federal law, the attorney-client privilege applies when the following are present:  A client is seeking legal advice or a lawyer’s services; The person to whom the communication is made is a lawyer or his or her representative; The communication relates to a fact disclosed from a client (a representative) to a lawyer (a representative); Strangers are not present; A client requires confidentiality. In addition to the attorney-client privilege there is another privilege which can come into play around internal investigations. It is the attorney work-product doctrine. Keltner noted, “The attorney-client privilege and the attorney work-product doctrine are often asserted interchangeably. While there is some overlap between the two, the attorney-client privilege is significantly different than the attorney work-product doctrine.” Moreover as “codified in Fed R.Civ. P. 26(b)(3), [the attorney/work product] provides a qualified protection to materials prepared by party’s counsel or other representative in the anticipation of litigation.” The doctrine exists “because it permits lawyers to “work with a certain degree of privacy, free from unnecessary intrusion by opposing parties . . .”” Three key takeaways: Note the differences in the attorney-client privilege and attorney work-product doctrine. Both can be waived intentionally or through inadvertent conduct. Take care on attorney work-product outside the U.S., where there may be no privilege at all. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 30 Jun 2020 17:00:00 -0000 The parameters of privileges full Thomas Fox What are the parameters of the attorney/client and work product privileges? Find out in the final episode in June on 31 Days to a More Effective Compliance Program. The concept of privilege in an internal investigation is critical. Two important privileges are the attorney-client privilege and the work product privilege. Unfortunately, both are often misunderstood, miss-applied and consequently lost. To determine whether you have a valid privilege claim, it is incumbent to understand the parameters of the attorney-client privilege. In presentation, entitled “Attorney-Client Privilege ”, David E. Keltner, Kelly Hart & Hallman LLP, Elizabeth Brummett and Adrienne Parham, both from University of Texas Law School, wrote that under U.S. federal law, the attorney-client privilege applies when the following are present:  A client is seeking legal advice or a lawyer’s services; The person to whom the communication is made is a lawyer or his or her representative; The communication relates to a fact disclosed from a client (a representative) to a lawyer (a representative); Strangers are not present; A client requires confidentiality. In addition to the attorney-client privilege there is another privilege which can come into play around internal investigations. It is the attorney work-product doctrine. Keltner noted, “The attorney-client privilege and the attorney work-product doctrine are often asserted interchangeably. While there is some overlap between the two, the attorney-client privilege is significantly different than the attorney work-product doctrine.” Moreover as “codified in Fed R.Civ. P. 26(b)(3), [the attorney/work product] provides a qualified protection to materials prepared by party’s counsel or other representative in the anticipation of litigation.” The doctrine exists “because it permits lawyers to “work with a certain degree of privacy, free from unnecessary intrusion by opposing parties . . .”” Three key takeaways: Note the differences in the attorney-client privilege and attorney work-product doctrine. Both can be waived intentionally or through inadvertent conduct. Take care on attorney work-product outside the U.S., where there may be no privilege at all. Learn more about your ad choices. Visit megaphone.fm/adchoices The concept of privilege in an internal investigation is critical. Two important privileges are the attorney-client privilege and the work product privilege. Unfortunately, both are often misunderstood, miss-applied and consequently lost. To determine whether you have a valid privilege claim, it is incumbent to understand the parameters of the attorney-client privilege. In presentation, entitled “Attorney-Client Privilege ”, David E. Keltner, Kelly Hart & Hallman LLP, Elizabeth Brummett and Adrienne Parham, both from University of Texas Law School, wrote that under U.S. federal law, the attorney-client privilege applies when the following are present:

  1.  A client is seeking legal advice or a lawyer’s services;
  2. The person to whom the communication is made is a lawyer or his or her representative;
  3. The communication relates to a fact disclosed from a client (a representative) to a lawyer (a representative);
  4. Strangers are not present;
  5. A client requires confidentiality.

In addition to the attorney-client privilege there is another privilege which can come into play around internal investigations. It is the attorney work-product doctrine. Keltner noted, “The attorney-client privilege and the attorney work-product doctrine are often asserted interchangeably. While there is some overlap between the two, the attorney-client privilege is significantly different than the attorney work-product doctrine.” Moreover as “codified in Fed R.Civ. P. 26(b)(3), [the attorney/work product] provides a qualified protection to materials prepared by party’s counsel or other representative in the anticipation of litigation.” The doctrine exists “because it permits lawyers to “work with a certain degree of privacy, free from unnecessary intrusion by opposing parties . . .””

Three key takeaways:

  1. Note the differences in the attorney-client privilege and attorney work-product doctrine.
  2. Both can be waived intentionally or through inadvertent conduct.
  3. Take care on attorney work-product outside the U.S., where there may be no privilege at all.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no Miranda and internal investigations: What rights does an employee retain? Must an investigator warn an employee that concealing information from company lawyers conducting an internal FCPA investigation could be a federal crime? Even if the company attorneys provided the now standard corporate attorney Upjohn warning? Does a company attorney asking questions morph into a de facto federal agent during an internal company investigation regarding alleged FCPA violations and is the attorney thereby required to provide a Mirandawarning to employees during said investigation? Employees who are subject to being interviewed or otherwise required to cooperate in an internal investigation may find themselves on the sharp horns of a dilemma requiring either (1) cooperating with the internal investigation or (2) losing their jobs for failure to cooperate by providing documents, testimony or other evidence. Many U.S. businesses mandate full employee cooperation with internal investigations or those handled by outside counsel on behalf of a corporation. These requirements can exert a coercive force, “often inducing employees to act contrary to their personal legal interests in favor of candidly disclosing wrongdoing to corporate counsel.” Moreover, such a corporate policy may permit a company to claim to the government a spirit of cooperation in the hopes of avoiding prosecution in addition to increasing the chances of earning meaningful credit under the U.S. Sentencing Guidelines or the FCPA Corporate Enforcement Policy. Three key takeaways: Make sure you provide an Upjohn warning. If an employee demands counsel to represent them during an internal investigation, who bears the cost? Always check state law requirements around internal investigations. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 29 Jun 2020 15:40:33 -0000 Miranda and internal investigations: What rights does an employee retain? full Thomas Fox What role do Miranda warnings have to play in internal investigations? Find out on this episode of 31 Days to a More Effective Compliance Program. Must an investigator warn an employee that concealing information from company lawyers conducting an internal FCPA investigation could be a federal crime? Even if the company attorneys provided the now standard corporate attorney Upjohn warning? Does a company attorney asking questions morph into a de facto federal agent during an internal company investigation regarding alleged FCPA violations and is the attorney thereby required to provide a Mirandawarning to employees during said investigation? Employees who are subject to being interviewed or otherwise required to cooperate in an internal investigation may find themselves on the sharp horns of a dilemma requiring either (1) cooperating with the internal investigation or (2) losing their jobs for failure to cooperate by providing documents, testimony or other evidence. Many U.S. businesses mandate full employee cooperation with internal investigations or those handled by outside counsel on behalf of a corporation. These requirements can exert a coercive force, “often inducing employees to act contrary to their personal legal interests in favor of candidly disclosing wrongdoing to corporate counsel.” Moreover, such a corporate policy may permit a company to claim to the government a spirit of cooperation in the hopes of avoiding prosecution in addition to increasing the chances of earning meaningful credit under the U.S. Sentencing Guidelines or the FCPA Corporate Enforcement Policy. Three key takeaways: Make sure you provide an Upjohn warning. If an employee demands counsel to represent them during an internal investigation, who bears the cost? Always check state law requirements around internal investigations. Learn more about your ad choices. Visit megaphone.fm/adchoices Must an investigator warn an employee that concealing information from company lawyers conducting an internal FCPA investigation could be a federal crime? Even if the company attorneys provided the now standard corporate attorney Upjohn warning? Does a company attorney asking questions morph into a de facto federal agent during an internal company investigation regarding alleged FCPA violations and is the attorney thereby required to provide a Mirandawarning to employees during said investigation?

Employees who are subject to being interviewed or otherwise required to cooperate in an internal investigation may find themselves on the sharp horns of a dilemma requiring either (1) cooperating with the internal investigation or (2) losing their jobs for failure to cooperate by providing documents, testimony or other evidence. Many U.S. businesses mandate full employee cooperation with internal investigations or those handled by outside counsel on behalf of a corporation. These requirements can exert a coercive force, “often inducing employees to act contrary to their personal legal interests in favor of candidly disclosing wrongdoing to corporate counsel.” Moreover, such a corporate policy may permit a company to claim to the government a spirit of cooperation in the hopes of avoiding prosecution in addition to increasing the chances of earning meaningful credit under the U.S. Sentencing Guidelines or the FCPA Corporate Enforcement Policy.

Three key takeaways:

  1. Make sure you provide an Upjohn warning.
  2. If an employee demands counsel to represent them during an internal investigation, who bears the cost?
  3. Always check state law requirements around internal investigations.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no How the Yates Memo changed internal investigations In September 2015, Sally Yates, then Assistant Attorney General, announced the Memo that bears her name (Yates Memo), saying, “we have revised our policy guidance to require that if a company wants any credit for cooperation, any credit at all, it must identify all individuals involved in the wrongdoing, regardless of their position, status or seniority in the company and provide all relevant facts about their misconduct. It’s all or nothing. No more picking and choosing what gets disclosed. No more partial credit for cooperation that doesn’t include information about individuals.” This statement tied directly into the first point of the Yates Memo, which stated, “To be eligible for any cooperation credit, corporations must provide to the Department all relevant facts about the individuals involved in corporate misconduct.”  More than three years after the announcement of the Yates Memo, the DOJ modified this course slightly. In 2018, then-Deputy Attorney General Rod Rosenstein relaxed the rigid approach required by the Yates Memo and inserting more flexibility and discretion to government investigators. Rosenstein said that the DOJ would continue to focus on individuals in its white-collar investigations, but he ended the Yates Memo’s approach requiring ALL relevant facts to be turned over to the DOJ. This permitted corporations to receive credit for their cooperation if they identify individuals who were significantly involved in or caused the criminal conduct and permitted greater flexibility and discretion in awarding cooperation credit in civil cases. Then Attorney General Jeff Sessions echoed these concepts in his Keynote remarks at the Ethics and Compliance Initiative in April 2017. He reiterated that the DOJ would focus on individual criminal misconduct in the context of enforcing the FCPA. This continued emphasis will mean that there is even more pressure on corporate compliance programs to get it right and get it right sooner rather than later. Three key takeaways: What is a Yates binder? While the Yates Memo required you to hand over ALL evidence, the Rosenstein Corollary added flexibility. Senior management is now in the firing line. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 26 Jun 2020 17:00:00 -0000 How the Yates Memo changed internal investigations full Thomas Fox How did the Yates Memo change the focus of internal investigations? Find out in today's 31 Days to a More Effective Compliance Program. In September 2015, Sally Yates, then Assistant Attorney General, announced the Memo that bears her name (Yates Memo), saying, “we have revised our policy guidance to require that if a company wants any credit for cooperation, any credit at all, it must identify all individuals involved in the wrongdoing, regardless of their position, status or seniority in the company and provide all relevant facts about their misconduct. It’s all or nothing. No more picking and choosing what gets disclosed. No more partial credit for cooperation that doesn’t include information about individuals.” This statement tied directly into the first point of the Yates Memo, which stated, “To be eligible for any cooperation credit, corporations must provide to the Department all relevant facts about the individuals involved in corporate misconduct.”  More than three years after the announcement of the Yates Memo, the DOJ modified this course slightly. In 2018, then-Deputy Attorney General Rod Rosenstein relaxed the rigid approach required by the Yates Memo and inserting more flexibility and discretion to government investigators. Rosenstein said that the DOJ would continue to focus on individuals in its white-collar investigations, but he ended the Yates Memo’s approach requiring ALL relevant facts to be turned over to the DOJ. This permitted corporations to receive credit for their cooperation if they identify individuals who were significantly involved in or caused the criminal conduct and permitted greater flexibility and discretion in awarding cooperation credit in civil cases. Then Attorney General Jeff Sessions echoed these concepts in his Keynote remarks at the Ethics and Compliance Initiative in April 2017. He reiterated that the DOJ would focus on individual criminal misconduct in the context of enforcing the FCPA. This continued emphasis will mean that there is even more pressure on corporate compliance programs to get it right and get it right sooner rather than later. Three key takeaways: What is a Yates binder? While the Yates Memo required you to hand over ALL evidence, the Rosenstein Corollary added flexibility. Senior management is now in the firing line. Learn more about your ad choices. Visit megaphone.fm/adchoices In September 2015, Sally Yates, then Assistant Attorney General, announced the Memo that bears her name (Yates Memo), saying, “we have revised our policy guidance to require that if a company wants any credit for cooperation, any credit at all, it must identify all individuals involved in the wrongdoing, regardless of their position, status or seniority in the company and provide all relevant facts about their misconduct. It’s all or nothing. No more picking and choosing what gets disclosed. No more partial credit for cooperation that doesn’t include information about individuals.” This statement tied directly into the first point of the Yates Memo, which stated, “To be eligible for any cooperation credit, corporations must provide to the Department all relevant facts about the individuals involved in corporate misconduct.”

 More than three years after the announcement of the Yates Memo, the DOJ modified this course slightly. In 2018, then-Deputy Attorney General Rod Rosenstein relaxed the rigid approach required by the Yates Memo and inserting more flexibility and discretion to government investigators. Rosenstein said that the DOJ would continue to focus on individuals in its white-collar investigations, but he ended the Yates Memo’s approach requiring ALL relevant facts to be turned over to the DOJ. This permitted corporations to receive credit for their cooperation if they identify individuals who were significantly involved in or caused the criminal conduct and permitted greater flexibility and discretion in awarding cooperation credit in civil cases.

Then Attorney General Jeff Sessions echoed these concepts in his Keynote remarks at the Ethics and Compliance Initiative in April 2017. He reiterated that the DOJ would focus on individual criminal misconduct in the context of enforcing the FCPA. This continued emphasis will mean that there is even more pressure on corporate compliance programs to get it right and get it right sooner rather than later.

Three key takeaways:

  1. What is a Yates binder?
  2. While the Yates Memo required you to hand over ALL evidence, the Rosenstein Corollary added flexibility.
  3. Senior management is now in the firing line.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no What leads to a successful Board investigation? Now that you have set your Board of Directors, investigations protocol, we consider some of the key factors which will lead to the successful conclusion of a Board-led investigation. Once again, the article, “Successful Board Investigations”, offers seven considerations to lead to the successful conclusion of a Board-led investigation.  Consider whether you need independent outside counsel. Consider hiring an experienced investigator to lead the internal investigation. Consider the need to retain outside experts. Analyze potential conflicts of interest at the outset and during the investigation. Carefully evaluate whistleblower allegations. Request regular updates from outside counsel, without limiting the investigation. Consider whether an oral report at the conclusion of the investigation is sufficient. The authors conclude their piece by stating, “By keeping in mind the issues addressed above, the Board will be better prepared for the investigation and readily able to exercise good judgment throughout the review. A well-conducted investigation by the Board may spare the company further disruption and costs associated with follow-on investigations by the regulators, or at the very least minimize the company’s exposure.” Three key takeaways: Retain the right counsel. Consider conflicts and appearance. Carefully evaluate all whistleblower allegations and reject retaliation. Consider receiving oral reports on an ongoing basis and one lengthy oral report at the end of the investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 25 Jun 2020 17:00:00 -0000 What leads to a successful Board investigation? full Thomas Fox What are some of the top factors which lead to a successful Board of Directors led investigation? Find out in today's episode of 31 Days to a More Effective Compliance Program. Now that you have set your Board of Directors, investigations protocol, we consider some of the key factors which will lead to the successful conclusion of a Board-led investigation. Once again, the article, “Successful Board Investigations”, offers seven considerations to lead to the successful conclusion of a Board-led investigation.  Consider whether you need independent outside counsel. Consider hiring an experienced investigator to lead the internal investigation. Consider the need to retain outside experts. Analyze potential conflicts of interest at the outset and during the investigation. Carefully evaluate whistleblower allegations. Request regular updates from outside counsel, without limiting the investigation. Consider whether an oral report at the conclusion of the investigation is sufficient. The authors conclude their piece by stating, “By keeping in mind the issues addressed above, the Board will be better prepared for the investigation and readily able to exercise good judgment throughout the review. A well-conducted investigation by the Board may spare the company further disruption and costs associated with follow-on investigations by the regulators, or at the very least minimize the company’s exposure.” Three key takeaways: Retain the right counsel. Consider conflicts and appearance. Carefully evaluate all whistleblower allegations and reject retaliation. Consider receiving oral reports on an ongoing basis and one lengthy oral report at the end of the investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Now that you have set your Board of Directors, investigations protocol, we consider some of the key factors which will lead to the successful conclusion of a Board-led investigation. Once again, the article, “Successful Board Investigations”, offers seven considerations to lead to the successful conclusion of a Board-led investigation. 

  1. Consider whether you need independent outside counsel.
  2. Consider hiring an experienced investigator to lead the internal investigation.
  3. Consider the need to retain outside experts.
  4. Analyze potential conflicts of interest at the outset and during the investigation.
  5. Carefully evaluate whistleblower allegations.
  6. Request regular updates from outside counsel, without limiting the investigation.
  7. Consider whether an oral report at the conclusion of the investigation is sufficient.

The authors conclude their piece by stating, “By keeping in mind the issues addressed above, the Board will be better prepared for the investigation and readily able to exercise good judgment throughout the review. A well-conducted investigation by the Board may spare the company further disruption and costs associated with follow-on investigations by the regulators, or at the very least minimize the company’s exposure.”

Three key takeaways:

  1. Retain the right counsel. Consider conflicts and appearance.
  2. Carefully evaluate all whistleblower allegations and reject retaliation.
  3. Consider receiving oral reports on an ongoing basis and one lengthy oral report at the end of the investigation.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no The Board of Directors investigation protocol Many companies have an investigation protocol in place when a potential compliance violation or other legal issue arises. However, many Boards of Directors do not have the same rigor when it comes to an investigation, which should be conducted or led by the Board itself. The consequences of this lack of foresight can be problematic, because if a Board does handle an investigation right, the consequences to the company, its reputation and value can be quite severe. The SEC considers a variety of factors around corporate investigations including: Did management, the board or committees consisting solely of outside directors oversee the review? Did company employees or outside persons perform the review? If outside persons, have they done other work for the company? There is also a SOX role in internal investigations, most particularly for audit. Section 301 establishes certain requirements for Audit Committees, including: (1) Procedures for receipt, retention, and treatment of complaints received by the issuer regarding accounting, internal accounting controls, or auditing matters; (2) Procedures regarding the confidential, anonymous submission by employees of the issuer of concerns regarding questionable accounting or auditing matters; (3) Authority to engage independent counsel and other advisers, as it determines necessary to carry out its duties; and (4) Funding to engage advisors as it deems appropriate. Three key takeaways: The Board should have a written protocol for investigations prepared in advance. Any Board led investigation must be both credible and objective. The investigation must be thorough but the Board can be cost effective. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 24 Jun 2020 05:03:00 -0000 The Board of Directors investigation protocol full Thomas Fox What should be in a Board investigation protocol? Find out on this episode of 31 Days to a More Effective Compliance Program. Many companies have an investigation protocol in place when a potential compliance violation or other legal issue arises. However, many Boards of Directors do not have the same rigor when it comes to an investigation, which should be conducted or led by the Board itself. The consequences of this lack of foresight can be problematic, because if a Board does handle an investigation right, the consequences to the company, its reputation and value can be quite severe. The SEC considers a variety of factors around corporate investigations including: Did management, the board or committees consisting solely of outside directors oversee the review? Did company employees or outside persons perform the review? If outside persons, have they done other work for the company? There is also a SOX role in internal investigations, most particularly for audit. Section 301 establishes certain requirements for Audit Committees, including: (1) Procedures for receipt, retention, and treatment of complaints received by the issuer regarding accounting, internal accounting controls, or auditing matters; (2) Procedures regarding the confidential, anonymous submission by employees of the issuer of concerns regarding questionable accounting or auditing matters; (3) Authority to engage independent counsel and other advisers, as it determines necessary to carry out its duties; and (4) Funding to engage advisors as it deems appropriate. Three key takeaways: The Board should have a written protocol for investigations prepared in advance. Any Board led investigation must be both credible and objective. The investigation must be thorough but the Board can be cost effective. Learn more about your ad choices. Visit megaphone.fm/adchoices Many companies have an investigation protocol in place when a potential compliance violation or other legal issue arises. However, many Boards of Directors do not have the same rigor when it comes to an investigation, which should be conducted or led by the Board itself. The consequences of this lack of foresight can be problematic, because if a Board does handle an investigation right, the consequences to the company, its reputation and value can be quite severe. The SEC considers a variety of factors around corporate investigations including: Did management, the board or committees consisting solely of outside directors oversee the review? Did company employees or outside persons perform the review? If outside persons, have they done other work for the company?

There is also a SOX role in internal investigations, most particularly for audit. Section 301 establishes certain requirements for Audit Committees, including: (1) Procedures for receipt, retention, and treatment of complaints received by the issuer regarding accounting, internal accounting controls, or auditing matters; (2) Procedures regarding the confidential, anonymous submission by employees of the issuer of concerns regarding questionable accounting or auditing matters; (3) Authority to engage independent counsel and other advisers, as it determines necessary to carry out its duties; and (4) Funding to engage advisors as it deems appropriate.

Three key takeaways:

  1. The Board should have a written protocol for investigations prepared in advance.
  2. Any Board led investigation must be both credible and objective.
  3. The investigation must be thorough but the Board can be cost effective.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no Some Tough Questions Around Investigations You may find yourself in the position that you will have to have some very frank discussions about what to expect in terms of costs and time outlays. While much of these discussions will focus on the investigative process and costs, these discussions will allow you to begin to talk about remediation going forward and begin to explain why money must be budgeted for the process. Costs must be adequately discussed to set proper expectations. These include both direct costs and, even more importantly, a discussion of indirect costs to a company. Dan Chapman has noted that “the biggest cost to a company during an investigation is the diversion of management resources” and, as he further explained, “kind of everything stops to focus on the investigation.” This indirect cost comes through largely the time commitment of senior management. He further explained, “if senior management has to commit 20% of their time, that’s 20% that’s not going towards revenue generating, shareholder value protecting activities.” Three key takeaways: A serious allegation gets the attention of the Board of Directors and senior management. Use this time to move the compliance program forward. Be aware of how your investigation can impact and even inform your remediation efforts. How do you deal with the dreaded ‘where else’ question? Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 23 Jun 2020 17:00:00 -0000 Some Tough Questions Around Investigations full Thomas Fox When a large anti-corruption investigation begins, you will have to ask some very difficult questions of senior management. We explore what some of them are in this episode of 31 Days to a More Effective Compliance Program. You may find yourself in the position that you will have to have some very frank discussions about what to expect in terms of costs and time outlays. While much of these discussions will focus on the investigative process and costs, these discussions will allow you to begin to talk about remediation going forward and begin to explain why money must be budgeted for the process. Costs must be adequately discussed to set proper expectations. These include both direct costs and, even more importantly, a discussion of indirect costs to a company. Dan Chapman has noted that “the biggest cost to a company during an investigation is the diversion of management resources” and, as he further explained, “kind of everything stops to focus on the investigation.” This indirect cost comes through largely the time commitment of senior management. He further explained, “if senior management has to commit 20% of their time, that’s 20% that’s not going towards revenue generating, shareholder value protecting activities.” Three key takeaways: A serious allegation gets the attention of the Board of Directors and senior management. Use this time to move the compliance program forward. Be aware of how your investigation can impact and even inform your remediation efforts. How do you deal with the dreaded ‘where else’ question? Learn more about your ad choices. Visit megaphone.fm/adchoices You may find yourself in the position that you will have to have some very frank discussions about what to expect in terms of costs and time outlays. While much of these discussions will focus on the investigative process and costs, these discussions will allow you to begin to talk about remediation going forward and begin to explain why money must be budgeted for the process.

Costs must be adequately discussed to set proper expectations. These include both direct costs and, even more importantly, a discussion of indirect costs to a company. Dan Chapman has noted that “the biggest cost to a company during an investigation is the diversion of management resources” and, as he further explained, “kind of everything stops to focus on the investigation.” This indirect cost comes through largely the time commitment of senior management. He further explained, “if senior management has to commit 20% of their time, that’s 20% that’s not going towards revenue generating, shareholder value protecting activities.”

Three key takeaways:

  1. A serious allegation gets the attention of the Board of Directors and senior management. Use this time to move the compliance program forward.
  2. Be aware of how your investigation can impact and even inform your remediation efforts.
  3. How do you deal with the dreaded ‘where else’ question?


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no How an investigation informs remediation There is nothing like an internal whistleblower report about a FCPA violation, the finding of such an issue or (even worse) a subpoena from the DOJ to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check. In addition to robust investigation, a company must engage in remediation of the offending conduct. The 2020 Update to the Evaluation of Corporate Compliance Programs mandated the additional significance of this by providing that this process must be considered “both at the time of the offense and at the time of the charging decision and resolution”. When you consider the strictures around continuous monitoring and continuous improvement in compliance programs it is clear why this analysis is so important. Obviously, a key test of any compliance program is when a deficiency is found and a violation occurs. The question then becomes, what did you do about it.  But from the DOJ (and Securities and Exchange Commission) perspective, the key is to use the information to both fix the problem so that it does not occur again but also improve your compliance regime. Three key takeaways: How does your investigation inform your remediation plan? A compliance program failure offers a way to upgrade your regime. Your investigative team must inform your remediation team. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 22 Jun 2020 17:00:00 -0000 How an investigation informs remediation full Thomas Fox How does you investigation inform the remediation of a compliance program? Find out on this episode of 31 Days to a More Effective Compliance Program There is nothing like an internal whistleblower report about a FCPA violation, the finding of such an issue or (even worse) a subpoena from the DOJ to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check. In addition to robust investigation, a company must engage in remediation of the offending conduct. The 2020 Update to the Evaluation of Corporate Compliance Programs mandated the additional significance of this by providing that this process must be considered “both at the time of the offense and at the time of the charging decision and resolution”. When you consider the strictures around continuous monitoring and continuous improvement in compliance programs it is clear why this analysis is so important. Obviously, a key test of any compliance program is when a deficiency is found and a violation occurs. The question then becomes, what did you do about it.  But from the DOJ (and Securities and Exchange Commission) perspective, the key is to use the information to both fix the problem so that it does not occur again but also improve your compliance regime. Three key takeaways: How does your investigation inform your remediation plan? A compliance program failure offers a way to upgrade your regime. Your investigative team must inform your remediation team. Learn more about your ad choices. Visit megaphone.fm/adchoices There is nothing like an internal whistleblower report about a FCPA violation, the finding of such an issue or (even worse) a subpoena from the DOJ to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check.

In addition to robust investigation, a company must engage in remediation of the offending conduct. The 2020 Update to the Evaluation of Corporate Compliance Programs mandated the additional significance of this by providing that this process must be considered “both at the time of the offense and at the time of the charging decision and resolution”. When you consider the strictures around continuous monitoring and continuous improvement in compliance programs it is clear why this analysis is so important. Obviously, a key test of any compliance program is when a deficiency is found and a violation occurs. The question then becomes, what did you do about it. 

But from the DOJ (and Securities and Exchange Commission) perspective, the key is to use the information to both fix the problem so that it does not occur again but also improve your compliance regime.

Three key takeaways:

  1. How does your investigation inform your remediation plan?
  2. A compliance program failure offers a way to upgrade your regime.
  3. Your investigative team must inform your remediation team.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no Who and When to suspend during an investigation? Who to suspend during any investigation is always a delicate question to answer and is never easy to answer. As the VW emission-testing scandal reverberated, it brought up some very knotty questions, which have continued bedeviled many a CCO or compliance practitioner in multiple areas. De-confliction is also an issue which continues to bedevil investigators and internal investigations. Mara Senn has said “That is a very case-by-case difficult question to answer, but in general, I think it’s better to keep them around for as long as you may need them. Once they’ve been fired or otherwise disciplined, really, even if you keep them around, they’re going to be less cooperative with you and possibly, if you fire them, not cooperative at all. You can require them to be cooperative in the termination agreement, but obviously in practice, cooperation can mean a lot of different things.”  De-confliction, involves the government asking a company to halt its own investigation for the government to be the first to interview witnesses. Former DAG Lanny Breuer posed four questions which every investigator must consider in the area of de-confliction. (1) Would complying with the request be consistent with directors’ and corporate officers’ fiduciary duty of oversight? (2) How can a company make decisions without speaking with its employees? (3) How will a delay affect the company’s other regulatory obligations? and (4) How can external counsel advise a company without knowing the facts? Companies hire external counsel to conduct thorough investigations, evaluate their clients’ conduct, and provide informed legal advice. These tasks can be difficult if not impossible to accomplish where external counsel have their hands tied behind their backs. Three key takeaways: The decision on whom to discipline and when are critical decisions during any investigation. You should take a case-by-case approach. The “de-confliction” question can be quite troubling during an internal investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 19 Jun 2020 17:00:00 -0000 Who and When to suspend during an investigation? full Thomas Fox Who to suspend during any investigation is always a delicate question to answer and is never easy to answer. Find out more in this episode of 31 Days to a More Effective Compliance Program. Who to suspend during any investigation is always a delicate question to answer and is never easy to answer. As the VW emission-testing scandal reverberated, it brought up some very knotty questions, which have continued bedeviled many a CCO or compliance practitioner in multiple areas. De-confliction is also an issue which continues to bedevil investigators and internal investigations. Mara Senn has said “That is a very case-by-case difficult question to answer, but in general, I think it’s better to keep them around for as long as you may need them. Once they’ve been fired or otherwise disciplined, really, even if you keep them around, they’re going to be less cooperative with you and possibly, if you fire them, not cooperative at all. You can require them to be cooperative in the termination agreement, but obviously in practice, cooperation can mean a lot of different things.”  De-confliction, involves the government asking a company to halt its own investigation for the government to be the first to interview witnesses. Former DAG Lanny Breuer posed four questions which every investigator must consider in the area of de-confliction. (1) Would complying with the request be consistent with directors’ and corporate officers’ fiduciary duty of oversight? (2) How can a company make decisions without speaking with its employees? (3) How will a delay affect the company’s other regulatory obligations? and (4) How can external counsel advise a company without knowing the facts? Companies hire external counsel to conduct thorough investigations, evaluate their clients’ conduct, and provide informed legal advice. These tasks can be difficult if not impossible to accomplish where external counsel have their hands tied behind their backs. Three key takeaways: The decision on whom to discipline and when are critical decisions during any investigation. You should take a case-by-case approach. The “de-confliction” question can be quite troubling during an internal investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Who to suspend during any investigation is always a delicate question to answer and is never easy to answer. As the VW emission-testing scandal reverberated, it brought up some very knotty questions, which have continued bedeviled many a CCO or compliance practitioner in multiple areas. De-confliction is also an issue which continues to bedevil investigators and internal investigations. Mara Senn has said “That is a very case-by-case difficult question to answer, but in general, I think it’s better to keep them around for as long as you may need them. Once they’ve been fired or otherwise disciplined, really, even if you keep them around, they’re going to be less cooperative with you and possibly, if you fire them, not cooperative at all. You can require them to be cooperative in the termination agreement, but obviously in practice, cooperation can mean a lot of different things.”

 De-confliction, involves the government asking a company to halt its own investigation for the government to be the first to interview witnesses. Former DAG Lanny Breuer posed four questions which every investigator must consider in the area of de-confliction. (1) Would complying with the request be consistent with directors’ and corporate officers’ fiduciary duty of oversight? (2) How can a company make decisions without speaking with its employees? (3) How will a delay affect the company’s other regulatory obligations? and (4) How can external counsel advise a company without knowing the facts? Companies hire external counsel to conduct thorough investigations, evaluate their clients’ conduct, and provide informed legal advice. These tasks can be difficult if not impossible to accomplish where external counsel have their hands tied behind their backs.

Three key takeaways:

  1. The decision on whom to discipline and when are critical decisions during any investigation.
  2. You should take a case-by-case approach.
  3. The “de-confliction” question can be quite troubling during an internal investigation.



Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no Issues in Cross Border Investigations In an article, entitled “Internal Investigations, How to Conduct an Anti-Corruption Investigation: Developing and Implementing the Investigation Plan”, Mara Senn, now Director & Senior Counsel, Global Compliance Investigations at Zimmer Biomet and Michelle K. Albert, former lawyer at Arnold & Porter discussed cross-border investigations. They considered the following issues. Offer interview translations. Avoid cultural pitfalls.       Observe data privacy restrictions. Comply with labor requirements. Be aware of other local requirements. Put forms in native translations. Preserve the attorney-client privilege. Prepare for local enforcement actions. Prepare for security risks. Protect whistleblowers. Three key takeaways: Use translators and translations of key documents in witness interviews. Use local counsel to facilitate the investigation and to help navigate any local anti-corruption investigation issues. Never, never, never retaliate. The SEC will pay whistleblower bounties for non-U.S. citizens. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 18 Jun 2020 17:00:00 -0000 Issues in Cross Border Investigations full Thomas Fox What are some of the key issues in cross border investigations? Find out in this episode of 31 Days to a More Effective Compliance Program. In an article, entitled “Internal Investigations, How to Conduct an Anti-Corruption Investigation: Developing and Implementing the Investigation Plan”, Mara Senn, now Director & Senior Counsel, Global Compliance Investigations at Zimmer Biomet and Michelle K. Albert, former lawyer at Arnold & Porter discussed cross-border investigations. They considered the following issues. Offer interview translations. Avoid cultural pitfalls.       Observe data privacy restrictions. Comply with labor requirements. Be aware of other local requirements. Put forms in native translations. Preserve the attorney-client privilege. Prepare for local enforcement actions. Prepare for security risks. Protect whistleblowers. Three key takeaways: Use translators and translations of key documents in witness interviews. Use local counsel to facilitate the investigation and to help navigate any local anti-corruption investigation issues. Never, never, never retaliate. The SEC will pay whistleblower bounties for non-U.S. citizens. Learn more about your ad choices. Visit megaphone.fm/adchoices In an article, entitled “Internal Investigations, How to Conduct an Anti-Corruption Investigation: Developing and Implementing the Investigation Plan”, Mara Senn, now Director & Senior Counsel, Global Compliance Investigations at Zimmer Biomet and Michelle K. Albert, former lawyer at Arnold & Porter discussed cross-border investigations. They considered the following issues.

Offer interview translations.

Avoid cultural pitfalls.      

Observe data privacy restrictions.

Comply with labor requirements.

Be aware of other local requirements.

Put forms in native translations.

Preserve the attorney-client privilege.

Prepare for local enforcement actions.

Prepare for security risks.

Protect whistleblowers.

Three key takeaways:

  1. Use translators and translations of key documents in witness interviews.
  2. Use local counsel to facilitate the investigation and to help navigate any local anti-corruption investigation issues.
  3. Never, never, never retaliate. The SEC will pay whistleblower bounties for non-U.S. citizens.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no The witness interview What are the characteristics of a good interview in the context of an internal investigation? Is there one technique you can use which will provide you the results you want to achieve? How should you think through your questions and document review prior to the investigation? At this point in time, how do such issues play out in the time of Coronavirus?  There is no one right way to prepare for and conduct an interview. What is important is that you have a plan and execute on that plan. Begin by obtaining an understanding of what the various stakeholders want answers to. This could include the Board of Directors, C-Suite executives, the GC and legal department, the CCO and compliance function or up to government regulators such as the SEC or DOJ. Three key takeaways: There is no one right way to prepare and do an interview. The interview should not be confrontational. The interview, like the entire investigation process, is a chess match. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 17 Jun 2020 17:00:00 -0000 The witness interview full Thomas Fox There are some basics to a witness interview. Found out how to prepare and strategies to use in this episode of 31 Days to a More Effective Compliance Program. What are the characteristics of a good interview in the context of an internal investigation? Is there one technique you can use which will provide you the results you want to achieve? How should you think through your questions and document review prior to the investigation? At this point in time, how do such issues play out in the time of Coronavirus?  There is no one right way to prepare for and conduct an interview. What is important is that you have a plan and execute on that plan. Begin by obtaining an understanding of what the various stakeholders want answers to. This could include the Board of Directors, C-Suite executives, the GC and legal department, the CCO and compliance function or up to government regulators such as the SEC or DOJ. Three key takeaways: There is no one right way to prepare and do an interview. The interview should not be confrontational. The interview, like the entire investigation process, is a chess match. Learn more about your ad choices. Visit megaphone.fm/adchoices What are the characteristics of a good interview in the context of an internal investigation? Is there one technique you can use which will provide you the results you want to achieve? How should you think through your questions and document review prior to the investigation? At this point in time, how do such issues play out in the time of Coronavirus?

 There is no one right way to prepare for and conduct an interview. What is important is that you have a plan and execute on that plan. Begin by obtaining an understanding of what the various stakeholders want answers to. This could include the Board of Directors, C-Suite executives, the GC and legal department, the CCO and compliance function or up to government regulators such as the SEC or DOJ.

Three key takeaways:

  1. There is no one right way to prepare and do an interview.
  2. The interview should not be confrontational.
  3. The interview, like the entire investigation process, is a chess match.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no Investigative Challenges What are some of the top challenges you may well face during an investigation? Beyond the basics, a company must consider the intake process as a starting point, which Jonathan Marks noted is one of the biggest challenges. Rather surprisingly, he noted there are still companies without a hotline or anonymous reporting system, stating “we still see organizations whereby there is no formal ethics hotline except for the fact that they might send an email to some member of management or some member of the Board.” Planning your investigation, having the right team members involved and meeting the challenges which inevitably arise during an investigation can be difficult. However, beginning with the DOJ’s 2015 Yates Memo, the 2016 FCPA Pilot Program, and the 2017 and 2019 versions Evaluation of Corporate Compliance Programs, together with the 2020 Update and FCPA Corporate Enforcement Policy, the pressure on every CCO and company to get an investigation done quickly, efficiently and, most importantly, right is even greater now. Marks has laid out a concrete way for you to think through how to plan an investigation, staff it properly and meet the inevitable challenges. Three key takeaways: The intake process may seem the most straight-forward but many companies drop the ball at this initial step. You must never retaliate against employees who come forward in good faith. Always think several steps ahead. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 16 Jun 2020 17:00:00 -0000 Investigative Challenges full Thomas Fox What are some of the top investigative challenges in an internal investigation? Find out on this episode of 31 Days to a More Effective Compliance Program. What are some of the top challenges you may well face during an investigation? Beyond the basics, a company must consider the intake process as a starting point, which Jonathan Marks noted is one of the biggest challenges. Rather surprisingly, he noted there are still companies without a hotline or anonymous reporting system, stating “we still see organizations whereby there is no formal ethics hotline except for the fact that they might send an email to some member of management or some member of the Board.” Planning your investigation, having the right team members involved and meeting the challenges which inevitably arise during an investigation can be difficult. However, beginning with the DOJ’s 2015 Yates Memo, the 2016 FCPA Pilot Program, and the 2017 and 2019 versions Evaluation of Corporate Compliance Programs, together with the 2020 Update and FCPA Corporate Enforcement Policy, the pressure on every CCO and company to get an investigation done quickly, efficiently and, most importantly, right is even greater now. Marks has laid out a concrete way for you to think through how to plan an investigation, staff it properly and meet the inevitable challenges. Three key takeaways: The intake process may seem the most straight-forward but many companies drop the ball at this initial step. You must never retaliate against employees who come forward in good faith. Always think several steps ahead. Learn more about your ad choices. Visit megaphone.fm/adchoices What are some of the top challenges you may well face during an investigation? Beyond the basics, a company must consider the intake process as a starting point, which Jonathan Marks noted is one of the biggest challenges. Rather surprisingly, he noted there are still companies without a hotline or anonymous reporting system, stating “we still see organizations whereby there is no formal ethics hotline except for the fact that they might send an email to some member of management or some member of the Board.”

Planning your investigation, having the right team members involved and meeting the challenges which inevitably arise during an investigation can be difficult. However, beginning with the DOJ’s 2015 Yates Memo, the 2016 FCPA Pilot Program, and the 2017 and 2019 versions Evaluation of Corporate Compliance Programs, together with the 2020 Update and FCPA Corporate Enforcement Policy, the pressure on every CCO and company to get an investigation done quickly, efficiently and, most importantly, right is even greater now. Marks has laid out a concrete way for you to think through how to plan an investigation, staff it properly and meet the inevitable challenges.

Three key takeaways:

  1. The intake process may seem the most straight-forward but many companies drop the ball at this initial step.
  2. You must never retaliate against employees who come forward in good faith.
  3. Always think several steps ahead.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no The investigation team Beginning with the 2015 Yates Memo, 2016 FCPA Pilot Program, 2017 and 2019 Evaluations of Corporate Compliance Programs, with 2020 Update through to the FCPA Corporate Enforcement Policy; the DOJ has put even more pressure on every CCO, compliance practitioner and indeed company, to get an investigation done quickly, efficiently and, most importantly, right. This is even more true after the U.S. Supreme Court’s decisions in Digital Realty Trust v. Somers, which limited whistleblower protection and benefits to only those whistleblowers who go to the SEC, rather than initially report internally. What do all these documents tell who should be on your investigation team?   As with a decision on bringing in outside counsel to perform a compliance investigation, you will need to consider whether a forensic accountant should be retained as an outside consultant or hired as an employee. One critical reason to bring in an outside professional is so they will be not be governed by management or influenced by potential biases within a company. Lastly is the issue of privilege. If a forensic accountant is not assigned through your legal department or through outside counsel, you can kiss away even the chance of claiming privilege. Obviously, the GC would be involved to help protect the attorney client privilege if for no other reason. Further, an investigation needs to have compliance involved, to understand what compliance program was in place at the time of the incident in question, what procedures compliance had and understand if this truly was a gap in the compliance function or maybe there was an area within the compliance function that was not operating as prescribed, or maybe it was a little bit weak. Three key takeaways: HR plays a key but often underused role in internal investigations. The Board of Directors and senior management have different roles. Use your legal department to protect the privilege. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 15 Jun 2020 17:00:00 -0000 The investigation team full Thomas Fox Who should be on your investigative team? Find out in this episode of 31 Days to a More Effective Compliance Program. Beginning with the 2015 Yates Memo, 2016 FCPA Pilot Program, 2017 and 2019 Evaluations of Corporate Compliance Programs, with 2020 Update through to the FCPA Corporate Enforcement Policy; the DOJ has put even more pressure on every CCO, compliance practitioner and indeed company, to get an investigation done quickly, efficiently and, most importantly, right. This is even more true after the U.S. Supreme Court’s decisions in Digital Realty Trust v. Somers, which limited whistleblower protection and benefits to only those whistleblowers who go to the SEC, rather than initially report internally. What do all these documents tell who should be on your investigation team?   As with a decision on bringing in outside counsel to perform a compliance investigation, you will need to consider whether a forensic accountant should be retained as an outside consultant or hired as an employee. One critical reason to bring in an outside professional is so they will be not be governed by management or influenced by potential biases within a company. Lastly is the issue of privilege. If a forensic accountant is not assigned through your legal department or through outside counsel, you can kiss away even the chance of claiming privilege. Obviously, the GC would be involved to help protect the attorney client privilege if for no other reason. Further, an investigation needs to have compliance involved, to understand what compliance program was in place at the time of the incident in question, what procedures compliance had and understand if this truly was a gap in the compliance function or maybe there was an area within the compliance function that was not operating as prescribed, or maybe it was a little bit weak. Three key takeaways: HR plays a key but often underused role in internal investigations. The Board of Directors and senior management have different roles. Use your legal department to protect the privilege. Learn more about your ad choices. Visit megaphone.fm/adchoices Beginning with the 2015 Yates Memo, 2016 FCPA Pilot Program, 2017 and 2019 Evaluations of Corporate Compliance Programs, with 2020 Update through to the FCPA Corporate Enforcement Policy; the DOJ has put even more pressure on every CCO, compliance practitioner and indeed company, to get an investigation done quickly, efficiently and, most importantly, right. This is even more true after the U.S. Supreme Court’s decisions in Digital Realty Trust v. Somers, which limited whistleblower protection and benefits to only those whistleblowers who go to the SEC, rather than initially report internally. What do all these documents tell who should be on your investigation team? 

 As with a decision on bringing in outside counsel to perform a compliance investigation, you will need to consider whether a forensic accountant should be retained as an outside consultant or hired as an employee. One critical reason to bring in an outside professional is so they will be not be governed by management or influenced by potential biases within a company. Lastly is the issue of privilege. If a forensic accountant is not assigned through your legal department or through outside counsel, you can kiss away even the chance of claiming privilege.

Obviously, the GC would be involved to help protect the attorney client privilege if for no other reason. Further, an investigation needs to have compliance involved, to understand what compliance program was in place at the time of the incident in question, what procedures compliance had and understand if this truly was a gap in the compliance function or maybe there was an area within the compliance function that was not operating as prescribed, or maybe it was a little bit weak.

Three key takeaways:

  1. HR plays a key but often underused role in internal investigations.
  2. The Board of Directors and senior management have different roles.
  3. Use your legal department to protect the privilege.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no Selection of investigative counsel Dan Dunne, in a Compliance and Ethics Professional article, entitled “Foxes and henhouses: The importance of independent counsel”, discussed what he termed a “critical element” in any investigation, which he denominated as “fair and objective evaluation.” Dunne wrote that a key component of this fair and objective evaluation is the Who question; that is, who should supervise the investigation and who should handle the investigation? Dunne’s clear conclusion is that independent counsel should handle any serious investigation. There are three reasons for a company to retain independent counsel for internal investigations of serious whistleblower complaints. First, André Agassi was right, perception is reality. Secondly, if regular outside counsel investigates their own prior legal work or legal advice, a very large and potentially messy number of loyalty and privilege issues can arise in the internal investigation. The third reason is the relationship of the regular outside counsel or law firm with regulatory authorities. If a company’s regular outside counsel performs the internal investigation and the results turn out favorably for the company, the regulators may ask if the investigation was a whitewash or at the very least, less than robust. If the SEC or DOJ cannot rely on a company’s own internal investigation, it may perform the investigation all over again with its own personnel. Further, these regulators may believe that the company, and its law firm, has engaged in a cover-up. This is certainly not the way to buy credibility. Three key takeaways: Serious allegations demand a serious response, with seriously good lawyers leading the investigation. The biggest thing that any person or company brings to the table when sitting across from the DOJ or SEC is credibility. Use of regular corporate counsel can negatively impact your investigation because of the issues of loyalty and privilege. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 12 Jun 2020 17:00:00 -0000 Selection of investigative counsel full Thomas Fox How should you think through the hiring of investigative counsel? Find out on this episode of 31 Days to a More Effective Compliance Program. Dan Dunne, in a Compliance and Ethics Professional article, entitled “Foxes and henhouses: The importance of independent counsel”, discussed what he termed a “critical element” in any investigation, which he denominated as “fair and objective evaluation.” Dunne wrote that a key component of this fair and objective evaluation is the Who question; that is, who should supervise the investigation and who should handle the investigation? Dunne’s clear conclusion is that independent counsel should handle any serious investigation. There are three reasons for a company to retain independent counsel for internal investigations of serious whistleblower complaints. First, André Agassi was right, perception is reality. Secondly, if regular outside counsel investigates their own prior legal work or legal advice, a very large and potentially messy number of loyalty and privilege issues can arise in the internal investigation. The third reason is the relationship of the regular outside counsel or law firm with regulatory authorities. If a company’s regular outside counsel performs the internal investigation and the results turn out favorably for the company, the regulators may ask if the investigation was a whitewash or at the very least, less than robust. If the SEC or DOJ cannot rely on a company’s own internal investigation, it may perform the investigation all over again with its own personnel. Further, these regulators may believe that the company, and its law firm, has engaged in a cover-up. This is certainly not the way to buy credibility. Three key takeaways: Serious allegations demand a serious response, with seriously good lawyers leading the investigation. The biggest thing that any person or company brings to the table when sitting across from the DOJ or SEC is credibility. Use of regular corporate counsel can negatively impact your investigation because of the issues of loyalty and privilege. Learn more about your ad choices. Visit megaphone.fm/adchoices Dan Dunne, in a Compliance and Ethics Professional article, entitled “Foxes and henhouses: The importance of independent counsel”, discussed what he termed a “critical element” in any investigation, which he denominated as “fair and objective evaluation.” Dunne wrote that a key component of this fair and objective evaluation is the Who question; that is, who should supervise the investigation and who should handle the investigation? Dunne’s clear conclusion is that independent counsel should handle any serious investigation.

There are three reasons for a company to retain independent counsel for internal investigations of serious whistleblower complaints. First, André Agassi was right, perception is reality. Secondly, if regular outside counsel investigates their own prior legal work or legal advice, a very large and potentially messy number of loyalty and privilege issues can arise in the internal investigation. The third reason is the relationship of the regular outside counsel or law firm with regulatory authorities. If a company’s regular outside counsel performs the internal investigation and the results turn out favorably for the company, the regulators may ask if the investigation was a whitewash or at the very least, less than robust. If the SEC or DOJ cannot rely on a company’s own internal investigation, it may perform the investigation all over again with its own personnel. Further, these regulators may believe that the company, and its law firm, has engaged in a cover-up. This is certainly not the way to buy credibility.

Three key takeaways:

  1. Serious allegations demand a serious response, with seriously good lawyers leading the investigation.
  2. The biggest thing that any person or company brings to the table when sitting across from the DOJ or SEC is credibility.
  3. Use of regular corporate counsel can negatively impact your investigation because of the issues of loyalty and privilege.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no Preparing for the investigation Under Part 1, Section D. Confidential Reporting Structure and Investigation Process, it stated in part, Properly Scoped Investigation by Qualified Personnel –What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct an investigation, and who makes that determination? These questions were presaged by the DOJ’s 2015 Yates Memo and the 2016 FCPA Pilot Program. The pressure on every CCO, and indeed company, to get an investigation done quickly, efficiently and, most importantly, right is even greater now.  Jonathan Marks began by cautioning that when considering any well run internal investigation, a CCO must be cognizant of the strictures laid out in the Evaluation. It all begins with who in-house is looking at the complaint and does the CCO, compliance practitioner or legal team have the skills and capabilities to handle the matter which has arisen? Obviously if there are esoteric accounting issues or significant internal control work-arounds and overrides, a CCO may not have those skills to really understand all the issues. Similarly, if the matter is a global FCPA or equivalent bribery and corruption matter, Marks related, these “come in different flavors, and because they come in different flavors you may not have the skills or capabilities to do an investigation that would take place in say Brazil or Russia or China or India.” Three key takeaways: Always remember your ultimate audience may be the government. You must understand both the business environment and extended business enterprise. Communication and collaboration in any investigation are critical so you should begin early and continue to do so throughout the investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 11 Jun 2020 17:00:00 -0000 Preparing for the investigation full Thomas Fox How should you prepare for an investigation? Find out the steps to take in this episode of 31 Days to a More Effective Compliance Program. Under Part 1, Section D. Confidential Reporting Structure and Investigation Process, it stated in part, Properly Scoped Investigation by Qualified Personnel –What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct an investigation, and who makes that determination? These questions were presaged by the DOJ’s 2015 Yates Memo and the 2016 FCPA Pilot Program. The pressure on every CCO, and indeed company, to get an investigation done quickly, efficiently and, most importantly, right is even greater now.  Jonathan Marks began by cautioning that when considering any well run internal investigation, a CCO must be cognizant of the strictures laid out in the Evaluation. It all begins with who in-house is looking at the complaint and does the CCO, compliance practitioner or legal team have the skills and capabilities to handle the matter which has arisen? Obviously if there are esoteric accounting issues or significant internal control work-arounds and overrides, a CCO may not have those skills to really understand all the issues. Similarly, if the matter is a global FCPA or equivalent bribery and corruption matter, Marks related, these “come in different flavors, and because they come in different flavors you may not have the skills or capabilities to do an investigation that would take place in say Brazil or Russia or China or India.” Three key takeaways: Always remember your ultimate audience may be the government. You must understand both the business environment and extended business enterprise. Communication and collaboration in any investigation are critical so you should begin early and continue to do so throughout the investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Under Part 1, Section D. Confidential Reporting Structure and Investigation Process, it stated in part, Properly Scoped Investigation by Qualified Personnel –What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct an investigation, and who makes that determination? These questions were presaged by the DOJ’s 2015 Yates Memo and the 2016 FCPA Pilot Program. The pressure on every CCO, and indeed company, to get an investigation done quickly, efficiently and, most importantly, right is even greater now. 

Jonathan Marks began by cautioning that when considering any well run internal investigation, a CCO must be cognizant of the strictures laid out in the Evaluation. It all begins with who in-house is looking at the complaint and does the CCO, compliance practitioner or legal team have the skills and capabilities to handle the matter which has arisen? Obviously if there are esoteric accounting issues or significant internal control work-arounds and overrides, a CCO may not have those skills to really understand all the issues. Similarly, if the matter is a global FCPA or equivalent bribery and corruption matter, Marks related, these “come in different flavors, and because they come in different flavors you may not have the skills or capabilities to do an investigation that would take place in say Brazil or Russia or China or India.”

Three key takeaways:

  1. Always remember your ultimate audience may be the government.
  2. You must understand both the business environment and extended business enterprise.
  3. Communication and collaboration in any investigation are critical so you should begin early and continue to do so throughout the investigation.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no The Investigation protocol Under Part 1, Section D. Confidential Reporting Structure and Investigation Process, it stated in part, Properly Scoped Investigation by Qualified Personnel –What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? Your company should have a detailed written procedure for handling any complaint or allegation of bribery or corruption, regardless of the means through which it is communicated. The mechanism could include the internal company hotline, anonymous tips, or a report directly from the business unit involved. You can make the decision on whether or not to investigate with consultation with other groups such as the Compliance Committee of the Board of Directors or the Legal Department. The head of the business unit in which the claim arose may also be notified that an allegation has been made and that the Compliance Department will be handling the matter on a go-forward basis. Through the use of such a detailed written procedure, you can work to ensure there is complete transparency on the rights and obligations of all parties once an allegation is made. This allows compliance to have not only the flexibility but also the responsibility to deal with such matters, from which it can best assess and then decide on how to manage the matter. Three key takeaways: A written protocol, created before an investigation, is a key starting point. Create specific steps to follow so there will be full transparency and documentation going forward. Consistency in approach is critical. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 10 Jun 2020 17:00:00 -0000 The Investigation protocol full Thomas Fox What is your investigation protocol? Find out why you need one in 31 Days to a More Effective Compliance Program. Under Part 1, Section D. Confidential Reporting Structure and Investigation Process, it stated in part, Properly Scoped Investigation by Qualified Personnel –What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? Your company should have a detailed written procedure for handling any complaint or allegation of bribery or corruption, regardless of the means through which it is communicated. The mechanism could include the internal company hotline, anonymous tips, or a report directly from the business unit involved. You can make the decision on whether or not to investigate with consultation with other groups such as the Compliance Committee of the Board of Directors or the Legal Department. The head of the business unit in which the claim arose may also be notified that an allegation has been made and that the Compliance Department will be handling the matter on a go-forward basis. Through the use of such a detailed written procedure, you can work to ensure there is complete transparency on the rights and obligations of all parties once an allegation is made. This allows compliance to have not only the flexibility but also the responsibility to deal with such matters, from which it can best assess and then decide on how to manage the matter. Three key takeaways: A written protocol, created before an investigation, is a key starting point. Create specific steps to follow so there will be full transparency and documentation going forward. Consistency in approach is critical. Learn more about your ad choices. Visit megaphone.fm/adchoices Under Part 1, Section D. Confidential Reporting Structure and Investigation Process, it stated in part, Properly Scoped Investigation by Qualified Personnel –What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? Your company should have a detailed written procedure for handling any complaint or allegation of bribery or corruption, regardless of the means through which it is communicated. The mechanism could include the internal company hotline, anonymous tips, or a report directly from the business unit involved.

You can make the decision on whether or not to investigate with consultation with other groups such as the Compliance Committee of the Board of Directors or the Legal Department. The head of the business unit in which the claim arose may also be notified that an allegation has been made and that the Compliance Department will be handling the matter on a go-forward basis. Through the use of such a detailed written procedure, you can work to ensure there is complete transparency on the rights and obligations of all parties once an allegation is made. This allows compliance to have not only the flexibility but also the responsibility to deal with such matters, from which it can best assess and then decide on how to manage the matter.

Three key takeaways:

  1. A written protocol, created before an investigation, is a key starting point.
  2. Create specific steps to follow so there will be full transparency and documentation going forward.
  3. Consistency in approach is critical.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Triage of Internally Reported Allegations One of the things that I learned from the television series M*A*S*H was the need for triage. In the hospital setting, triage is the process of determining the priority of patients’ treatments based on the severity of their condition. In the 2012 FCPA Guidance, there is a short but succinct statement, “once an allegation is made, companies should have in place an efficient, reliable, and properly funded process for investigating the allegation and documenting the company’s response, including any disciplinary or remediation measures taken.” This is considered in more expansive language in the 2020 Update to the Evaluation of Corporate Compliance Programs. Under Part 1, Section D. Confidential Reporting Structure and Investigation Process, it stated in part, Properly Scoped Investigation by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation?  Appropriate triage of allegations has several different impacts for any matter which comes to the attention of compliance. Obviously, it will help you to initially determine the seriousness of the matter. From there you can allocate an appropriate level of resources. It will also aid in your discussion with the DOJ if you must go that route. Finally, in the situation where facts come in, it provides the required documented evidence that a process was followed that you can show the government that a claim was properly scoped, as required under the Evaluation. But the key is to be prepared, not only in terms of having your investigation and notification protocols in place before an allegation comes in but also doing the proper triage so that you have an initial understanding of what you may be facing. Three key takeaways: Compliance can learn from M*A*S*H about the need for triage. Initial triage allows you to separate the wheat of serious allegations from the chaff of more inconsequential allegations. A robust triage process allows for greater credibility with government regulators. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 09 Jun 2020 17:00:00 -0000 Triage of Internally Reported Allegations full Thomas Fox Why is the triage of internal reports so critical? Find out on this episode of 31 Days to a More Effective Compliance Program. One of the things that I learned from the television series M*A*S*H was the need for triage. In the hospital setting, triage is the process of determining the priority of patients’ treatments based on the severity of their condition. In the 2012 FCPA Guidance, there is a short but succinct statement, “once an allegation is made, companies should have in place an efficient, reliable, and properly funded process for investigating the allegation and documenting the company’s response, including any disciplinary or remediation measures taken.” This is considered in more expansive language in the 2020 Update to the Evaluation of Corporate Compliance Programs. Under Part 1, Section D. Confidential Reporting Structure and Investigation Process, it stated in part, Properly Scoped Investigation by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation?  Appropriate triage of allegations has several different impacts for any matter which comes to the attention of compliance. Obviously, it will help you to initially determine the seriousness of the matter. From there you can allocate an appropriate level of resources. It will also aid in your discussion with the DOJ if you must go that route. Finally, in the situation where facts come in, it provides the required documented evidence that a process was followed that you can show the government that a claim was properly scoped, as required under the Evaluation. But the key is to be prepared, not only in terms of having your investigation and notification protocols in place before an allegation comes in but also doing the proper triage so that you have an initial understanding of what you may be facing. Three key takeaways: Compliance can learn from M*A*S*H about the need for triage. Initial triage allows you to separate the wheat of serious allegations from the chaff of more inconsequential allegations. A robust triage process allows for greater credibility with government regulators. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the things that I learned from the television series M*A*S*H was the need for triage. In the hospital setting, triage is the process of determining the priority of patients’ treatments based on the severity of their condition. In the 2012 FCPA Guidance, there is a short but succinct statement, “once an allegation is made, companies should have in place an efficient, reliable, and properly funded process for investigating the allegation and documenting the company’s response, including any disciplinary or remediation measures taken.” This is considered in more expansive language in the 2020 Update to the Evaluation of Corporate Compliance Programs. Under Part 1, Section D. Confidential Reporting Structure and Investigation Process, it stated in part, Properly Scoped Investigation by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation? 

Appropriate triage of allegations has several different impacts for any matter which comes to the attention of compliance. Obviously, it will help you to initially determine the seriousness of the matter. From there you can allocate an appropriate level of resources. It will also aid in your discussion with the DOJ if you must go that route. Finally, in the situation where facts come in, it provides the required documented evidence that a process was followed that you can show the government that a claim was properly scoped, as required under the Evaluation. But the key is to be prepared, not only in terms of having your investigation and notification protocols in place before an allegation comes in but also doing the proper triage so that you have an initial understanding of what you may be facing.

Three key takeaways:

  1. Compliance can learn from M*A*S*H about the need for triage.
  2. Initial triage allows you to separate the wheat of serious allegations from the chaff of more inconsequential allegations.
  3. A robust triage process allows for greater credibility with government regulators.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Internal Reporting and Whistleblowers During Layoffs In Houston, we have experienced energy companies laying off upwards of 30% of their workforce, both in the US and abroad. Employment separations can be one of the trickiest maneuvers to manage in the spectrum of the employment relationship. Even when an employee is aware layoffs are coming it can still be quite a shock when Human Resources (HR) shows up at their door and says, “Come with me.” However, layoffs, massive or otherwise, can present some unique challenges for the FCPA compliance practitioner. Employees can use layoffs to claim that they were retaliated against for a wide variety of complaints, including those for concerns that impact the compliance practitioner. Yet there are several actions you can take to protect your company as much as possible. The reason for these actions are to allow you to demonstrate that any laid off employee was not separated because of a hotline or whistleblower allegation but due to your overall layoff scheme. However it could be that you may need this person to provide your compliance department additional information, to be a resource to you going forward, or even a witness that you can reasonably anticipate the government may want to interview. If any of these situations exist, if you do not plan for their eventuality before you layoff the employee, said (now) ex-employee may not be inclined to cooperate with you going forward. Also if you do demonstrate that you are sincerely interested in a meritorious hotline complaint, it may keep this person from becoming a SEC whistleblower. Three Key Takeaways An employment separation is a critical time if an internal report has been made. Have appropriate language in your separation agreement. Treat terminated employees with dignity and respect. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 08 Jun 2020 17:00:00 -0000 Internal Reporting and Whistleblowers During Layoffs full Thomas Fox How should you handle whistleblowers during a time of employee layoffs? Find out on this episode of 31 Days to a More Effective Compliance Program In Houston, we have experienced energy companies laying off upwards of 30% of their workforce, both in the US and abroad. Employment separations can be one of the trickiest maneuvers to manage in the spectrum of the employment relationship. Even when an employee is aware layoffs are coming it can still be quite a shock when Human Resources (HR) shows up at their door and says, “Come with me.” However, layoffs, massive or otherwise, can present some unique challenges for the FCPA compliance practitioner. Employees can use layoffs to claim that they were retaliated against for a wide variety of complaints, including those for concerns that impact the compliance practitioner. Yet there are several actions you can take to protect your company as much as possible. The reason for these actions are to allow you to demonstrate that any laid off employee was not separated because of a hotline or whistleblower allegation but due to your overall layoff scheme. However it could be that you may need this person to provide your compliance department additional information, to be a resource to you going forward, or even a witness that you can reasonably anticipate the government may want to interview. If any of these situations exist, if you do not plan for their eventuality before you layoff the employee, said (now) ex-employee may not be inclined to cooperate with you going forward. Also if you do demonstrate that you are sincerely interested in a meritorious hotline complaint, it may keep this person from becoming a SEC whistleblower. Three Key Takeaways An employment separation is a critical time if an internal report has been made. Have appropriate language in your separation agreement. Treat terminated employees with dignity and respect. Learn more about your ad choices. Visit megaphone.fm/adchoices In Houston, we have experienced energy companies laying off upwards of 30% of their workforce, both in the US and abroad. Employment separations can be one of the trickiest maneuvers to manage in the spectrum of the employment relationship. Even when an employee is aware layoffs are coming it can still be quite a shock when Human Resources (HR) shows up at their door and says, “Come with me.” However, layoffs, massive or otherwise, can present some unique challenges for the FCPA compliance practitioner. Employees can use layoffs to claim that they were retaliated against for a wide variety of complaints, including those for concerns that impact the compliance practitioner. Yet there are several actions you can take to protect your company as much as possible.

The reason for these actions are to allow you to demonstrate that any laid off employee was not separated because of a hotline or whistleblower allegation but due to your overall layoff scheme. However it could be that you may need this person to provide your compliance department additional information, to be a resource to you going forward, or even a witness that you can reasonably anticipate the government may want to interview. If any of these situations exist, if you do not plan for their eventuality before you layoff the employee, said (now) ex-employee may not be inclined to cooperate with you going forward. Also if you do demonstrate that you are sincerely interested in a meritorious hotline complaint, it may keep this person from becoming a SEC whistleblower.

Three Key Takeaways

  1. An employment separation is a critical time if an internal report has been made.
  2. Have appropriate language in your separation agreement.
  3. Treat terminated employees with dignity and respect.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Answering DOJ Questions on Confidential Reporting What are some best practices regarding an internal reporting system? The 2012 FCPA Guidance stated, “An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation.”  This was expanded in the DOJ’s 2020 Guidance, in the section entitled “D. Confidential Reporting Structure and Investigation Process”, with the following language, “Another hallmark of a well-designed compliance program is the existence of an efficient and trusted mechanism by which employees can anonymously or confidentially report allegations of a breach of the company’s code of conduct, company policies, or suspected or actual misconduct. Prosecutors should assess whether the company’s complaint-handling process includes pro-active measures to create a workplace atmosphere without fear of retaliation, appropriate processes for the submission of complaints, and processes to protect whistleblowers.” Three Key Takeaways Internal reporting systems are a clear indicia of a working, operationalized compliance program. There must be a solid line of communication between the people who are doing the investigation and the people leading the remediation. Your internal reporting mechanism must be trusted. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 05 Jun 2020 17:00:00 -0000 Answering DOJ Questions on Confidential Reporting full Thomas Fox In its Evaluation of Corporate Compliance Programs, the DOJ poses a series of questions. How can you answer them regarding confidential reporting? Find out on this episode of 31 Days to a More Effective Compliance Program. What are some best practices regarding an internal reporting system? The 2012 FCPA Guidance stated, “An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation.”  This was expanded in the DOJ’s 2020 Guidance, in the section entitled “D. Confidential Reporting Structure and Investigation Process”, with the following language, “Another hallmark of a well-designed compliance program is the existence of an efficient and trusted mechanism by which employees can anonymously or confidentially report allegations of a breach of the company’s code of conduct, company policies, or suspected or actual misconduct. Prosecutors should assess whether the company’s complaint-handling process includes pro-active measures to create a workplace atmosphere without fear of retaliation, appropriate processes for the submission of complaints, and processes to protect whistleblowers.” Three Key Takeaways Internal reporting systems are a clear indicia of a working, operationalized compliance program. There must be a solid line of communication between the people who are doing the investigation and the people leading the remediation. Your internal reporting mechanism must be trusted. Learn more about your ad choices. Visit megaphone.fm/adchoices What are some best practices regarding an internal reporting system? The 2012 FCPA Guidance stated, “An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation.” 

This was expanded in the DOJ’s 2020 Guidance, in the section entitled “D. Confidential Reporting Structure and Investigation Process”, with the following language, “Another hallmark of a well-designed compliance program is the existence of an efficient and trusted mechanism by which employees can anonymously or confidentially report allegations of a breach of the company’s code of conduct, company policies, or suspected or actual misconduct. Prosecutors should assess whether the company’s complaint-handling process includes pro-active measures to create a workplace atmosphere without fear of retaliation, appropriate processes for the submission of complaints, and processes to protect whistleblowers.”

Three Key Takeaways

  1. Internal reporting systems are a clear indicia of a working, operationalized compliance program.
  2. There must be a solid line of communication between the people who are doing the investigation and the people leading the remediation.
  3. Your internal reporting mechanism must be trusted.



Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Internal Reporting System Best Practices What are some best practices regarding an internal reporting system? The 2012 FCPA Guidance stated, “An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation.” The 2019 Guidance further refined this basic requirement for a hotline with inquiries into the effectiveness of your corporate hotline, asking, “Effectiveness of the Reporting Mechanism – Does the company have an anonymous reporting mechanism, and, if not, why not? How is the reporting mechanism publicized to the company’s employees? Has it been used? How has the company assessed the seriousness of the allegations it received? Has the compliance function had full access to reporting and investigative information?” In this podcast, we detail some of the key best practices.  Three key takeaways: Get the word out to your employees about your company hotline through a variety of mediums and platforms. Train your employees on the use of the hotline. Use data from your hotline to continually update and improve your compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 04 Jun 2020 17:00:00 -0000 Internal Reporting System Best Practices full Thomas Fox What are some of the best practices for an internal reporting system? Find out in today's episode of 31 Days to a More Effective Compliance Program. What are some best practices regarding an internal reporting system? The 2012 FCPA Guidance stated, “An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation.” The 2019 Guidance further refined this basic requirement for a hotline with inquiries into the effectiveness of your corporate hotline, asking, “Effectiveness of the Reporting Mechanism – Does the company have an anonymous reporting mechanism, and, if not, why not? How is the reporting mechanism publicized to the company’s employees? Has it been used? How has the company assessed the seriousness of the allegations it received? Has the compliance function had full access to reporting and investigative information?” In this podcast, we detail some of the key best practices.  Three key takeaways: Get the word out to your employees about your company hotline through a variety of mediums and platforms. Train your employees on the use of the hotline. Use data from your hotline to continually update and improve your compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices What are some best practices regarding an internal reporting system? The 2012 FCPA Guidance stated, “An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation.” The 2019 Guidance further refined this basic requirement for a hotline with inquiries into the effectiveness of your corporate hotline, asking, “Effectiveness of the Reporting Mechanism – Does the company have an anonymous reporting mechanism, and, if not, why not? How is the reporting mechanism publicized to the company’s employees? Has it been used? How has the company assessed the seriousness of the allegations it received? Has the compliance function had full access to reporting and investigative information?” In this podcast, we detail some of the key best practices. 

Three key takeaways:

  1. Get the word out to your employees about your company hotline through a variety of mediums and platforms.
  2. Train your employees on the use of the hotline.
  3. Use data from your hotline to continually update and improve your compliance program.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Specific benefits of a reporting system-a case study Is your hotline working for you? In an article, entitled “Promoting Effective Use of the Company Compliance Hotline”, José Tabuena provided an excellent example of the power of a hotline. He provided a case study of a company which had not integrated its IT function into its regular compliance and ethics training programs. As such there were zero calls into the hotline by IT employees. This dynamic was changed and IT was integrated into the company’s regular compliance and ethics training. Thereafter, the hotline received several calls from IT employees indicating where there were two major areas of complaints. The first area regarded family members who were hired and perceptions of favoritism. The second related to allegations that certain managers were manipulating data to maximize their bonuses. This case study demonstrates the power of a hotline. The company’s Compliance Department “established the credibility of the helpline as a resource to raise issues and report misconduct. The concerns regarding nepotism and conflicts of interest were taken seriously, and although the  violations were not as widespread as the calls indicated, the review went a long way to clear the air.” Equally important, the helpline proved to be a successful management tool as well. The company was able to manage potential compliance issues and improve employee morale.  Three key takeaways: Hotlines can be powerful tools for the compliance professional. Simply because you have no hotline complaints does not mean you do not have any compliance or ethics issues which need review and resolution. Adequate follow up is a key part of overall hotline effectiveness. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 03 Jun 2020 17:00:00 -0000 Specific benefits of a reporting system-a case study full Thomas Fox What were the benefits of an internal reporting system for one company? We explore in today's episode of 31 Days to a More Effective Compliance Program. Is your hotline working for you? In an article, entitled “Promoting Effective Use of the Company Compliance Hotline”, José Tabuena provided an excellent example of the power of a hotline. He provided a case study of a company which had not integrated its IT function into its regular compliance and ethics training programs. As such there were zero calls into the hotline by IT employees. This dynamic was changed and IT was integrated into the company’s regular compliance and ethics training. Thereafter, the hotline received several calls from IT employees indicating where there were two major areas of complaints. The first area regarded family members who were hired and perceptions of favoritism. The second related to allegations that certain managers were manipulating data to maximize their bonuses. This case study demonstrates the power of a hotline. The company’s Compliance Department “established the credibility of the helpline as a resource to raise issues and report misconduct. The concerns regarding nepotism and conflicts of interest were taken seriously, and although the  violations were not as widespread as the calls indicated, the review went a long way to clear the air.” Equally important, the helpline proved to be a successful management tool as well. The company was able to manage potential compliance issues and improve employee morale.  Three key takeaways: Hotlines can be powerful tools for the compliance professional. Simply because you have no hotline complaints does not mean you do not have any compliance or ethics issues which need review and resolution. Adequate follow up is a key part of overall hotline effectiveness. Learn more about your ad choices. Visit megaphone.fm/adchoices Is your hotline working for you? In an article, entitled “Promoting Effective Use of the Company Compliance Hotline”, José Tabuena provided an excellent example of the power of a hotline. He provided a case study of a company which had not integrated its IT function into its regular compliance and ethics training programs. As such there were zero calls into the hotline by IT employees. This dynamic was changed and IT was integrated into the company’s regular compliance and ethics training. Thereafter, the hotline received several calls from IT employees indicating where there were two major areas of complaints. The first area regarded family members who were hired and perceptions of favoritism. The second related to allegations that certain managers were manipulating data to maximize their bonuses.

This case study demonstrates the power of a hotline. The company’s Compliance Department “established the credibility of the helpline as a resource to raise issues and report misconduct. The concerns regarding nepotism and conflicts of interest were taken seriously, and although the  violations were not as widespread as the calls indicated, the review went a long way to clear the air.” Equally important, the helpline proved to be a successful management tool as well. The company was able to manage potential compliance issues and improve employee morale. 

Three key takeaways:

  1. Hotlines can be powerful tools for the compliance professional.
  2. Simply because you have no hotline complaints does not mean you do not have any compliance or ethics issues which need review and resolution.
  3. Adequate follow up is a key part of overall hotline effectiveness.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Advantages of an Internal Reporting System While it is clear that the government expects companies to have an internal reporting system, there are benefits far beyond putting you in the government’s good graces. Companies with a more robust internal reporting system generated more reports. Dr. Welch found a group of companies he termed “power users”, which were high level users of whistleblower reporting systems who had more activity than the average entity. These “power user” companies have several interesting characteristics. First they are typically firms with a higher quality earnings reporting. They are more profitable entities. Finally, these “power user” companies were firms with higher quality governance, as rated by the Entrenchment Index which is used measure how entrenched management is in a company.   Conversely, companies which were observed to be a more limited user of whistleblower reporting systems are companies that were seen to have poor governance. They are more prone to financial accounting issues, such as discretionary accruals, which could prove problematic. These tend to be smaller and less mature firms. Their overall compliance programs were generally not seen as robust or as effective as those in larger, more mature organizations. Finally, these firms, probably because they were smaller and less mature, are more prone to extreme growth and the problems associated with trying to scale up quickly. All of this points to one unmistakable conclusion, a robust whistleblower reporting system facilitates a company’s resolution of problems before they become major problems or legal violations bringing the Securities and Exchange Commission (SEC) or DOJ calling. Three Key Takeaways Companies with a robust whistleblower and reporting system had greater profitability and workforce productivity as measured by Return on Assets. There were fewer material lawsuits brought against the company overall and there were lower settlement costs if a lawsuit did occur. There were fewer external whistleblower reports to regulatory agencies and other authorities. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 02 Jun 2020 17:00:00 -0000 Advantages of an Internal Reporting System full Thomas Fox There are numerous advantages in an internal reporting system. In today's episode of 31 Day's to a More Effective Compliance Program, I lay some of the key reasons out for you. While it is clear that the government expects companies to have an internal reporting system, there are benefits far beyond putting you in the government’s good graces. Companies with a more robust internal reporting system generated more reports. Dr. Welch found a group of companies he termed “power users”, which were high level users of whistleblower reporting systems who had more activity than the average entity. These “power user” companies have several interesting characteristics. First they are typically firms with a higher quality earnings reporting. They are more profitable entities. Finally, these “power user” companies were firms with higher quality governance, as rated by the Entrenchment Index which is used measure how entrenched management is in a company.   Conversely, companies which were observed to be a more limited user of whistleblower reporting systems are companies that were seen to have poor governance. They are more prone to financial accounting issues, such as discretionary accruals, which could prove problematic. These tend to be smaller and less mature firms. Their overall compliance programs were generally not seen as robust or as effective as those in larger, more mature organizations. Finally, these firms, probably because they were smaller and less mature, are more prone to extreme growth and the problems associated with trying to scale up quickly. All of this points to one unmistakable conclusion, a robust whistleblower reporting system facilitates a company’s resolution of problems before they become major problems or legal violations bringing the Securities and Exchange Commission (SEC) or DOJ calling. Three Key Takeaways Companies with a robust whistleblower and reporting system had greater profitability and workforce productivity as measured by Return on Assets. There were fewer material lawsuits brought against the company overall and there were lower settlement costs if a lawsuit did occur. There were fewer external whistleblower reports to regulatory agencies and other authorities. Learn more about your ad choices. Visit megaphone.fm/adchoices While it is clear that the government expects companies to have an internal reporting system, there are benefits far beyond putting you in the government’s good graces. Companies with a more robust internal reporting system generated more reports. Dr. Welch found a group of companies he termed “power users”, which were high level users of whistleblower reporting systems who had more activity than the average entity. These “power user” companies have several interesting characteristics. First they are typically firms with a higher quality earnings reporting. They are more profitable entities. Finally, these “power user” companies were firms with higher quality governance, as rated by the Entrenchment Index which is used measure how entrenched management is in a company.  

Conversely, companies which were observed to be a more limited user of whistleblower reporting systems are companies that were seen to have poor governance. They are more prone to financial accounting issues, such as discretionary accruals, which could prove problematic. These tend to be smaller and less mature firms. Their overall compliance programs were generally not seen as robust or as effective as those in larger, more mature organizations. Finally, these firms, probably because they were smaller and less mature, are more prone to extreme growth and the problems associated with trying to scale up quickly.

All of this points to one unmistakable conclusion, a robust whistleblower reporting system facilitates a company’s resolution of problems before they become major problems or legal violations bringing the Securities and Exchange Commission (SEC) or DOJ calling.

Three Key Takeaways

  1. Companies with a robust whistleblower and reporting system had greater profitability and workforce productivity as measured by Return on Assets.
  2. There were fewer material lawsuits brought against the company overall and there were lower settlement costs if a lawsuit did occur.
  3. There were fewer external whistleblower reports to regulatory agencies and other authorities.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Introduction to internal reporting and investigations The call, email or tip comes into your office; an employee reports suspicious activity somewhere across the globe. That activity might well turn into a FCPA issue for your company. As the CCO, it will be up to you to begin the process which will determine, in many instances, how the company will respond. This chapter will provide you with the steps you will need to consider going forward. This chapter will detail the two parts; internal reporting and investigations. It would seem axiomatic that organizations understand the benefits of having an internal reporting system, whether it is called a hotline, helpline or something else. Just as plainly, a company should understand the need for effective investigations after a report comes in which might lead to a potential violation. Three key takeaways: A robust internal reporting system will be one of the key indicia the DOJ considers. Hotline reporting can bring a visibility to problems. Hotline reports must be treated fairly and justly. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 01 Jun 2020 17:00:00 -0000 Introduction to internal reporting and investigations full Thomas Fox Join me for the month of June as I explore internal reporting systems, hotlines and internal investigations. All on 31 Days to a More Effective Compliance Program. The call, email or tip comes into your office; an employee reports suspicious activity somewhere across the globe. That activity might well turn into a FCPA issue for your company. As the CCO, it will be up to you to begin the process which will determine, in many instances, how the company will respond. This chapter will provide you with the steps you will need to consider going forward. This chapter will detail the two parts; internal reporting and investigations. It would seem axiomatic that organizations understand the benefits of having an internal reporting system, whether it is called a hotline, helpline or something else. Just as plainly, a company should understand the need for effective investigations after a report comes in which might lead to a potential violation. Three key takeaways: A robust internal reporting system will be one of the key indicia the DOJ considers. Hotline reporting can bring a visibility to problems. Hotline reports must be treated fairly and justly. Learn more about your ad choices. Visit megaphone.fm/adchoices The call, email or tip comes into your office; an employee reports suspicious activity somewhere across the globe. That activity might well turn into a FCPA issue for your company. As the CCO, it will be up to you to begin the process which will determine, in many instances, how the company will respond. This chapter will provide you with the steps you will need to consider going forward.

This chapter will detail the two parts; internal reporting and investigations. It would seem axiomatic that organizations understand the benefits of having an internal reporting system, whether it is called a hotline, helpline or something else. Just as plainly, a company should understand the need for effective investigations after a report comes in which might lead to a potential violation.

Three key takeaways:

  1. A robust internal reporting system will be one of the key indicia the DOJ considers.
  2. Hotline reporting can bring a visibility to problems.
  3. Hotline reports must be treated fairly and justly.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Polices on extortion payments The next area for policies is extortion payments, which not are made illegal under the FCPA. Extortion payments are made for any action which threatens or demands payment for life, liberty, or health. These should be exempted out from your facilitation payments and your compliance program through specific language. You need to do this for a variety of reasons. First and foremost, your employees must understand that the company will support them if they are in any way threatened with harm, with arrest or physical detention, their health/safety is threatened. As a compliance professional, you need to make sure they understand they need to do whatever they have to do to get themselves out of such a situation.  Some of the situations your employees might face are along the lines of the following: Employees are stopped by police, military or paramilitary personnel, or militia (uniformed or not) at designated or other checkpoints or other places and a payment is demanded as a condition of passage of persons or property; Employees are stopped at the airport by customs or passport control personnel or military personnel and a payment is demanded for entry or exit of persons or property; or Employees are asked by persons claiming to be security personnel, immigration control, or health inspectors to pay for an allegedly required inoculation or other similar procedure. The key though is that it be properly documented. But more than simply the documentation is that you must specifically list extortion payments in your books and records, so you will not be suspected with hiding them by describing them as something else. The key is to train your employees specifically on the actions to take. In your policy state that if there is a threat to health, safety or liberty, it is not a facilitation payment but an extortion payment. Make sure that they understand what their rights are and what their obligations are to report it when they come back to the corporate office or their office. Always remember, an extortion payment is not a FCPA violation. Three key takeaways: Extortion payments are not illegal under the FCPA. Was the action an extortion or some other type of situation? “Document, Document, and Document” your extortion payments, both the financial component and a description of the underlying events. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 29 May 2020 17:00:00 -0000 Polices on extortion payments full Thomas Fox What are extortion payments? What does the FCPA say about them? Find out on this episode of 31 Days to a More Effective Compliance Program. The next area for policies is extortion payments, which not are made illegal under the FCPA. Extortion payments are made for any action which threatens or demands payment for life, liberty, or health. These should be exempted out from your facilitation payments and your compliance program through specific language. You need to do this for a variety of reasons. First and foremost, your employees must understand that the company will support them if they are in any way threatened with harm, with arrest or physical detention, their health/safety is threatened. As a compliance professional, you need to make sure they understand they need to do whatever they have to do to get themselves out of such a situation.  Some of the situations your employees might face are along the lines of the following: Employees are stopped by police, military or paramilitary personnel, or militia (uniformed or not) at designated or other checkpoints or other places and a payment is demanded as a condition of passage of persons or property; Employees are stopped at the airport by customs or passport control personnel or military personnel and a payment is demanded for entry or exit of persons or property; or Employees are asked by persons claiming to be security personnel, immigration control, or health inspectors to pay for an allegedly required inoculation or other similar procedure. The key though is that it be properly documented. But more than simply the documentation is that you must specifically list extortion payments in your books and records, so you will not be suspected with hiding them by describing them as something else. The key is to train your employees specifically on the actions to take. In your policy state that if there is a threat to health, safety or liberty, it is not a facilitation payment but an extortion payment. Make sure that they understand what their rights are and what their obligations are to report it when they come back to the corporate office or their office. Always remember, an extortion payment is not a FCPA violation. Three key takeaways: Extortion payments are not illegal under the FCPA. Was the action an extortion or some other type of situation? “Document, Document, and Document” your extortion payments, both the financial component and a description of the underlying events. Learn more about your ad choices. Visit megaphone.fm/adchoices The next area for policies is extortion payments, which not are made illegal under the FCPA. Extortion payments are made for any action which threatens or demands payment for life, liberty, or health. These should be exempted out from your facilitation payments and your compliance program through specific language. You need to do this for a variety of reasons. First and foremost, your employees must understand that the company will support them if they are in any way threatened with harm, with arrest or physical detention, their health/safety is threatened. As a compliance professional, you need to make sure they understand they need to do whatever they have to do to get themselves out of such a situation.

 Some of the situations your employees might face are along the lines of the following:

  • Employees are stopped by police, military or paramilitary personnel, or militia (uniformed or not) at designated or other checkpoints or other places and a payment is demanded as a condition of passage of persons or property;
  • Employees are stopped at the airport by customs or passport control personnel or military personnel and a payment is demanded for entry or exit of persons or property; or
  • Employees are asked by persons claiming to be security personnel, immigration control, or health inspectors to pay for an allegedly required inoculation or other similar procedure.

The key though is that it be properly documented. But more than simply the documentation is that you must specifically list extortion payments in your books and records, so you will not be suspected with hiding them by describing them as something else. The key is to train your employees specifically on the actions to take. In your policy state that if there is a threat to health, safety or liberty, it is not a facilitation payment but an extortion payment. Make sure that they understand what their rights are and what their obligations are to report it when they come back to the corporate office or their office. Always remember, an extortion payment is not a FCPA violation.

Three key takeaways:

  1. Extortion payments are not illegal under the FCPA.
  2. Was the action an extortion or some other type of situation?
  3. “Document, Document, and Document” your extortion payments, both the financial component and a description of the underlying events.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Policies for third-parties As every compliance practitioner is well aware, third-parties still present the highest risk under the FCPA. The DOJ 2019 Guidance devotes an entire prong to third-party management. It begins with the following: A well-designed compliance program should apply risk-based due diligence to its third-party relationships. Although the degree of appropriate due diligence may vary based on the size and nature of the company or transaction, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions. This set of queries clearly specifies the DOJ expects an integrated approach that is operationalized throughout the company. This means your compliance program must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party management: 1) business justification; 2) questionnaire to third-party; 3) due diligence on third-party; 4) compliance terms and conditions, including payment terms; and 5) management and oversight of third parties after contract signing. I continually give my mantra of compliance, which is “Document, Document, and Document”. Each of the steps you take in the management of your third parties must be documented. Not only must they be documented but they must be stored and managed in a manner that you can retrieve them with relative ease. The management of third parties is absolutely critical in any best practices compliance program. Three key takeaways: Use the full five-step process for third-party management. Make sure you have Business Development involvement and buy-in. Operationalize all steps going forward by including business unit representatives. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 28 May 2020 17:00:00 -0000 Policies for third-parties full Thomas Fox What should be in your policies for third parties? Find out on this episode of 31 Days to a More Effective Compliance Program. As every compliance practitioner is well aware, third-parties still present the highest risk under the FCPA. The DOJ 2019 Guidance devotes an entire prong to third-party management. It begins with the following: A well-designed compliance program should apply risk-based due diligence to its third-party relationships. Although the degree of appropriate due diligence may vary based on the size and nature of the company or transaction, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions. This set of queries clearly specifies the DOJ expects an integrated approach that is operationalized throughout the company. This means your compliance program must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party management: 1) business justification; 2) questionnaire to third-party; 3) due diligence on third-party; 4) compliance terms and conditions, including payment terms; and 5) management and oversight of third parties after contract signing. I continually give my mantra of compliance, which is “Document, Document, and Document”. Each of the steps you take in the management of your third parties must be documented. Not only must they be documented but they must be stored and managed in a manner that you can retrieve them with relative ease. The management of third parties is absolutely critical in any best practices compliance program. Three key takeaways: Use the full five-step process for third-party management. Make sure you have Business Development involvement and buy-in. Operationalize all steps going forward by including business unit representatives. Learn more about your ad choices. Visit megaphone.fm/adchoices As every compliance practitioner is well aware, third-parties still present the highest risk under the FCPA. The DOJ 2019 Guidance devotes an entire prong to third-party management. It begins with the following: A well-designed compliance program should apply risk-based due diligence to its third-party relationships. Although the degree of appropriate due diligence may vary based on the size and nature of the company or transaction, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.

This set of queries clearly specifies the DOJ expects an integrated approach that is operationalized throughout the company. This means your compliance program must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party management: 1) business justification; 2) questionnaire to third-party; 3) due diligence on third-party; 4) compliance terms and conditions, including payment terms; and 5) management and oversight of third parties after contract signing.

I continually give my mantra of compliance, which is “Document, Document, and Document”. Each of the steps you take in the management of your third parties must be documented. Not only must they be documented but they must be stored and managed in a manner that you can retrieve them with relative ease. The management of third parties is absolutely critical in any best practices compliance program.

Three key takeaways:

  1. Use the full five-step process for third-party management.
  2. Make sure you have Business Development involvement and buy-in.
  3. Operationalize all steps going forward by including business unit representatives.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Policies on Facilitation Payments From the information provided by the DOJ in Opinion Releases and in enforcement actions, there are several different insights which may be drawn on regarding what should go into your policy on facilitation payments. Do not forget that facilitation payments must be accurately shown on the books and records of your company. In all cases the employee who requested permission to make the facilitation payment must be responsible for obtaining all required approvals and forwarding a copy of the approvals and any other relevant supporting documentation as required, so that the it is recorded as a facilitation expense in the books and records and maintained in a central file. Facilitation payments should not be recorded as consulting fees, entertainment expenses, or other types of expenses that may misrepresent the true nature of the payments.  There may be emergency situations when it will be difficult or impossible for employees to obtain approvals before having to decide whether or not to pay a facilitation payment. If the facilitation payment is made in an emergency, the employee reports the facilitating payment to the compliance department and explains the emergency as soon as practical after making the facilitation payment. Three key takeaways: What was the amount of the facilitation payment? Was the action truly routine? How high up was the government official who received the facilitation payment? Was his or her decision discretionary? Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 27 May 2020 17:00:00 -0000 Policies on Facilitation Payments full Thomas Fox What should be in your policies around facilitation payments? Find out in today's episode of 31 Days to a More Effective Compliance Program. From the information provided by the DOJ in Opinion Releases and in enforcement actions, there are several different insights which may be drawn on regarding what should go into your policy on facilitation payments. Do not forget that facilitation payments must be accurately shown on the books and records of your company. In all cases the employee who requested permission to make the facilitation payment must be responsible for obtaining all required approvals and forwarding a copy of the approvals and any other relevant supporting documentation as required, so that the it is recorded as a facilitation expense in the books and records and maintained in a central file. Facilitation payments should not be recorded as consulting fees, entertainment expenses, or other types of expenses that may misrepresent the true nature of the payments.  There may be emergency situations when it will be difficult or impossible for employees to obtain approvals before having to decide whether or not to pay a facilitation payment. If the facilitation payment is made in an emergency, the employee reports the facilitating payment to the compliance department and explains the emergency as soon as practical after making the facilitation payment. Three key takeaways: What was the amount of the facilitation payment? Was the action truly routine? How high up was the government official who received the facilitation payment? Was his or her decision discretionary? Learn more about your ad choices. Visit megaphone.fm/adchoices From the information provided by the DOJ in Opinion Releases and in enforcement actions, there are several different insights which may be drawn on regarding what should go into your policy on facilitation payments. Do not forget that facilitation payments must be accurately shown on the books and records of your company. In all cases the employee who requested permission to make the facilitation payment must be responsible for obtaining all required approvals and forwarding a copy of the approvals and any other relevant supporting documentation as required, so that the it is recorded as a facilitation expense in the books and records and maintained in a central file. Facilitation payments should not be recorded as consulting fees, entertainment expenses, or other types of expenses that may misrepresent the true nature of the payments.

 There may be emergency situations when it will be difficult or impossible for employees to obtain approvals before having to decide whether or not to pay a facilitation payment. If the facilitation payment is made in an emergency, the employee reports the facilitating payment to the compliance department and explains the emergency as soon as practical after making the facilitation payment.

Three key takeaways:

  1. What was the amount of the facilitation payment?
  2. Was the action truly routine?
  3. How high up was the government official who received the facilitation payment? Was his or her decision discretionary?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Enforcement Actions Featuring Facilitation Payments One of the more confusing areas of the FCPA is in that of facilitation payments. Facilitation payments are small bribes but make no mistake about it, they are bribes. For that reason, many companies feel they are inconsistent with a company culture of doing business ethically and in compliance with laws prohibiting corruption and bribery. Further, the 2012 FCPA Guidance specifies, “while the payment may qualify as an exception to the FCPA’s anti-bribery provisions, it may violate other laws, both in Foreign Country and elsewhere. In addition, if the payment is not accurately recorded, it could violate the FCPA’s books and records provision.” Additionally, the 2012 FCPA Guidance states, “Whether a payment falls within the exception is not dependent on the size of the payment, though size can be telling, as a large payment is more suggestive of corrupt intent to influence a non-routine governmental action. But, like the FCPA’s anti-bribery provisions more generally, the facilitating payments exception focuses on the purpose of the payment rather than its value.” In addition to these clear statements about whether the FCPA should continue to allow said bribes; you should also consider the administrative nightmare for any international company. The U.K. Bribery Act does not have any such exception, exemption or defense along the lines of the FCPA facilitation payment exception. This means that even if your company allows facilitation payments, it must exempt out every U.K. Company or subsidiary from the policy. Further, if your company employs any U.K. citizens, they are subject to the U.K. Bribery Act no matter who they work for and where they may work in the world, so they must also be exempted. Finally, if your U.S. Company does business with a U.K. or other company subject to the U.K. Bribery Act, you may be prevented contractually from making facilitation payments while working under that customer’s contract. As I said, an administrative nightmare. Three key takeaways: Do not forget the administrative nightmare of facilitation payments for international organizations. The Kay decision made clear how narrow the “routine government action” exception is. Facilitation payments will usually be an add-on as they are symptomatic of an ineffective compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 26 May 2020 17:00:00 -0000 Enforcement Actions Featuring Facilitation Payments full Thomas Fox What are some of the key FCPA enforcement actions involving facilitation payments? Find out in today's episode of 31 Days to a More Effective Compliance Program. One of the more confusing areas of the FCPA is in that of facilitation payments. Facilitation payments are small bribes but make no mistake about it, they are bribes. For that reason, many companies feel they are inconsistent with a company culture of doing business ethically and in compliance with laws prohibiting corruption and bribery. Further, the 2012 FCPA Guidance specifies, “while the payment may qualify as an exception to the FCPA’s anti-bribery provisions, it may violate other laws, both in Foreign Country and elsewhere. In addition, if the payment is not accurately recorded, it could violate the FCPA’s books and records provision.” Additionally, the 2012 FCPA Guidance states, “Whether a payment falls within the exception is not dependent on the size of the payment, though size can be telling, as a large payment is more suggestive of corrupt intent to influence a non-routine governmental action. But, like the FCPA’s anti-bribery provisions more generally, the facilitating payments exception focuses on the purpose of the payment rather than its value.” In addition to these clear statements about whether the FCPA should continue to allow said bribes; you should also consider the administrative nightmare for any international company. The U.K. Bribery Act does not have any such exception, exemption or defense along the lines of the FCPA facilitation payment exception. This means that even if your company allows facilitation payments, it must exempt out every U.K. Company or subsidiary from the policy. Further, if your company employs any U.K. citizens, they are subject to the U.K. Bribery Act no matter who they work for and where they may work in the world, so they must also be exempted. Finally, if your U.S. Company does business with a U.K. or other company subject to the U.K. Bribery Act, you may be prevented contractually from making facilitation payments while working under that customer’s contract. As I said, an administrative nightmare. Three key takeaways: Do not forget the administrative nightmare of facilitation payments for international organizations. The Kay decision made clear how narrow the “routine government action” exception is. Facilitation payments will usually be an add-on as they are symptomatic of an ineffective compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the more confusing areas of the FCPA is in that of facilitation payments. Facilitation payments are small bribes but make no mistake about it, they are bribes. For that reason, many companies feel they are inconsistent with a company culture of doing business ethically and in compliance with laws prohibiting corruption and bribery. Further, the 2012 FCPA Guidance specifies, “while the payment may qualify as an exception to the FCPA’s anti-bribery provisions, it may violate other laws, both in Foreign Country and elsewhere. In addition, if the payment is not accurately recorded, it could violate the FCPA’s books and records provision.” Additionally, the 2012 FCPA Guidance states, “Whether a payment falls within the exception is not dependent on the size of the payment, though size can be telling, as a large payment is more suggestive of corrupt intent to influence a non-routine governmental action. But, like the FCPA’s anti-bribery provisions more generally, the facilitating payments exception focuses on the purpose of the payment rather than its value.”

In addition to these clear statements about whether the FCPA should continue to allow said bribes; you should also consider the administrative nightmare for any international company. The U.K. Bribery Act does not have any such exception, exemption or defense along the lines of the FCPA facilitation payment exception. This means that even if your company allows facilitation payments, it must exempt out every U.K. Company or subsidiary from the policy. Further, if your company employs any U.K. citizens, they are subject to the U.K. Bribery Act no matter who they work for and where they may work in the world, so they must also be exempted. Finally, if your U.S. Company does business with a U.K. or other company subject to the U.K. Bribery Act, you may be prevented contractually from making facilitation payments while working under that customer’s contract. As I said, an administrative nightmare.

Three key takeaways:

  1. Do not forget the administrative nightmare of facilitation payments for international organizations.
  2. The Kay decision made clear how narrow the “routine government action” exception is.
  3. Facilitation payments will usually be an add-on as they are symptomatic of an ineffective compliance program.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no The Problem with Facilitation Payments The original version of the Foreign Corrupt Practices Act (FCPA), enacted in 1977, contained an exception for payments made to non-US officials who performed duties that were “essentially ministerial or clerical”. In 1988 Congress responded by amending the FCPA under the Omnibus Trade and Competitiveness Act to clarify the scope of the FCPA’s prohibitions on bribery, including the scope of permitted facilitation payments. An expanded definition of “routine governmental action” was included in the final version of the bill, reflecting the intent of Congress that the exceptions apply only to the performance of duties listed in the subcategories of the statute and actions of a similar nature. Congress also meant to make clear that “ordinarily and commonly performed actions”, with respect to permits or licenses, would not include those governmental approvals involving an exercise of discretion by a government official where the actions are the functional equivalent of “obtaining or retaining business for, or with, or directing business to, any person.” Three key takeaways: Many companies still struggle with facilitation payments. What are the five listed purposes for facilitation payments? The facilitation payment exception is narrowly construed by both the courts and the Justice Department. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 22 May 2020 17:00:00 -0000 The Problem with Facilitation Payments full Thomas Fox What are some of the key problems with facilitation payments? Find out in this episode of 31 Days to a More Effective Compliance Program. The original version of the Foreign Corrupt Practices Act (FCPA), enacted in 1977, contained an exception for payments made to non-US officials who performed duties that were “essentially ministerial or clerical”. In 1988 Congress responded by amending the FCPA under the Omnibus Trade and Competitiveness Act to clarify the scope of the FCPA’s prohibitions on bribery, including the scope of permitted facilitation payments. An expanded definition of “routine governmental action” was included in the final version of the bill, reflecting the intent of Congress that the exceptions apply only to the performance of duties listed in the subcategories of the statute and actions of a similar nature. Congress also meant to make clear that “ordinarily and commonly performed actions”, with respect to permits or licenses, would not include those governmental approvals involving an exercise of discretion by a government official where the actions are the functional equivalent of “obtaining or retaining business for, or with, or directing business to, any person.” Three key takeaways: Many companies still struggle with facilitation payments. What are the five listed purposes for facilitation payments? The facilitation payment exception is narrowly construed by both the courts and the Justice Department. Learn more about your ad choices. Visit megaphone.fm/adchoices The original version of the Foreign Corrupt Practices Act (FCPA), enacted in 1977, contained an exception for payments made to non-US officials who performed duties that were “essentially ministerial or clerical”. In 1988 Congress responded by amending the FCPA under the Omnibus Trade and Competitiveness Act to clarify the scope of the FCPA’s prohibitions on bribery, including the scope of permitted facilitation payments. An expanded definition of “routine governmental action” was included in the final version of the bill, reflecting the intent of Congress that the exceptions apply only to the performance of duties listed in the subcategories of the statute and actions of a similar nature. Congress also meant to make clear that “ordinarily and commonly performed actions”, with respect to permits or licenses, would not include those governmental approvals involving an exercise of discretion by a government official where the actions are the functional equivalent of “obtaining or retaining business for, or with, or directing business to, any person.”

Three key takeaways:

  1. Many companies still struggle with facilitation payments.
  2. What are the five listed purposes for facilitation payments?
  3. The facilitation payment exception is narrowly construed by both the courts and the Justice Department.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Policies on Political Contributions The FCPA states, “The FCPA’s anti-bribery provisions apply to corrupt payments made to (1) “any foreign official”; (2) “any foreign political party or official thereof”; (3) “any candidate for foreign political office”; or (4) any person, while knowing that all or a portion of the payment will be offered, given, or promised to an individual falling within one of these three categories. Although the statute distinguishes between a “foreign official,” “foreign political party or official thereof,” and “candidate for foreign political office,” the term “foreign official” in this guide generally refers to an individual falling within any of these three categories.” Government policies affect the commercial environment. A company is subject to legislation and regulation that affects how it conducts its business and generates value for its investors. Participating in the political process is part of a business strategy to protect a company’s interests. Most international businesses have strategy to engage in the political process with a view to the long-term interests of the company and to promote and protect its interests. All political contributions and expenditures on behalf of the Company and management reports on these political contributions and expenditures should be reported to the Board of Directors annually. No political contributions may be made or promised unless written pre-approval has been obtained from the corporate compliance function Three key takeaways: Political candidates are covered by the FCPA. What is the business purpose for the contribution? Do not make contributions towards candidates who can award your company business.   Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 21 May 2020 17:00:00 -0000 Policies on Political Contributions full Thomas Fox What should be in your policy on political contributions? Find out in today's episode of 31 Days to a More Effective Compliance Program. The FCPA states, “The FCPA’s anti-bribery provisions apply to corrupt payments made to (1) “any foreign official”; (2) “any foreign political party or official thereof”; (3) “any candidate for foreign political office”; or (4) any person, while knowing that all or a portion of the payment will be offered, given, or promised to an individual falling within one of these three categories. Although the statute distinguishes between a “foreign official,” “foreign political party or official thereof,” and “candidate for foreign political office,” the term “foreign official” in this guide generally refers to an individual falling within any of these three categories.” Government policies affect the commercial environment. A company is subject to legislation and regulation that affects how it conducts its business and generates value for its investors. Participating in the political process is part of a business strategy to protect a company’s interests. Most international businesses have strategy to engage in the political process with a view to the long-term interests of the company and to promote and protect its interests. All political contributions and expenditures on behalf of the Company and management reports on these political contributions and expenditures should be reported to the Board of Directors annually. No political contributions may be made or promised unless written pre-approval has been obtained from the corporate compliance function Three key takeaways: Political candidates are covered by the FCPA. What is the business purpose for the contribution? Do not make contributions towards candidates who can award your company business.   Learn more about your ad choices. Visit megaphone.fm/adchoices The FCPA states, “The FCPA’s anti-bribery provisions apply to corrupt payments made to (1) “any foreign official”; (2) “any foreign political party or official thereof”; (3) “any candidate for foreign political office”; or (4) any person, while knowing that all or a portion of the payment will be offered, given, or promised to an individual falling within one of these three categories. Although the statute distinguishes between a “foreign official,” “foreign political party or official thereof,” and “candidate for foreign political office,” the term “foreign official” in this guide generally refers to an individual falling within any of these three categories.” Government policies affect the commercial environment. A company is subject to legislation and regulation that affects how it conducts its business and generates value for its investors. Participating in the political process is part of a business strategy to protect a company’s interests.

Most international businesses have strategy to engage in the political process with a view to the long-term interests of the company and to promote and protect its interests. All political contributions and expenditures on behalf of the Company and management reports on these political contributions and expenditures should be reported to the Board of Directors annually. No political contributions may be made or promised unless written pre-approval has been obtained from the corporate compliance function

Three key takeaways:

  1. Political candidates are covered by the FCPA.
  2. What is the business purpose for the contribution?
  3. Do not make contributions towards candidates who can award your company business.

 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Policies and Procedures on Charitable Donations What should your compliance policy and procedures on charitable donations look like? What should you prohibit or even caution against? The starting point is the 2012 FCPA Guidance regarding charitable donations. The information on the red flags from the Opinion Releases and the best practices, as set out in the 2012 FCPA Guidance, have been available for some time. From the Schering-Plough and Lilly enforcement actions, your policy should consider the timing of charitable donations to see if they are at or near the time of the awarding of new or continued business. Finally, in managing the relationship, you now need to look at overall increases in sales to determine if they are tied to a pattern of charitable donations. By looking at the timing and quantum of charitable donations, internal audit may be able to ascertain that a spike in sales is tied to corrupt conduct. Three key takeaways: What are the basic inquiries to make around charitable donations? Use all of the communication tools the DOJ has provided; written guidance, enforcement actions and Opinion Releases to inform your charitable donation policy. “Document, Document, and Document” the basis of your charitable donations risk assessment. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 20 May 2020 17:00:00 -0000 Policies and Procedures on Charitable Donations full Thomas Fox What should be included in your policies and procedures for charitable donations? Find out in today's 31 Days to More Effective Compliance Program. What should your compliance policy and procedures on charitable donations look like? What should you prohibit or even caution against? The starting point is the 2012 FCPA Guidance regarding charitable donations. The information on the red flags from the Opinion Releases and the best practices, as set out in the 2012 FCPA Guidance, have been available for some time. From the Schering-Plough and Lilly enforcement actions, your policy should consider the timing of charitable donations to see if they are at or near the time of the awarding of new or continued business. Finally, in managing the relationship, you now need to look at overall increases in sales to determine if they are tied to a pattern of charitable donations. By looking at the timing and quantum of charitable donations, internal audit may be able to ascertain that a spike in sales is tied to corrupt conduct. Three key takeaways: What are the basic inquiries to make around charitable donations? Use all of the communication tools the DOJ has provided; written guidance, enforcement actions and Opinion Releases to inform your charitable donation policy. “Document, Document, and Document” the basis of your charitable donations risk assessment. Learn more about your ad choices. Visit megaphone.fm/adchoices What should your compliance policy and procedures on charitable donations look like? What should you prohibit or even caution against? The starting point is the 2012 FCPA Guidance regarding charitable donations. The information on the red flags from the Opinion Releases and the best practices, as set out in the 2012 FCPA Guidance, have been available for some time. From the Schering-Plough and Lilly enforcement actions, your policy should consider the timing of charitable donations to see if they are at or near the time of the awarding of new or continued business. Finally, in managing the relationship, you now need to look at overall increases in sales to determine if they are tied to a pattern of charitable donations. By looking at the timing and quantum of charitable donations, internal audit may be able to ascertain that a spike in sales is tied to corrupt conduct.

Three key takeaways:

  1. What are the basic inquiries to make around charitable donations?
  2. Use all of the communication tools the DOJ has provided; written guidance, enforcement actions and Opinion Releases to inform your charitable donation policy.
  3. “Document, Document, and Document” the basis of your charitable donations risk assessment.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Opinion Release guidance on charitable donations Opinion Releases can provide valuable information for the compliance practitioner. I agree with the statement found in the 2012 FCPA Guidance that “DOJ’s opinion procedure is a valuable mechanism for companies and individuals to determine whether proposed conduct would be prosecuted by DOJ under the FCPA. Generally speaking, under the opinion procedure process, parties submit information to DOJ, after which DOJ issues an opinion about whether the proposed conduct falls within its enforcement policy.” In the areas of charitable donations, the DOJ has provided four Opinion Releases which give solid guidance on this tricky issue under the FCPA. In each Opinion Release, the DOJ indicated that it would not initiate prosecutions based upon the fact scenarios presented to it. Three key takeaways: You can utilize the Opinion Release process for a wide variety of issue. You must manage your charitable donations program even after the money has been donated. Never forget the Mendelsohn common sense approach to charitable donations. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 19 May 2020 17:00:00 -0000 Opinion Release guidance on charitable donations full Thomas Fox Opinion Releases can provide valuable information for the compliance practitioner. Find out more in this episode of 31 Days to a More Effective Compliance Program. Opinion Releases can provide valuable information for the compliance practitioner. I agree with the statement found in the 2012 FCPA Guidance that “DOJ’s opinion procedure is a valuable mechanism for companies and individuals to determine whether proposed conduct would be prosecuted by DOJ under the FCPA. Generally speaking, under the opinion procedure process, parties submit information to DOJ, after which DOJ issues an opinion about whether the proposed conduct falls within its enforcement policy.” In the areas of charitable donations, the DOJ has provided four Opinion Releases which give solid guidance on this tricky issue under the FCPA. In each Opinion Release, the DOJ indicated that it would not initiate prosecutions based upon the fact scenarios presented to it. Three key takeaways: You can utilize the Opinion Release process for a wide variety of issue. You must manage your charitable donations program even after the money has been donated. Never forget the Mendelsohn common sense approach to charitable donations. Learn more about your ad choices. Visit megaphone.fm/adchoices Opinion Releases can provide valuable information for the compliance practitioner. I agree with the statement found in the 2012 FCPA Guidance that “DOJ’s opinion procedure is a valuable mechanism for companies and individuals to determine whether proposed conduct would be prosecuted by DOJ under the FCPA. Generally speaking, under the opinion procedure process, parties submit information to DOJ, after which DOJ issues an opinion about whether the proposed conduct falls within its enforcement policy.”

In the areas of charitable donations, the DOJ has provided four Opinion Releases which give solid guidance on this tricky issue under the FCPA. In each Opinion Release, the DOJ indicated that it would not initiate prosecutions based upon the fact scenarios presented to it.

Three key takeaways:

  1. You can utilize the Opinion Release process for a wide variety of issue.
  2. You must manage your charitable donations program even after the money has been donated.
  3. Never forget the Mendelsohn common sense approach to charitable donations.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Charitable donation enforcement actions When is a rose not a rose? When it is a charitable donation not made for philanthropic purposes and violates the FCPA. This was a feature of the Eli Lilly and Company (Lilly) FCPA enforcement action brought by the SEC in 2012, involving a bribery scheme utilized by Lilly in Poland. The scheme and FCPA violations mirrored an earlier FCPA enforcement action, also brought by the SEC as a civil matter, rather than by the DOJ as a criminal matter, against another U.S. entity Schering-Plough, for making charitable donations in Poland which violated the FCPA. One of the remarkable things about both of these enforcement actions, brought almost eight years apart, was that they involved improper payments to the same Polish charitable foundation to wrongfully influence the same Polish government official to purchase products from both of these companies.  Three key takeaways: Every compliance practitioner should study both the Lilly and Schering-Plough enforcement actions. What is the purpose of the charitable entity you are making a donation to? “Document, Document, and Document” your due diligence around donors. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 18 May 2020 14:56:27 -0000 Charitable donation enforcement actions full Thomas Fox When is a rose not a rose? When it is a charitable donation not made for philanthropic purposes and violates the FCPA. Find out more in today's episode of 31 Days to a More Effective Compliance Program. When is a rose not a rose? When it is a charitable donation not made for philanthropic purposes and violates the FCPA. This was a feature of the Eli Lilly and Company (Lilly) FCPA enforcement action brought by the SEC in 2012, involving a bribery scheme utilized by Lilly in Poland. The scheme and FCPA violations mirrored an earlier FCPA enforcement action, also brought by the SEC as a civil matter, rather than by the DOJ as a criminal matter, against another U.S. entity Schering-Plough, for making charitable donations in Poland which violated the FCPA. One of the remarkable things about both of these enforcement actions, brought almost eight years apart, was that they involved improper payments to the same Polish charitable foundation to wrongfully influence the same Polish government official to purchase products from both of these companies.  Three key takeaways: Every compliance practitioner should study both the Lilly and Schering-Plough enforcement actions. What is the purpose of the charitable entity you are making a donation to? “Document, Document, and Document” your due diligence around donors. Learn more about your ad choices. Visit megaphone.fm/adchoices When is a rose not a rose? When it is a charitable donation not made for philanthropic purposes and violates the FCPA. This was a feature of the Eli Lilly and Company (Lilly) FCPA enforcement action brought by the SEC in 2012, involving a bribery scheme utilized by Lilly in Poland. The scheme and FCPA violations mirrored an earlier FCPA enforcement action, also brought by the SEC as a civil matter, rather than by the DOJ as a criminal matter, against another U.S. entity Schering-Plough, for making charitable donations in Poland which violated the FCPA. One of the remarkable things about both of these enforcement actions, brought almost eight years apart, was that they involved improper payments to the same Polish charitable foundation to wrongfully influence the same Polish government official to purchase products from both of these companies.

 Three key takeaways:

  1. Every compliance practitioner should study both the Lilly and Schering-Plough enforcement actions.
  2. What is the purpose of the charitable entity you are making a donation to?
  3. “Document, Document, and Document” your due diligence around donors.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Policies on Travel Prior to the 2012 FCPA Guidance, the DOJ issued two 2007 Opinion Releases which offered guidance to companies considering whether, and if so how, to incur travel and lodging expenses for government officials. Both Opinion Releases laid out the specific representations made to the DOJ, which led to them to approve the travel to the U.S. by foreign governmental officials. These facts provided strong guidance to any company which seeks to bring such governmental officials to the U.S. for a legitimate business purpose. In Opinion Release 07-01, the company was desired to cover the domestic expenses for a trip to the U.S. for a six-person delegation of the government of an Asian country for an educational and promotional tour of one of the requestor’s U.S. operations sites. In 07-02, the Company desired to pay certain domestic expenses for a trip within the U.S. by approximately six junior to mid-level officials of a foreign government for an educational program at the Requestor’s US headquarters, prior to the delegates attendance at an annual six-week long internship program for foreign insurance regulators sponsored by the National Association of Insurance Commissioners (NAIC). When Walmart Inc., Hewlett-Packard Company (HP) or GSK are in the news for alleged FCPA violations, it provides you a good reminder to review your compliance program. Not only from your compliance procedures perspective, but to test to determine if the policies and procedures are being followed or if there are issues which you might need to look at more closely. Three key takeaways: Travel for foreign officials continues to plague companies for compliance violations. The key is being reasonable in your costs. Always remember to record travel expenses correctly based upon documented costs. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 15 May 2020 17:00:00 -0000 Policies and Procedures on Travel full 11 Thomas Fox What are your compliance policies around travel? Find out how to think through this issue on this episode of 31 Days to a More Effective Compliance Program. Prior to the 2012 FCPA Guidance, the DOJ issued two 2007 Opinion Releases which offered guidance to companies considering whether, and if so how, to incur travel and lodging expenses for government officials. Both Opinion Releases laid out the specific representations made to the DOJ, which led to them to approve the travel to the U.S. by foreign governmental officials. These facts provided strong guidance to any company which seeks to bring such governmental officials to the U.S. for a legitimate business purpose. In Opinion Release 07-01, the company was desired to cover the domestic expenses for a trip to the U.S. for a six-person delegation of the government of an Asian country for an educational and promotional tour of one of the requestor’s U.S. operations sites. In 07-02, the Company desired to pay certain domestic expenses for a trip within the U.S. by approximately six junior to mid-level officials of a foreign government for an educational program at the Requestor’s US headquarters, prior to the delegates attendance at an annual six-week long internship program for foreign insurance regulators sponsored by the National Association of Insurance Commissioners (NAIC). When Walmart Inc., Hewlett-Packard Company (HP) or GSK are in the news for alleged FCPA violations, it provides you a good reminder to review your compliance program. Not only from your compliance procedures perspective, but to test to determine if the policies and procedures are being followed or if there are issues which you might need to look at more closely. Three key takeaways: Travel for foreign officials continues to plague companies for compliance violations. The key is being reasonable in your costs. Always remember to record travel expenses correctly based upon documented costs. Learn more about your ad choices. Visit megaphone.fm/adchoices Prior to the 2012 FCPA Guidance, the DOJ issued two 2007 Opinion Releases which offered guidance to companies considering whether, and if so how, to incur travel and lodging expenses for government officials. Both Opinion Releases laid out the specific representations made to the DOJ, which led to them to approve the travel to the U.S. by foreign governmental officials. These facts provided strong guidance to any company which seeks to bring such governmental officials to the U.S. for a legitimate business purpose. In Opinion Release 07-01, the company was desired to cover the domestic expenses for a trip to the U.S. for a six-person delegation of the government of an Asian country for an educational and promotional tour of one of the requestor’s U.S. operations sites. In 07-02, the Company desired to pay certain domestic expenses for a trip within the U.S. by approximately six junior to mid-level officials of a foreign government for an educational program at the Requestor’s US headquarters, prior to the delegates attendance at an annual six-week long internship program for foreign insurance regulators sponsored by the National Association of Insurance Commissioners (NAIC).

When Walmart Inc., Hewlett-Packard Company (HP) or GSK are in the news for alleged FCPA violations, it provides you a good reminder to review your compliance program. Not only from your compliance procedures perspective, but to test to determine if the policies and procedures are being followed or if there are issues which you might need to look at more closely.

Three key takeaways:

  1. Travel for foreign officials continues to plague companies for compliance violations.
  2. The key is being reasonable in your costs.
  3. Always remember to record travel expenses correctly based upon documented costs.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 Policies and procedures on gifts and business entertainment If one were to reflect upon the providing of gifts and business entertainment to foreign governmental officials, one might reasonably conclude that after 40 years of the FCPA, companies might follow its prescriptions regarding gifts and business entertainment. However, there have been some notable FCPA enforcement actions in this area.  The 2012 FCPA Guidance clearly stated the FCPA does not ban gifts and entertainment. Indeed, it specified, “A small gift or token of esteem or gratitude is often an appropriate way for business people to display respect for each other. Some hallmarks of appropriate gift-giving are when the gift is given openly and transparently, properly recorded in the giver’s books and records, provided only to reflect esteem or gratitude, and permitted under local law. Items of nominal value, such as cab fare, reasonable meals and entertainment expenses, or company promotional items, are unlikely to improperly influence an official, and, as a result, are not, without more, items that have resulted in enforcement action by DOJ or SEC.” These guidelines must be coupled with active training of all personnel, not only on a company’s compliance policy, but also on the corporate and individual consequences that may arise if the FCPA is violated regarding gifts and business entertainment. Lastly, it is imperative that all such gifts and business entertainment be properly recorded, as required by the books and records component of the FCPA. And, as always, do not forget the gut check test. Three key takeaways: Gifts and business entertainment continue to plague companies for compliance violations. The key is not the amount but of having a policy and procedure and following it. Always remember to record gifts and business entertainment expenses correctly. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 14 May 2020 17:00:00 -0000 Policies and procedures on gifts and business entertainment full Thomas Fox What should be your policies around gifts and business entertainment? Find out in today's episode of 31 Days to a More Effective Compliance Program. If one were to reflect upon the providing of gifts and business entertainment to foreign governmental officials, one might reasonably conclude that after 40 years of the FCPA, companies might follow its prescriptions regarding gifts and business entertainment. However, there have been some notable FCPA enforcement actions in this area.  The 2012 FCPA Guidance clearly stated the FCPA does not ban gifts and entertainment. Indeed, it specified, “A small gift or token of esteem or gratitude is often an appropriate way for business people to display respect for each other. Some hallmarks of appropriate gift-giving are when the gift is given openly and transparently, properly recorded in the giver’s books and records, provided only to reflect esteem or gratitude, and permitted under local law. Items of nominal value, such as cab fare, reasonable meals and entertainment expenses, or company promotional items, are unlikely to improperly influence an official, and, as a result, are not, without more, items that have resulted in enforcement action by DOJ or SEC.” These guidelines must be coupled with active training of all personnel, not only on a company’s compliance policy, but also on the corporate and individual consequences that may arise if the FCPA is violated regarding gifts and business entertainment. Lastly, it is imperative that all such gifts and business entertainment be properly recorded, as required by the books and records component of the FCPA. And, as always, do not forget the gut check test. Three key takeaways: Gifts and business entertainment continue to plague companies for compliance violations. The key is not the amount but of having a policy and procedure and following it. Always remember to record gifts and business entertainment expenses correctly. Learn more about your ad choices. Visit megaphone.fm/adchoices If one were to reflect upon the providing of gifts and business entertainment to foreign governmental officials, one might reasonably conclude that after 40 years of the FCPA, companies might follow its prescriptions regarding gifts and business entertainment. However, there have been some notable FCPA enforcement actions in this area.

 The 2012 FCPA Guidance clearly stated the FCPA does not ban gifts and entertainment. Indeed, it specified, “A small gift or token of esteem or gratitude is often an appropriate way for business people to display respect for each other. Some hallmarks of appropriate gift-giving are when the gift is given openly and transparently, properly recorded in the giver’s books and records, provided only to reflect esteem or gratitude, and permitted under local law. Items of nominal value, such as cab fare, reasonable meals and entertainment expenses, or company promotional items, are unlikely to improperly influence an official, and, as a result, are not, without more, items that have resulted in enforcement action by DOJ or SEC.”

These guidelines must be coupled with active training of all personnel, not only on a company’s compliance policy, but also on the corporate and individual consequences that may arise if the FCPA is violated regarding gifts and business entertainment. Lastly, it is imperative that all such gifts and business entertainment be properly recorded, as required by the books and records component of the FCPA.

And, as always, do not forget the gut check test.

Three key takeaways:

  1. Gifts and business entertainment continue to plague companies for compliance violations.
  2. The key is not the amount but of having a policy and procedure and following it.
  3. Always remember to record gifts and business entertainment expenses correctly.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 Revising your policies and procedures Simply having a Code of Conduct, together with compliance policies and procedures is not enough. As articulated by former Assistant Attorney General Lanny Breuer, “Your compliance program is a living entity; it should be constantly evolving.” The 2012 FCPA Guidance stated, “When assessing a compliance program, DOJ and SEC will review whether the company Guiding Principles of Enforcement has taken steps to make certain that the Code of Conduct remains current and effective and whether a company has periodically reviewed and updated its code.” After considering these issues, you should benchmark your current policies and procedures against other companies in your industry. If you decide to move forward, I suggest a process which can be fully documented as a basis to include revisions to your compliance policies and procedures. These points are a useful guide to not only thinking through how to determine if your policies and procedures need updating, but also practical steps on how to tackle the problem. If it has been more than five years since the last updates, you should begin the process now. It is far better to review and update if appropriate than wait for a massive FCPA investigation to go through the process. Three key takeaways: If you have not revised your compliance policies and procedures in the past five years, you should do so now Set a timeline and budget and stick to it in the compliance policy and procedure revision process. Document your process of revision to demonstrate more complete operationalization of your compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 13 May 2020 17:00:00 -0000 Revising your policies and procedures full 9 Thomas Fox How should you consider revising your policies and procedures? Find out in this episode of 31 Days to a More Effective Compliance Program. Simply having a Code of Conduct, together with compliance policies and procedures is not enough. As articulated by former Assistant Attorney General Lanny Breuer, “Your compliance program is a living entity; it should be constantly evolving.” The 2012 FCPA Guidance stated, “When assessing a compliance program, DOJ and SEC will review whether the company Guiding Principles of Enforcement has taken steps to make certain that the Code of Conduct remains current and effective and whether a company has periodically reviewed and updated its code.” After considering these issues, you should benchmark your current policies and procedures against other companies in your industry. If you decide to move forward, I suggest a process which can be fully documented as a basis to include revisions to your compliance policies and procedures. These points are a useful guide to not only thinking through how to determine if your policies and procedures need updating, but also practical steps on how to tackle the problem. If it has been more than five years since the last updates, you should begin the process now. It is far better to review and update if appropriate than wait for a massive FCPA investigation to go through the process. Three key takeaways: If you have not revised your compliance policies and procedures in the past five years, you should do so now Set a timeline and budget and stick to it in the compliance policy and procedure revision process. Document your process of revision to demonstrate more complete operationalization of your compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices Simply having a Code of Conduct, together with compliance policies and procedures is not enough. As articulated by former Assistant Attorney General Lanny Breuer, “Your compliance program is a living entity; it should be constantly evolving.” The 2012 FCPA Guidance stated, “When assessing a compliance program, DOJ and SEC will review whether the company Guiding Principles of Enforcement has taken steps to make certain that the Code of Conduct remains current and effective and whether a company has periodically reviewed and updated its code.”

After considering these issues, you should benchmark your current policies and procedures against other companies in your industry. If you decide to move forward, I suggest a process which can be fully documented as a basis to include revisions to your compliance policies and procedures. These points are a useful guide to not only thinking through how to determine if your policies and procedures need updating, but also practical steps on how to tackle the problem. If it has been more than five years since the last updates, you should begin the process now. It is far better to review and update if appropriate than wait for a massive FCPA investigation to go through the process.

Three key takeaways:

  1. If you have not revised your compliance policies and procedures in the past five years, you should do so now
  2. Set a timeline and budget and stick to it in the compliance policy and procedure revision process.
  3. Document your process of revision to demonstrate more complete operationalization of your compliance program.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Policies and procedures There are numerous reasons to put some serious work into your policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2012 FCPA Guidance made clear that “Whether a company has policies and procedures that outline responsibilities for compliance within the company, detail proper internal controls, auditing practices, and documentation policies, and set forth disciplinary procedures will also be considered by DOJ and SEC.” And by using the word “considered” it is clear that this means the regulators will take a strong view against a company that does not have well thought out and articulated policies and procedures; all of which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital layer of communication and acts as an internal control. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to this area of anti-corruption compliance. The specific written policies and procedures required for a best practices compliance program are well known and long established. The 2012 FCPA Guidance stated, “Among the risks that a company may need to address include the nature and extent of transactions with foreign governments, including payments to foreign officials; use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments.” Policies help form the basis of expectation and conduct in your company. Procedures are the documents that implement these standards of conduct. Three key takeaways: The Code of Conduct, together with written compliance policies and procedures form the backbone of your compliance program. The DOJ and SEC expect a well-thought out and articulated set of compliance policies and procedures. The Fair Process Doctrineholds for the application of policies and procedures. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 12 May 2020 17:00:00 -0000 Policies and procedures full 8 Thomas Fox Why are policies and procedures so critical to a best practices compliance program? How do you design, implement and review them? Find out in today's episode of 31 Days to a More Effective Compliance Program. There are numerous reasons to put some serious work into your policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2012 FCPA Guidance made clear that “Whether a company has policies and procedures that outline responsibilities for compliance within the company, detail proper internal controls, auditing practices, and documentation policies, and set forth disciplinary procedures will also be considered by DOJ and SEC.” And by using the word “considered” it is clear that this means the regulators will take a strong view against a company that does not have well thought out and articulated policies and procedures; all of which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital layer of communication and acts as an internal control. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to this area of anti-corruption compliance. The specific written policies and procedures required for a best practices compliance program are well known and long established. The 2012 FCPA Guidance stated, “Among the risks that a company may need to address include the nature and extent of transactions with foreign governments, including payments to foreign officials; use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments.” Policies help form the basis of expectation and conduct in your company. Procedures are the documents that implement these standards of conduct. Three key takeaways: The Code of Conduct, together with written compliance policies and procedures form the backbone of your compliance program. The DOJ and SEC expect a well-thought out and articulated set of compliance policies and procedures. The Fair Process Doctrineholds for the application of policies and procedures. Learn more about your ad choices. Visit megaphone.fm/adchoices There are numerous reasons to put some serious work into your policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2012 FCPA Guidance made clear that “Whether a company has policies and procedures that outline responsibilities for compliance within the company, detail proper internal controls, auditing practices, and documentation policies, and set forth disciplinary procedures will also be considered by DOJ and SEC.” And by using the word “considered” it is clear that this means the regulators will take a strong view against a company that does not have well thought out and articulated policies and procedures; all of which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital layer of communication and acts as an internal control. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to this area of anti-corruption compliance.

The specific written policies and procedures required for a best practices compliance program are well known and long established. The 2012 FCPA Guidance stated, “Among the risks that a company may need to address include the nature and extent of transactions with foreign governments, including payments to foreign officials; use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments.” Policies help form the basis of expectation and conduct in your company. Procedures are the documents that implement these standards of conduct.

Three key takeaways:

  1. The Code of Conduct, together with written compliance policies and procedures form the backbone of your compliance program.
  2. The DOJ and SEC expect a well-thought out and articulated set of compliance policies and procedures.
  3. The Fair Process Doctrineholds for the application of policies and procedures.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Operationalization of your Code of Conduct How can you work to operationalize your Code of Conduct as articulated in the DOJ 2019 Guidance? The 2019 Guidance focuses not on whether a company has a paper compliance program but whether a company is actually doing compliance. A company does compliance by moving it into the functional business units as a part of an overall business process. That is what makes a compliance program effective at the business level. There are several different parts of the 2019 Guidance that touch upon your Code of Conduct. The Code of Conduct design and implementation process enshrine your company’s values. Those are set by senior management and their input and support for any code project, whether initial draft or update, is critical. This gets to the heart of operationalization and demonstrates how a Code of Conduct can work to meet the DOJ requirements. As an early part of your design and drafting process, you should assemble a cross-functional team. This is important for several reasons. First, diversity in your team will help produce a more well-rounded final product. But having such team diversity will also assist in your benchmarking effort, coupled with those who are going to help you out looking at designs and maybe helping forge the design of the code. Finally, you can use a group to help in the drafting, redrafting and editing process. This diversity will help you to answer all of the DOJ questions from the 2019 Guidance in a manner consistent to support operationalization. All of these requirements point to getting out and making your Code of Conduct a part of the very fabric of your organization. By using some or all of these strategies, you will have a good starting point. But it is more than simply rollout and training. There must be ongoing communications as well. Three key takeaways: What has been the role of senior management in the creation or update of your Code of Conduct? How have you worked with employees outside the compliance function to lay the groundwork for fully operationalizing your Code of Conduct? How have you measured the effectiveness of your Code of Conduct training? Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 11 May 2020 16:15:00 -0000 Operationalization of your Code of Conduct full 7 Thomas Fox How can you work to more fully operationalize your Code of Conduct? How can you work to operationalize your Code of Conduct as articulated in the DOJ 2019 Guidance? The 2019 Guidance focuses not on whether a company has a paper compliance program but whether a company is actually doing compliance. A company does compliance by moving it into the functional business units as a part of an overall business process. That is what makes a compliance program effective at the business level. There are several different parts of the 2019 Guidance that touch upon your Code of Conduct. The Code of Conduct design and implementation process enshrine your company’s values. Those are set by senior management and their input and support for any code project, whether initial draft or update, is critical. This gets to the heart of operationalization and demonstrates how a Code of Conduct can work to meet the DOJ requirements. As an early part of your design and drafting process, you should assemble a cross-functional team. This is important for several reasons. First, diversity in your team will help produce a more well-rounded final product. But having such team diversity will also assist in your benchmarking effort, coupled with those who are going to help you out looking at designs and maybe helping forge the design of the code. Finally, you can use a group to help in the drafting, redrafting and editing process. This diversity will help you to answer all of the DOJ questions from the 2019 Guidance in a manner consistent to support operationalization. All of these requirements point to getting out and making your Code of Conduct a part of the very fabric of your organization. By using some or all of these strategies, you will have a good starting point. But it is more than simply rollout and training. There must be ongoing communications as well. Three key takeaways: What has been the role of senior management in the creation or update of your Code of Conduct? How have you worked with employees outside the compliance function to lay the groundwork for fully operationalizing your Code of Conduct? How have you measured the effectiveness of your Code of Conduct training? Learn more about your ad choices. Visit megaphone.fm/adchoices How can you work to operationalize your Code of Conduct as articulated in the DOJ 2019 Guidance? The 2019 Guidance focuses not on whether a company has a paper compliance program but whether a company is actually doing compliance. A company does compliance by moving it into the functional business units as a part of an overall business process. That is what makes a compliance program effective at the business level. There are several different parts of the 2019 Guidance that touch upon your Code of Conduct.

The Code of Conduct design and implementation process enshrine your company’s values. Those are set by senior management and their input and support for any code project, whether initial draft or update, is critical. This gets to the heart of operationalization and demonstrates how a Code of Conduct can work to meet the DOJ requirements. As an early part of your design and drafting process, you should assemble a cross-functional team. This is important for several reasons. First, diversity in your team will help produce a more well-rounded final product. But having such team diversity will also assist in your benchmarking effort, coupled with those who are going to help you out looking at designs and maybe helping forge the design of the code. Finally, you can use a group to help in the drafting, redrafting and editing process. This diversity will help you to answer all of the DOJ questions from the 2019 Guidance in a manner consistent to support operationalization.

All of these requirements point to getting out and making your Code of Conduct a part of the very fabric of your organization. By using some or all of these strategies, you will have a good starting point. But it is more than simply rollout and training. There must be ongoing communications as well.

Three key takeaways:

  1. What has been the role of senior management in the creation or update of your Code of Conduct?
  2. How have you worked with employees outside the compliance function to lay the groundwork for fully operationalizing your Code of Conduct?
  3. How have you measured the effectiveness of your Code of Conduct training?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Training on your Code of Conduct What about the training on your finalized Code of Conduct? While there have been criticisms of code training, if you consider training as one source of your 360-degrees of compliance communications, the rollout of a new or updated code can be an opportunity. This rollout fits directly into the concept of 360-degrees of compliance communications as rollout is part of both communications and engagement. The delivery of a Code of Conduct is a key element of its effectiveness. By allowing your employees and other stakeholders to engage and interact with the code, through live or interactive training, the effectiveness can be better monitored and measured. Beginning with the DOJ’s 2017 Evaluation and continuing into the 2019 Guidance, is the DOJ’s emphasis in the effectiveness of training. I think everyone would understand you do need to train but now the government’s talking to us about effective training. Begin with live training that can be held at the corporate headquarters with senior management and executive involvement. Many companies will videotape a message from the CEO to help celebrate the rollout. Then there is the opportunity for localized training that gives employees an opportunity to see, meet, and speak directly with a compliance officer, not an insignificant dynamic in the corporate environment. Such personal training also sends a strong message of commitment to the Code of Conduct. It gives employees the opportunity to interact with the compliance officer by asking questions which are relevant to markets and locations outside the corporate office, which can often provide employees with the opportunity to have confidential in-person discussions. However, your Code of Conduct training should be an extension of the way you communicate compliance in your organization. If it is divorced from your 360-degrees of compliance communications style, you may well be missing an opportunity to drive better understanding of the code and denigrate the effectiveness of the training. Whatever approach is used, one of the critical factors is the length of time of the training session. Although lawyers and ethics and compliance professionals can (sometimes) sit through a multi-hour Code of Conduct lesson, it is almost impossible to keep the attention of business and operations employees for such a length of time. The presentation and number of PowerPoint slides must be kept to a manageable length before the attendee’s eyes start to glaze over.  Three key takeaways: Consider a video message from your CEO to help roll out your Code of Conduct initiation or update. Tailor your Code of Conduct training to your workforce. Consider interactive and modular approaches to Code of Conduct training. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 08 May 2020 17:00:00 -0000 Training on your Code of Conduct full Thomas Fox How should you think about training on your Code of Conduct? Find out in today's episode of 31 Days to a More Effective Compliance Program. What about the training on your finalized Code of Conduct? While there have been criticisms of code training, if you consider training as one source of your 360-degrees of compliance communications, the rollout of a new or updated code can be an opportunity. This rollout fits directly into the concept of 360-degrees of compliance communications as rollout is part of both communications and engagement. The delivery of a Code of Conduct is a key element of its effectiveness. By allowing your employees and other stakeholders to engage and interact with the code, through live or interactive training, the effectiveness can be better monitored and measured. Beginning with the DOJ’s 2017 Evaluation and continuing into the 2019 Guidance, is the DOJ’s emphasis in the effectiveness of training. I think everyone would understand you do need to train but now the government’s talking to us about effective training. Begin with live training that can be held at the corporate headquarters with senior management and executive involvement. Many companies will videotape a message from the CEO to help celebrate the rollout. Then there is the opportunity for localized training that gives employees an opportunity to see, meet, and speak directly with a compliance officer, not an insignificant dynamic in the corporate environment. Such personal training also sends a strong message of commitment to the Code of Conduct. It gives employees the opportunity to interact with the compliance officer by asking questions which are relevant to markets and locations outside the corporate office, which can often provide employees with the opportunity to have confidential in-person discussions. However, your Code of Conduct training should be an extension of the way you communicate compliance in your organization. If it is divorced from your 360-degrees of compliance communications style, you may well be missing an opportunity to drive better understanding of the code and denigrate the effectiveness of the training. Whatever approach is used, one of the critical factors is the length of time of the training session. Although lawyers and ethics and compliance professionals can (sometimes) sit through a multi-hour Code of Conduct lesson, it is almost impossible to keep the attention of business and operations employees for such a length of time. The presentation and number of PowerPoint slides must be kept to a manageable length before the attendee’s eyes start to glaze over.  Three key takeaways: Consider a video message from your CEO to help roll out your Code of Conduct initiation or update. Tailor your Code of Conduct training to your workforce. Consider interactive and modular approaches to Code of Conduct training. Learn more about your ad choices. Visit megaphone.fm/adchoices What about the training on your finalized Code of Conduct? While there have been criticisms of code training, if you consider training as one source of your 360-degrees of compliance communications, the rollout of a new or updated code can be an opportunity. This rollout fits directly into the concept of 360-degrees of compliance communications as rollout is part of both communications and engagement. The delivery of a Code of Conduct is a key element of its effectiveness. By allowing your employees and other stakeholders to engage and interact with the code, through live or interactive training, the effectiveness can be better monitored and measured.

Beginning with the DOJ’s 2017 Evaluation and continuing into the 2019 Guidance, is the DOJ’s emphasis in the effectiveness of training. I think everyone would understand you do need to train but now the government’s talking to us about effective training. Begin with live training that can be held at the corporate headquarters with senior management and executive involvement. Many companies will videotape a message from the CEO to help celebrate the rollout. Then there is the opportunity for localized training that gives employees an opportunity to see, meet, and speak directly with a compliance officer, not an insignificant dynamic in the corporate environment. Such personal training also sends a strong message of commitment to the Code of Conduct. It gives employees the opportunity to interact with the compliance officer by asking questions which are relevant to markets and locations outside the corporate office, which can often provide employees with the opportunity to have confidential in-person discussions.

However, your Code of Conduct training should be an extension of the way you communicate compliance in your organization. If it is divorced from your 360-degrees of compliance communications style, you may well be missing an opportunity to drive better understanding of the code and denigrate the effectiveness of the training. Whatever approach is used, one of the critical factors is the length of time of the training session. Although lawyers and ethics and compliance professionals can (sometimes) sit through a multi-hour Code of Conduct lesson, it is almost impossible to keep the attention of business and operations employees for such a length of time. The presentation and number of PowerPoint slides must be kept to a manageable length before the attendee’s eyes start to glaze over.

 Three key takeaways:

  1. Consider a video message from your CEO to help roll out your Code of Conduct initiation or update.
  2. Tailor your Code of Conduct training to your workforce.
  3. Consider interactive and modular approaches to Code of Conduct training.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Design of your Code of Conduct Next is the design of your Code of Conduct. Through attention to detail in the design process, you should be able to come out at the end with a code which will help you to more fully operationalize your compliance program. You must begin with a determination of what you are trying to accomplish. It does not serve you to try and list every compliance risk you might think your company may encounter. You should determine the values you want to communicate, what the expectations are for employees and how to call the hotline. Under such an approach, a Code of Conduct can be the jumping off point for training on the issues stated in it. It can also form the hub of the wheel for other policies and procedures and written standards you want to communicate to relevant stakeholders. You should also consider how you are going to distribute your code to your employees and stakeholders. If it is through an Adobe .pdf document, which is accessible for most stakeholders across an organization or via another method. If a significant part of your workforce does not have access to computers, online production only will not work as the primary distribution platform. Three key takeaways: Get your business folks involved in your Code of Conduct from the outset. Your ethical values should be integrated into and integral to your Code of Conduct. How have you operationalized your Code of Conduct? Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 07 May 2020 17:00:00 -0000 Design of your Code of Conduct full Thomas Fox How should you design your Code of Conduct? Find out in today's 31 Days to a More Effective Compliance Program. Next is the design of your Code of Conduct. Through attention to detail in the design process, you should be able to come out at the end with a code which will help you to more fully operationalize your compliance program. You must begin with a determination of what you are trying to accomplish. It does not serve you to try and list every compliance risk you might think your company may encounter. You should determine the values you want to communicate, what the expectations are for employees and how to call the hotline. Under such an approach, a Code of Conduct can be the jumping off point for training on the issues stated in it. It can also form the hub of the wheel for other policies and procedures and written standards you want to communicate to relevant stakeholders. You should also consider how you are going to distribute your code to your employees and stakeholders. If it is through an Adobe .pdf document, which is accessible for most stakeholders across an organization or via another method. If a significant part of your workforce does not have access to computers, online production only will not work as the primary distribution platform. Three key takeaways: Get your business folks involved in your Code of Conduct from the outset. Your ethical values should be integrated into and integral to your Code of Conduct. How have you operationalized your Code of Conduct? Learn more about your ad choices. Visit megaphone.fm/adchoices Next is the design of your Code of Conduct. Through attention to detail in the design process, you should be able to come out at the end with a code which will help you to more fully operationalize your compliance program. You must begin with a determination of what you are trying to accomplish. It does not serve you to try and list every compliance risk you might think your company may encounter. You should determine the values you want to communicate, what the expectations are for employees and how to call the hotline. Under such an approach, a Code of Conduct can be the jumping off point for training on the issues stated in it. It can also form the hub of the wheel for other policies and procedures and written standards you want to communicate to relevant stakeholders.

You should also consider how you are going to distribute your code to your employees and stakeholders. If it is through an Adobe .pdf document, which is accessible for most stakeholders across an organization or via another method. If a significant part of your workforce does not have access to computers, online production only will not work as the primary distribution platform.

Three key takeaways:

  1. Get your business folks involved in your Code of Conduct from the outset.
  2. Your ethical values should be integrated into and integral to your Code of Conduct.
  3. How have you operationalized your Code of Conduct?


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Code of Conduct: Structure and format Next comes the evolution of the structure and format of a best practices Code of Conduct. Initially, my experience with this is that they were written by lawyers, largely for lawyers. This included ‘thou shalts’ and ‘thou shalt nots’ liberally sprinkled throughout a lengthy written document. This was what is now referred to as Code 1.0. The compliance community then evolved to Code 2.0, where the writing was less turgid, moved to more employee friendly language and then somewhere along the line we started putting in hyperlinks, pictures and videos. There are two factors which a company should consider on the structure of a Code of Conduct. The first is to consider how your organization generally communicates, overlaid with the most effective way to communicate with the various stakeholders who will read and use it. These stakeholders can include such diverse groups as employees, shareholders and third parties on both the sales and supply side of your business. This may require multiple approaches. Be sure to make your code readable. This is beyond simply eliminating legalese. It is writing English at a grade level that is sufficient for your employee population. It may be that an eighth-grade language level is appropriate for your work force. However, if you have a population consisting primarily of professionals, translating it into the appropriate languages it might be appropriate to aim for a higher level of language. Finally, you do not have to say the same thing, in multiple different ways. Three key takeaways: Companies have moved past having a Code of Conduct written by lawyers for lawyers to a fully interactive code for all employees. Consider how information is distributed at your organization as a basis for communication in your Code of Conduct. Your Code of Conduct must be readable, in both in English and native language for non-English speaking employees. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 06 May 2020 17:00:00 -0000 Code of Conduct: Structure and format full Thomas Fox How can you think through the structure and format of your Code of Conduct? Find out in today's edition of 31 Days to a More Effective Compliance Program. Next comes the evolution of the structure and format of a best practices Code of Conduct. Initially, my experience with this is that they were written by lawyers, largely for lawyers. This included ‘thou shalts’ and ‘thou shalt nots’ liberally sprinkled throughout a lengthy written document. This was what is now referred to as Code 1.0. The compliance community then evolved to Code 2.0, where the writing was less turgid, moved to more employee friendly language and then somewhere along the line we started putting in hyperlinks, pictures and videos. There are two factors which a company should consider on the structure of a Code of Conduct. The first is to consider how your organization generally communicates, overlaid with the most effective way to communicate with the various stakeholders who will read and use it. These stakeholders can include such diverse groups as employees, shareholders and third parties on both the sales and supply side of your business. This may require multiple approaches. Be sure to make your code readable. This is beyond simply eliminating legalese. It is writing English at a grade level that is sufficient for your employee population. It may be that an eighth-grade language level is appropriate for your work force. However, if you have a population consisting primarily of professionals, translating it into the appropriate languages it might be appropriate to aim for a higher level of language. Finally, you do not have to say the same thing, in multiple different ways. Three key takeaways: Companies have moved past having a Code of Conduct written by lawyers for lawyers to a fully interactive code for all employees. Consider how information is distributed at your organization as a basis for communication in your Code of Conduct. Your Code of Conduct must be readable, in both in English and native language for non-English speaking employees. Learn more about your ad choices. Visit megaphone.fm/adchoices Next comes the evolution of the structure and format of a best practices Code of Conduct. Initially, my experience with this is that they were written by lawyers, largely for lawyers. This included ‘thou shalts’ and ‘thou shalt nots’ liberally sprinkled throughout a lengthy written document. This was what is now referred to as Code 1.0. The compliance community then evolved to Code 2.0, where the writing was less turgid, moved to more employee friendly language and then somewhere along the line we started putting in hyperlinks, pictures and videos.

There are two factors which a company should consider on the structure of a Code of Conduct. The first is to consider how your organization generally communicates, overlaid with the most effective way to communicate with the various stakeholders who will read and use it. These stakeholders can include such diverse groups as employees, shareholders and third parties on both the sales and supply side of your business. This may require multiple approaches.

Be sure to make your code readable. This is beyond simply eliminating legalese. It is writing English at a grade level that is sufficient for your employee population. It may be that an eighth-grade language level is appropriate for your work force. However, if you have a population consisting primarily of professionals, translating it into the appropriate languages it might be appropriate to aim for a higher level of language. Finally, you do not have to say the same thing, in multiple different ways.

Three key takeaways:

  1. Companies have moved past having a Code of Conduct written by lawyers for lawyers to a fully interactive code for all employees.
  2. Consider how information is distributed at your organization as a basis for communication in your Code of Conduct.
  3. Your Code of Conduct must be readable, in both in English and native language for non-English speaking employees.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Code of Conduct What is the value of having a Code of Conduct? I have heard many business folks ask that question over the years. In its early days, a Code of Conduct tended to be a lawyer-written and lawyer-driven document to wave in regulator’s face during an enforcement action by using it to claim, “we are an ethical company”. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s law? What is it that makes a Code of Conduct effective? What should be the goal in the creation of your company’s Code of Conduct? How important is the Code of Conduct? Consider the 2016 SEC enforcement action involving United Airlines, Inc., which turned on violation of the company’s Code of Conduct. The breach of the code was determined to be a FCPA internal controls violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity which has authority over, among other things, United Airlines operations at the company’s huge east coast hub at Newark, NJ. The actions of United’s former CEO, Jeff Smisek, in personally approving the benefit granted to favor Samson violated the company’s internal controls around gifts to government officials by failing to not only follow the United Code of Conduct but also violating it. The $2.4 million civil penalty levied on United was in addition to United’s Non Prosecution Agreement resolution with the DOJ, which resulted in a penalty of $2.25 million. The scandal also cost the resignation of Smisek and two high-level executives from United. Three key takeaways: Every formulation of a best practices compliance program starts with a written Code of Conduct. The substance of your Code of Conduct should be tailored to the company’s culture, and to its industry and corporate identity “Document, Document, Document” your training and communication efforts around your Code of Conduct. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 05 May 2020 15:42:44 -0000 Code of Conduct full Thomas Fox Why is your Code of Conduct foundational? Find out in today's episode of 31 Days to a More Effective Compliance Program. What is the value of having a Code of Conduct? I have heard many business folks ask that question over the years. In its early days, a Code of Conduct tended to be a lawyer-written and lawyer-driven document to wave in regulator’s face during an enforcement action by using it to claim, “we are an ethical company”. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s law? What is it that makes a Code of Conduct effective? What should be the goal in the creation of your company’s Code of Conduct? How important is the Code of Conduct? Consider the 2016 SEC enforcement action involving United Airlines, Inc., which turned on violation of the company’s Code of Conduct. The breach of the code was determined to be a FCPA internal controls violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity which has authority over, among other things, United Airlines operations at the company’s huge east coast hub at Newark, NJ. The actions of United’s former CEO, Jeff Smisek, in personally approving the benefit granted to favor Samson violated the company’s internal controls around gifts to government officials by failing to not only follow the United Code of Conduct but also violating it. The $2.4 million civil penalty levied on United was in addition to United’s Non Prosecution Agreement resolution with the DOJ, which resulted in a penalty of $2.25 million. The scandal also cost the resignation of Smisek and two high-level executives from United. Three key takeaways: Every formulation of a best practices compliance program starts with a written Code of Conduct. The substance of your Code of Conduct should be tailored to the company’s culture, and to its industry and corporate identity “Document, Document, Document” your training and communication efforts around your Code of Conduct. Learn more about your ad choices. Visit megaphone.fm/adchoices What is the value of having a Code of Conduct? I have heard many business folks ask that question over the years. In its early days, a Code of Conduct tended to be a lawyer-written and lawyer-driven document to wave in regulator’s face during an enforcement action by using it to claim, “we are an ethical company”. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s law? What is it that makes a Code of Conduct effective? What should be the goal in the creation of your company’s Code of Conduct?

How important is the Code of Conduct? Consider the 2016 SEC enforcement action involving United Airlines, Inc., which turned on violation of the company’s Code of Conduct. The breach of the code was determined to be a FCPA internal controls violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity which has authority over, among other things, United Airlines operations at the company’s huge east coast hub at Newark, NJ.

The actions of United’s former CEO, Jeff Smisek, in personally approving the benefit granted to favor Samson violated the company’s internal controls around gifts to government officials by failing to not only follow the United Code of Conduct but also violating it. The $2.4 million civil penalty levied on United was in addition to United’s Non Prosecution Agreement resolution with the DOJ, which resulted in a penalty of $2.25 million. The scandal also cost the resignation of Smisek and two high-level executives from United.

Three key takeaways:

  1. Every formulation of a best practices compliance program starts with a written Code of Conduct.
  2. The substance of your Code of Conduct should be tailored to the company’s culture, and to its industry and corporate identity
  3. “Document, Document, Document” your training and communication efforts around your Code of Conduct.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Clearly articulated written standards The written standard requirements have long been memorialized in the U.S. Sentencing Guidelines, which contain seven basic compliance elements that can be tailored to fit the needs and financial realities of any given organization. From these seven compliance elements, the DOJ has crafted its minimum best practices compliance program, which is now attached to every DPA and NPA issued. These requirements were incorporated into the 2012 FCPA Guidance and brought forward in the 2019 Guidance and FCPA Corporate Enforcement Policy. The U.S. Sentencing Guidelines assumes that every effective compliance and ethics program begins with a written standard of conduct; i.e., a Code of Conduct.  Following your Code of Conduct is written policies and procedures required for a best practices compliance program are well- known and long established. The role of compliance policies is to provide guidance and to protect companies, despite an occasional hick-up. Policies provide a basic set of guidelines for employees to follow. They can include general do’s and don’ts, work process flows, specific issue guidelines. By establishing what is and is not acceptable compliance behavior, a company can mitigate the compliance risks posed by employees who might make foolish decisions or otherwise engage in unethical behavior. There are numerous reasons to put some serious work into your Code of Conduct, policies and procedures. They are certainly a first line of defense when the government comes knocking. This means the regulators will take a strong view against a company that does not have well thought out and articulated policies, procedures or Code of Conduct; all of which are systematically reviewed and updated. Written policies, signed by employees provide a vital layer of communication. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, Document” mantra applies just as strongly to this area of anti-corruption compliance. Three key takeaways: A Code of Conduct, together with policies and procedures, have long been recognized as cornerstones of a best practices compliance policy. Each level of written standards builds upon one another, so consider this integration step. The Fair Process Doctrine applies to your written standards. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 04 May 2020 17:00:00 -0000 Clearly articulated written standards full Thomas Fox What should be in your clearly articulated written standards? Find out in this episode of 31 Days to a More Effective Compliance Program. The written standard requirements have long been memorialized in the U.S. Sentencing Guidelines, which contain seven basic compliance elements that can be tailored to fit the needs and financial realities of any given organization. From these seven compliance elements, the DOJ has crafted its minimum best practices compliance program, which is now attached to every DPA and NPA issued. These requirements were incorporated into the 2012 FCPA Guidance and brought forward in the 2019 Guidance and FCPA Corporate Enforcement Policy. The U.S. Sentencing Guidelines assumes that every effective compliance and ethics program begins with a written standard of conduct; i.e., a Code of Conduct.  Following your Code of Conduct is written policies and procedures required for a best practices compliance program are well- known and long established. The role of compliance policies is to provide guidance and to protect companies, despite an occasional hick-up. Policies provide a basic set of guidelines for employees to follow. They can include general do’s and don’ts, work process flows, specific issue guidelines. By establishing what is and is not acceptable compliance behavior, a company can mitigate the compliance risks posed by employees who might make foolish decisions or otherwise engage in unethical behavior. There are numerous reasons to put some serious work into your Code of Conduct, policies and procedures. They are certainly a first line of defense when the government comes knocking. This means the regulators will take a strong view against a company that does not have well thought out and articulated policies, procedures or Code of Conduct; all of which are systematically reviewed and updated. Written policies, signed by employees provide a vital layer of communication. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, Document” mantra applies just as strongly to this area of anti-corruption compliance. Three key takeaways: A Code of Conduct, together with policies and procedures, have long been recognized as cornerstones of a best practices compliance policy. Each level of written standards builds upon one another, so consider this integration step. The Fair Process Doctrine applies to your written standards. Learn more about your ad choices. Visit megaphone.fm/adchoices The written standard requirements have long been memorialized in the U.S. Sentencing Guidelines, which contain seven basic compliance elements that can be tailored to fit the needs and financial realities of any given organization. From these seven compliance elements, the DOJ has crafted its minimum best practices compliance program, which is now attached to every DPA and NPA issued. These requirements were incorporated into the 2012 FCPA Guidance and brought forward in the 2019 Guidance and FCPA Corporate Enforcement Policy. The U.S. Sentencing Guidelines assumes that every effective compliance and ethics program begins with a written standard of conduct; i.e., a Code of Conduct. 

Following your Code of Conduct is written policies and procedures required for a best practices compliance program are well- known and long established. The role of compliance policies is to provide guidance and to protect companies, despite an occasional hick-up. Policies provide a basic set of guidelines for employees to follow. They can include general do’s and don’ts, work process flows, specific issue guidelines. By establishing what is and is not acceptable compliance behavior, a company can mitigate the compliance risks posed by employees who might make foolish decisions or otherwise engage in unethical behavior.

There are numerous reasons to put some serious work into your Code of Conduct, policies and procedures. They are certainly a first line of defense when the government comes knocking. This means the regulators will take a strong view against a company that does not have well thought out and articulated policies, procedures or Code of Conduct; all of which are systematically reviewed and updated. Written policies, signed by employees provide a vital layer of communication. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, Document” mantra applies just as strongly to this area of anti-corruption compliance.

Three key takeaways:

  1. A Code of Conduct, together with policies and procedures, have long been recognized as cornerstones of a best practices compliance policy.
  2. Each level of written standards builds upon one another, so consider this integration step.
  3. The Fair Process Doctrine applies to your written standards.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Introduction to written standards The cornerstone of any best practices compliance program is written protocols. This includes a Code of Conduct, policies and procedures. These elements have long been memorialized in the US Sentencing Guidelines; the Department Of Justice’s (DOJs) Opinion Releases regarding compliance programs, the 2012 FCPA Guidance, both DOJ and Securities and Exchange Commission (SEC) enforcement actions, the 2019 Guidance and FCPA Corporate Enforcement Policy.   There are three levels of standards and controls, Code of Conduct standards and policies and procedures. Every company should have a Code of Conduct that expresses its ethical principles. But a Code of Conduct is not enough. The Code of Conduct is implemented through your compliance policies. It is further operationalized through your compliance procedures. The DOJ spoke to their importance in the 2019 Guidance when it stated, “As a threshold matter, prosecutors should examine whether the company has a code of conduct that sets forth, among other things, the company’s commitment to full compliance with relevant Federal laws that is accessible and applicable to all company employees.” As a corollary, prosecutors should also assess whether the company has established policies and procedures that incorporate the culture of compliance into its day-to-day operations. At the end of the 31 Days you will have a very detailed grounding on better written standards for your compliance program. You will be able to utilize the information presented to implement a more effective compliance program for your organization.  Three key takeaways:  The cornerstone of any best practices compliance program is its written protocols. Written standards work to prevent, detect and remediate. What are the specific written protocols you should have in your compliance program? Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 01 May 2020 10:58:45 -0000 Introduction to written standards full Thomas Fox Welcome to a new month in 31 Days to a Better Compliance Program. In May, I will be considering the role of written standards in a best practices compliance program. The cornerstone of any best practices compliance program is written protocols. This includes a Code of Conduct, policies and procedures. These elements have long been memorialized in the US Sentencing Guidelines; the Department Of Justice’s (DOJs) Opinion Releases regarding compliance programs, the 2012 FCPA Guidance, both DOJ and Securities and Exchange Commission (SEC) enforcement actions, the 2019 Guidance and FCPA Corporate Enforcement Policy.   There are three levels of standards and controls, Code of Conduct standards and policies and procedures. Every company should have a Code of Conduct that expresses its ethical principles. But a Code of Conduct is not enough. The Code of Conduct is implemented through your compliance policies. It is further operationalized through your compliance procedures. The DOJ spoke to their importance in the 2019 Guidance when it stated, “As a threshold matter, prosecutors should examine whether the company has a code of conduct that sets forth, among other things, the company’s commitment to full compliance with relevant Federal laws that is accessible and applicable to all company employees.” As a corollary, prosecutors should also assess whether the company has established policies and procedures that incorporate the culture of compliance into its day-to-day operations. At the end of the 31 Days you will have a very detailed grounding on better written standards for your compliance program. You will be able to utilize the information presented to implement a more effective compliance program for your organization.  Three key takeaways:  The cornerstone of any best practices compliance program is its written protocols. Written standards work to prevent, detect and remediate. What are the specific written protocols you should have in your compliance program? Learn more about your ad choices. Visit megaphone.fm/adchoices The cornerstone of any best practices compliance program is written protocols. This includes a Code of Conduct, policies and procedures. These elements have long been memorialized in the US Sentencing Guidelines; the Department Of Justice’s (DOJs) Opinion Releases regarding compliance programs, the 2012 FCPA Guidance, both DOJ and Securities and Exchange Commission (SEC) enforcement actions, the 2019 Guidance and FCPA Corporate Enforcement Policy. 

 There are three levels of standards and controls, Code of Conduct standards and policies and procedures. Every company should have a Code of Conduct that expresses its ethical principles. But a Code of Conduct is not enough. The Code of Conduct is implemented through your compliance policies. It is further operationalized through your compliance procedures. The DOJ spoke to their importance in the 2019 Guidance when it stated, “As a threshold matter, prosecutors should examine whether the company has a code of conduct that sets forth, among other things, the company’s commitment to full compliance with relevant Federal laws that is accessible and applicable to all company employees.” As a corollary, prosecutors should also assess whether the company has established policies and procedures that incorporate the culture of compliance into its day-to-day operations.

At the end of the 31 Days you will have a very detailed grounding on better written standards for your compliance program. You will be able to utilize the information presented to implement a more effective compliance program for your organization. 

Three key takeaways: 

  1. The cornerstone of any best practices compliance program is its written protocols.
  2. Written standards work to prevent, detect and remediate.
  3. What are the specific written protocols you should have in your compliance program?


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 372 no Conclusion to continuous improvement in a compliance program Over the course of this month, I have presented a variety of specific tools and techniques for the compliance practitioner to utilize to continuous improve their compliance regime. They include financial audit, the culture audit, controls monitoring, various risk management strategies which can become continuous monitoring. The tools are both quantitative and qualitative. Pick and choose the right tools for your company’s business and compliance profile. Continuous improvement through continuous monitoring or other techniques will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is in many ways a continuously evolving organism, just as your company is. You need to build in a way to keep pace with both market and regulatory changes to have a truly effective anti-corruption compliance program. The 2012 FCPA Guidance makes clear the “DOJ and SEC will give meaningful credit to thoughtful efforts to create a sustainable compliance program if a problem is later discovered. Similarly, undertaking proactive evaluations before a problem strikes can lower the applicable penalty range under the U.S. Sentencing Guidelines. Although the nature and the frequency of proactive evaluations may vary depending on the size and complexity of an organization, the idea behind such efforts is the same: continuous improve­ment and sustainability.” Three key takeaways: Your compliance program should be continually evolving. There are a variety of tools for continuous improvement which will enhance both your compliance and business processes. DOJ and SEC will give meaningful credit to thoughtful efforts to create a sustainable compliance program if a problem is later discovered. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 30 Apr 2020 17:00:00 -0000 Conclusion to continuous improvement in a compliance program full Thomas Fox Over the course of this month, I have presented a variety of specific tools and techniques for the compliance practitioner to utilize to continuous improve their compliance regime. Over the course of this month, I have presented a variety of specific tools and techniques for the compliance practitioner to utilize to continuous improve their compliance regime. They include financial audit, the culture audit, controls monitoring, various risk management strategies which can become continuous monitoring. The tools are both quantitative and qualitative. Pick and choose the right tools for your company’s business and compliance profile. Continuous improvement through continuous monitoring or other techniques will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is in many ways a continuously evolving organism, just as your company is. You need to build in a way to keep pace with both market and regulatory changes to have a truly effective anti-corruption compliance program. The 2012 FCPA Guidance makes clear the “DOJ and SEC will give meaningful credit to thoughtful efforts to create a sustainable compliance program if a problem is later discovered. Similarly, undertaking proactive evaluations before a problem strikes can lower the applicable penalty range under the U.S. Sentencing Guidelines. Although the nature and the frequency of proactive evaluations may vary depending on the size and complexity of an organization, the idea behind such efforts is the same: continuous improve­ment and sustainability.” Three key takeaways: Your compliance program should be continually evolving. There are a variety of tools for continuous improvement which will enhance both your compliance and business processes. DOJ and SEC will give meaningful credit to thoughtful efforts to create a sustainable compliance program if a problem is later discovered. Learn more about your ad choices. Visit megaphone.fm/adchoices Over the course of this month, I have presented a variety of specific tools and techniques for the compliance practitioner to utilize to continuous improve their compliance regime. They include financial audit, the culture audit, controls monitoring, various risk management strategies which can become continuous monitoring. The tools are both quantitative and qualitative. Pick and choose the right tools for your company’s business and compliance profile.

Continuous improvement through continuous monitoring or other techniques will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is in many ways a continuously evolving organism, just as your company is. You need to build in a way to keep pace with both market and regulatory changes to have a truly effective anti-corruption compliance program. The 2012 FCPA Guidance makes clear the “DOJ and SEC will give meaningful credit to thoughtful efforts to create a sustainable compliance program if a problem is later discovered. Similarly, undertaking proactive evaluations before a problem strikes can lower the applicable penalty range under the U.S. Sentencing Guidelines. Although the nature and the frequency of proactive evaluations may vary depending on the size and complexity of an organization, the idea behind such efforts is the same: continuous improve­ment and sustainability.”

Three key takeaways:

  1. Your compliance program should be continually evolving.
  2. There are a variety of tools for continuous improvement which will enhance both your compliance and business processes.
  3. DOJ and SEC will give meaningful credit to thoughtful efforts to create a sustainable compliance program if a problem is later discovered.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Use of social media for continuous improvement Compliance does not exist in a time-warp vacuum, with compliance programs living in 1977 when the first major anti-corruption legislation, the FCPA, was passed. The law has advanced since that time, as has compliance and society as well. One of the ways that you can engage in continuous improvement for your compliance program is based upon the two-way use of social media. Social media can be used not only to communicate with your employee base but also for your employee base to communicate with you, most particularly if you are prepared to listen. Twitter can be powerful tool for the compliance practitioner, as it allows you to both listen and communicate. It is one of the only tools that can work both inbound for you to obtain information and insight and in an outbound manner as well; where you are able to communicate with your compliance customer base, your employees. You should work to incorporate one or more of the techniques listed herein to help you burn compliance into the DNA fabric of your organization through continuous improvement. Three key takeaways:  Social media is a two-way approach to communications. Twitter or a similar tool can facilitate your compliance program improvement. Study and embrace technology to move your compliance program forward. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 29 Apr 2020 17:00:00 -0000 Use of social media for continuous improvement full Thomas Fox How can your compliance function use social media for continuous improvement? Find out on this edition of 31 Days to a More Effective Compliance Program Compliance does not exist in a time-warp vacuum, with compliance programs living in 1977 when the first major anti-corruption legislation, the FCPA, was passed. The law has advanced since that time, as has compliance and society as well. One of the ways that you can engage in continuous improvement for your compliance program is based upon the two-way use of social media. Social media can be used not only to communicate with your employee base but also for your employee base to communicate with you, most particularly if you are prepared to listen. Twitter can be powerful tool for the compliance practitioner, as it allows you to both listen and communicate. It is one of the only tools that can work both inbound for you to obtain information and insight and in an outbound manner as well; where you are able to communicate with your compliance customer base, your employees. You should work to incorporate one or more of the techniques listed herein to help you burn compliance into the DNA fabric of your organization through continuous improvement. Three key takeaways:  Social media is a two-way approach to communications. Twitter or a similar tool can facilitate your compliance program improvement. Study and embrace technology to move your compliance program forward. Learn more about your ad choices. Visit megaphone.fm/adchoices Compliance does not exist in a time-warp vacuum, with compliance programs living in 1977 when the first major anti-corruption legislation, the FCPA, was passed. The law has advanced since that time, as has compliance and society as well. One of the ways that you can engage in continuous improvement for your compliance program is based upon the two-way use of social media. Social media can be used not only to communicate with your employee base but also for your employee base to communicate with you, most particularly if you are prepared to listen.

Twitter can be powerful tool for the compliance practitioner, as it allows you to both listen and communicate. It is one of the only tools that can work both inbound for you to obtain information and insight and in an outbound manner as well; where you are able to communicate with your compliance customer base, your employees. You should work to incorporate one or more of the techniques listed herein to help you burn compliance into the DNA fabric of your organization through continuous improvement.

Three key takeaways: 

  1. Social media is a two-way approach to communications.
  2. Twitter or a similar tool can facilitate your compliance program improvement.
  3. Study and embrace technology to move your compliance program forward.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Email sweeps for continuous improvement The 2012 FCPA Guidance specified, “a good compliance program should constantly evolve. A company’s business changes over time, as do the environments in which it operates, the nature of its customers, the laws that govern its actions, and the standards of its industry. In addition, compliance programs do not just exist on paper but are followed in practice will inevitably uncover compliance weaknesses and require enhancements. Consequently, DOJ and SEC evaluate whether companies regularly review and improve their compliance programs and not allow them to become stale.” Continuous improvement through continuous monitoring will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is a continuously evolving organism, just as your company is continually improving its business processes. The 2012 FCPA Guidance makes clear the “DOJ and SEC will give meaningful credit to thoughtful efforts to create a sustainable compliance program if a problem is later discovered. Similarly, undertaking proactive evaluations before a problem strikes can lower the applicable penalty range under the U.S. Sentencing Guidelines. Although the nature and the frequency of proactive evaluations may vary depending on the size and complexity of an organization, the idea behind such efforts is the same: continuous improve­ment and sustainability.”  Three key takeaways:  Ongoing monitoring is not limited to financial monitoring, a holistic approach would look at other indicia of corruption. Where there is compliance smoke, there is most usually a compliance fire. Continuous improvement can be achieved in a variety of efficient, cost-effective ways. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 28 Apr 2020 14:24:19 -0000 Email sweeps for continuous improvement full Thomas Fox How can email sweeps facilitate continuous improvement? Find out in today's edition of 31 Days to a More Effective Compliance Program. The 2012 FCPA Guidance specified, “a good compliance program should constantly evolve. A company’s business changes over time, as do the environments in which it operates, the nature of its customers, the laws that govern its actions, and the standards of its industry. In addition, compliance programs do not just exist on paper but are followed in practice will inevitably uncover compliance weaknesses and require enhancements. Consequently, DOJ and SEC evaluate whether companies regularly review and improve their compliance programs and not allow them to become stale.” Continuous improvement through continuous monitoring will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is a continuously evolving organism, just as your company is continually improving its business processes. The 2012 FCPA Guidance makes clear the “DOJ and SEC will give meaningful credit to thoughtful efforts to create a sustainable compliance program if a problem is later discovered. Similarly, undertaking proactive evaluations before a problem strikes can lower the applicable penalty range under the U.S. Sentencing Guidelines. Although the nature and the frequency of proactive evaluations may vary depending on the size and complexity of an organization, the idea behind such efforts is the same: continuous improve­ment and sustainability.”  Three key takeaways:  Ongoing monitoring is not limited to financial monitoring, a holistic approach would look at other indicia of corruption. Where there is compliance smoke, there is most usually a compliance fire. Continuous improvement can be achieved in a variety of efficient, cost-effective ways. Learn more about your ad choices. Visit megaphone.fm/adchoices The 2012 FCPA Guidance specified, “a good compliance program should constantly evolve. A company’s business changes over time, as do the environments in which it operates, the nature of its customers, the laws that govern its actions, and the standards of its industry. In addition, compliance programs do not just exist on paper but are followed in practice will inevitably uncover compliance weaknesses and require enhancements. Consequently, DOJ and SEC evaluate whether companies regularly review and improve their compliance programs and not allow them to become stale.”

Continuous improvement through continuous monitoring will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is a continuously evolving organism, just as your company is continually improving its business processes. The 2012 FCPA Guidance makes clear the “DOJ and SEC will give meaningful credit to thoughtful efforts to create a sustainable compliance program if a problem is later discovered. Similarly, undertaking proactive evaluations before a problem strikes can lower the applicable penalty range under the U.S. Sentencing Guidelines. Although the nature and the frequency of proactive evaluations may vary depending on the size and complexity of an organization, the idea behind such efforts is the same: continuous improve­ment and sustainability.”

 Three key takeaways: 

  1. Ongoing monitoring is not limited to financial monitoring, a holistic approach would look at other indicia of corruption.
  2. Where there is compliance smoke, there is most usually a compliance fire.
  3. Continuous improvement can be achieved in a variety of efficient, cost-effective ways.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Continuous Improvement Through Compliance Program Upgrades Continuous improvement can come in many different, shapes, sizes and packages. As with all things compliance, you are only limited by your imagination. Have you ever thought about a tech implementation as a way for continuous improvement? Probably not but it is also a way forward for continuous improvement. Think about that for a moment as this is taking the concept of continuous improvement and adding an ongoing tech solution. This is one of the areas both the Department of Justice (DOJ) and Securities and Exchange Commission (SEC) discussed in their jointly issued 2012 FCPA Guidance, as Hallmark 9 in the Ten Hallmarks of an Effective Compliance Program. This is not simply taking data from your compliance program and feeding it back in to create continuous improvement, but it is using a tech solution to not only make your compliance program run more efficiently but using that same tech solution to help continuously improve your compliance program. Such an approach uses the subject matter expertise (SME) of the tech solution provider to help the compliance professional come up with a more effective compliance program. For the compliance professional it is expanding out their reach and scope through the use of not only this tech SME but with the information from their own compliance program to create greater efficiencies and effectiveness.  Three key takeaways:  Even in continuous improvement, you are only limited by your imagination. The delivery of a tech solution for compliance can be beneficial in multiple ways. Start your analytics at the transaction level and move upwards. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 27 Apr 2020 17:00:00 -0000 Continuous Improvement Through Compliance Program Upgrades full Thomas Fox How can implementing a new tech solution lead to continuous improvement? Find out in this episode of 31 Days to a More Effective Compliance Program Continuous improvement can come in many different, shapes, sizes and packages. As with all things compliance, you are only limited by your imagination. Have you ever thought about a tech implementation as a way for continuous improvement? Probably not but it is also a way forward for continuous improvement. Think about that for a moment as this is taking the concept of continuous improvement and adding an ongoing tech solution. This is one of the areas both the Department of Justice (DOJ) and Securities and Exchange Commission (SEC) discussed in their jointly issued 2012 FCPA Guidance, as Hallmark 9 in the Ten Hallmarks of an Effective Compliance Program. This is not simply taking data from your compliance program and feeding it back in to create continuous improvement, but it is using a tech solution to not only make your compliance program run more efficiently but using that same tech solution to help continuously improve your compliance program. Such an approach uses the subject matter expertise (SME) of the tech solution provider to help the compliance professional come up with a more effective compliance program. For the compliance professional it is expanding out their reach and scope through the use of not only this tech SME but with the information from their own compliance program to create greater efficiencies and effectiveness.  Three key takeaways:  Even in continuous improvement, you are only limited by your imagination. The delivery of a tech solution for compliance can be beneficial in multiple ways. Start your analytics at the transaction level and move upwards. Learn more about your ad choices. Visit megaphone.fm/adchoices Continuous improvement can come in many different, shapes, sizes and packages. As with all things compliance, you are only limited by your imagination. Have you ever thought about a tech implementation as a way for continuous improvement? Probably not but it is also a way forward for continuous improvement. Think about that for a moment as this is taking the concept of continuous improvement and adding an ongoing tech solution. This is one of the areas both the Department of Justice (DOJ) and Securities and Exchange Commission (SEC) discussed in their jointly issued 2012 FCPA Guidance, as Hallmark 9 in the Ten Hallmarks of an Effective Compliance Program. This is not simply taking data from your compliance program and feeding it back in to create continuous improvement, but it is using a tech solution to not only make your compliance program run more efficiently but using that same tech solution to help continuously improve your compliance program.

Such an approach uses the subject matter expertise (SME) of the tech solution provider to help the compliance professional come up with a more effective compliance program. For the compliance professional it is expanding out their reach and scope through the use of not only this tech SME but with the information from their own compliance program to create greater efficiencies and effectiveness.

 Three key takeaways: 

  1. Even in continuous improvement, you are only limited by your imagination.
  2. The delivery of a tech solution for compliance can be beneficial in multiple ways.
  3. Start your analytics at the transaction level and move upwards.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Proactive monitoring for continuous improvement There are multiple areas in the DOJ’s 2019 Guidance which intersect with the area of continuous improvement. They include the following:  Prior Indications – Were there prior opportunities to detect the misconduct in question, such as audit reports identifying relevant control failures or allegations, complaints, or investigations? What is the company’s analysis of why such opportunities were missed?  Remediation – What specific changes has the company made to reduce the risk that the same or similar issues will not occur in the future? What specific remediation has addressed the issues identified in the root cause and missed opportunity analysis?  This ties to the 2012 FCPA Guidance, which made clear that compliance audits, with actionable remediation plans, are a key component of any effective compliance program. Another way to do achieve these multiple and intersecting goals is through proactive monitoring. Proactive monitoring is an excellent technique through which a company can engage in continuous improvement. Nonetheless, it has many other benefits including regulatory and evidence in a criminal investigation if needed under anti-corruption laws such as the FCPA. The bottom line is that all those scenarios might justify a company to engage a proactive monitorship to come in and do a complete ethics.  Three key takeaways:  A proactive monitorship can be reactive proactivity to look at a specific issue... …or used to test a compliance program… …or used in a variety of legal and business manners. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 24 Apr 2020 17:00:00 -0000 Proactive monitoring for continuous improvement full Thomas Fox How can proactive monitoring facilitate continuous improvement? Find out in today's episode of 31 Days to a More Effective Compliance Program. There are multiple areas in the DOJ’s 2019 Guidance which intersect with the area of continuous improvement. They include the following:  Prior Indications – Were there prior opportunities to detect the misconduct in question, such as audit reports identifying relevant control failures or allegations, complaints, or investigations? What is the company’s analysis of why such opportunities were missed?  Remediation – What specific changes has the company made to reduce the risk that the same or similar issues will not occur in the future? What specific remediation has addressed the issues identified in the root cause and missed opportunity analysis?  This ties to the 2012 FCPA Guidance, which made clear that compliance audits, with actionable remediation plans, are a key component of any effective compliance program. Another way to do achieve these multiple and intersecting goals is through proactive monitoring. Proactive monitoring is an excellent technique through which a company can engage in continuous improvement. Nonetheless, it has many other benefits including regulatory and evidence in a criminal investigation if needed under anti-corruption laws such as the FCPA. The bottom line is that all those scenarios might justify a company to engage a proactive monitorship to come in and do a complete ethics.  Three key takeaways:  A proactive monitorship can be reactive proactivity to look at a specific issue... …or used to test a compliance program… …or used in a variety of legal and business manners. Learn more about your ad choices. Visit megaphone.fm/adchoices There are multiple areas in the DOJ’s 2019 Guidance which intersect with the area of continuous improvement. They include the following:

 Prior Indications – Were there prior opportunities to detect the misconduct in question, such as audit reports identifying relevant control failures or allegations, complaints, or investigations? What is the company’s analysis of why such opportunities were missed? 

Remediation – What specific changes has the company made to reduce the risk that the same or similar issues will not occur in the future? What specific remediation has addressed the issues identified in the root cause and missed opportunity analysis? 

This ties to the 2012 FCPA Guidance, which made clear that compliance audits, with actionable remediation plans, are a key component of any effective compliance program. Another way to do achieve these multiple and intersecting goals is through proactive monitoring. Proactive monitoring is an excellent technique through which a company can engage in continuous improvement. Nonetheless, it has many other benefits including regulatory and evidence in a criminal investigation if needed under anti-corruption laws such as the FCPA. The bottom line is that all those scenarios might justify a company to engage a proactive monitorship to come in and do a complete ethics.

 Three key takeaways: 

  1. A proactive monitorship can be reactive proactivity to look at a specific issue...
  2. …or used to test a compliance program…
  3. …or used in a variety of legal and business manners.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Measuring the effectiveness of a compliance program Determining effectiveness is a key part of continuous improvement. Yet how to do so still bedevils many compliance professionals. You need to consider both outcomes and outputs. Outcomes will show you the results of specific actions, such as investigations and conclusions to them. Numbers are attractive because they can form a “straight line” about how your compliance program is functioning. But you must remember that the numbers only give you one view of a compliance program. You also need to consider the qualitative side of the equation. There is the need for both a quantitative and qualitative approach to measuring compliance program effectiveness. Numbers are important but they only tell part of the equation. Vin DiCianni has said, “Both are very important, but I think without having consideration of both sides of the equation, you will not obtain a full understanding of how effective compliance program is in its operation.” Three key takeaways: You should test your compliance program effectiveness through both a qualitative and quantitative approach. Bring in an outside party to interview your employees. The Resource Guide is an excellent resource to consider compliance program effectiveness. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 23 Apr 2020 17:00:00 -0000 Measuring the effectiveness of a compliance program full Thomas Fox How does measuring the effectiveness of your compliance program facilitate continuous improvement? Find out in this episode of 31 Days to a More Effective Compliance Program. Determining effectiveness is a key part of continuous improvement. Yet how to do so still bedevils many compliance professionals. You need to consider both outcomes and outputs. Outcomes will show you the results of specific actions, such as investigations and conclusions to them. Numbers are attractive because they can form a “straight line” about how your compliance program is functioning. But you must remember that the numbers only give you one view of a compliance program. You also need to consider the qualitative side of the equation. There is the need for both a quantitative and qualitative approach to measuring compliance program effectiveness. Numbers are important but they only tell part of the equation. Vin DiCianni has said, “Both are very important, but I think without having consideration of both sides of the equation, you will not obtain a full understanding of how effective compliance program is in its operation.” Three key takeaways: You should test your compliance program effectiveness through both a qualitative and quantitative approach. Bring in an outside party to interview your employees. The Resource Guide is an excellent resource to consider compliance program effectiveness. Learn more about your ad choices. Visit megaphone.fm/adchoices Determining effectiveness is a key part of continuous improvement. Yet how to do so still bedevils many compliance professionals. You need to consider both outcomes and outputs. Outcomes will show you the results of specific actions, such as investigations and conclusions to them. Numbers are attractive because they can form a “straight line” about how your compliance program is functioning. But you must remember that the numbers only give you one view of a compliance program. You also need to consider the qualitative side of the equation.

There is the need for both a quantitative and qualitative approach to measuring compliance program effectiveness. Numbers are important but they only tell part of the equation. Vin DiCianni has said, “Both are very important, but I think without having consideration of both sides of the equation, you will not obtain a full understanding of how effective compliance program is in its operation.”

Three key takeaways:

  1. You should test your compliance program effectiveness through both a qualitative and quantitative approach.
  2. Bring in an outside party to interview your employees.
  3. The Resource Guide is an excellent resource to consider compliance program effectiveness.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Using Data For Continuous Improvement Vince Walden has posited that “the black box is dead”. He meant that there is no single tool to use to identify high-risk transactions, customer, employees or third parties. Yet, it is now even easier to ask big insightful questions from your data. Every compliance professional should embrace this. Properly seen, compliance is a business process. As such you should keep in mind certain queries, such as: What are the company’s high compliance and ethics risks? Who within the organization is responsible for managing these risks? What controls are in place to manage these risks? Are these controls working? Are they effective? How do you know (or not) this? The key is that through greater data mining and asking more insightful questions of that data you can truly move from a reactive-detect mode to a proactive-prescriptive mode. Three key takeaways: The black box is dead. What is driving your risk scoring? Compliance as a business process must be driven by data. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 22 Apr 2020 17:00:00 -0000 Using Data For Continuous Improvement full Thomas Fox How to think through using data for continuous improvement? Find out in today's episode of 31 Days to a More Effective Compliance Program. Vince Walden has posited that “the black box is dead”. He meant that there is no single tool to use to identify high-risk transactions, customer, employees or third parties. Yet, it is now even easier to ask big insightful questions from your data. Every compliance professional should embrace this. Properly seen, compliance is a business process. As such you should keep in mind certain queries, such as: What are the company’s high compliance and ethics risks? Who within the organization is responsible for managing these risks? What controls are in place to manage these risks? Are these controls working? Are they effective? How do you know (or not) this? The key is that through greater data mining and asking more insightful questions of that data you can truly move from a reactive-detect mode to a proactive-prescriptive mode. Three key takeaways: The black box is dead. What is driving your risk scoring? Compliance as a business process must be driven by data. Learn more about your ad choices. Visit megaphone.fm/adchoices Vince Walden has posited that “the black box is dead”. He meant that there is no single tool to use to identify high-risk transactions, customer, employees or third parties. Yet, it is now even easier to ask big insightful questions from your data. Every compliance professional should embrace this.

Properly seen, compliance is a business process. As such you should keep in mind certain queries, such as:

  • What are the company’s high compliance and ethics risks?
  • Who within the organization is responsible for managing these risks?
  • What controls are in place to manage these risks?
  • Are these controls working? Are they effective?
  • How do you know (or not) this?

The key is that through greater data mining and asking more insightful questions of that data you can truly move from a reactive-detect mode to a proactive-prescriptive mode.

Three key takeaways:

  1. The black box is dead.
  2. What is driving your risk scoring?
  3. Compliance as a business process must be driven by data.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Big data and continuous improvement Consider again the use of big data, this time to facilitate continuous improvement. Alistair Croll, in an eBook entitled “Planning for Big Data” published by O’Reilly Radar, informs this discussion of continuous improvement in a best practices compliance program. Croll believes that big data will allow continuous improvement through the “feedback economy.” This is a step beyond the information economy because you are using the information that you have generated and collected as a source of information to guide you going forward. Information itself is not the greatest advantage but using that information to prevent, detect and remediate in a compliance program going forward is. The three prongs of any best practices compliance program are prevent, detect and remedy. Whether you consider the OODA loop or the big data supply chain feedback, this process, coupled with the data that is available to you should facilitate a more agile and directed compliance program. The feedback components allow you to make adjustments literally on the fly. If that does not meet the definition of continuous improvement, I do not know what does. Three key takeaways:  Use big data to continuously improve your compliance program. The OODA loop is an excellent way to think about using data to continuously improvement. Always remember the human element. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 21 Apr 2020 17:00:00 -0000 Big data and continuous improvement full Thomas Fox How can you us big data for continuous improvement of your compliance program? Find out in this episode of 31 Days to a More Effective Compliance Program. Consider again the use of big data, this time to facilitate continuous improvement. Alistair Croll, in an eBook entitled “Planning for Big Data” published by O’Reilly Radar, informs this discussion of continuous improvement in a best practices compliance program. Croll believes that big data will allow continuous improvement through the “feedback economy.” This is a step beyond the information economy because you are using the information that you have generated and collected as a source of information to guide you going forward. Information itself is not the greatest advantage but using that information to prevent, detect and remediate in a compliance program going forward is. The three prongs of any best practices compliance program are prevent, detect and remedy. Whether you consider the OODA loop or the big data supply chain feedback, this process, coupled with the data that is available to you should facilitate a more agile and directed compliance program. The feedback components allow you to make adjustments literally on the fly. If that does not meet the definition of continuous improvement, I do not know what does. Three key takeaways:  Use big data to continuously improve your compliance program. The OODA loop is an excellent way to think about using data to continuously improvement. Always remember the human element. Learn more about your ad choices. Visit megaphone.fm/adchoices Consider again the use of big data, this time to facilitate continuous improvement. Alistair Croll, in an eBook entitled “Planning for Big Data” published by O’Reilly Radar, informs this discussion of continuous improvement in a best practices compliance program. Croll believes that big data will allow continuous improvement through the “feedback economy.” This is a step beyond the information economy because you are using the information that you have generated and collected as a source of information to guide you going forward. Information itself is not the greatest advantage but using that information to prevent, detect and remediate in a compliance program going forward is.

The three prongs of any best practices compliance program are prevent, detect and remedy. Whether you consider the OODA loop or the big data supply chain feedback, this process, coupled with the data that is available to you should facilitate a more agile and directed compliance program. The feedback components allow you to make adjustments literally on the fly. If that does not meet the definition of continuous improvement, I do not know what does.

Three key takeaways: 

  1. Use big data to continuously improve your compliance program.
  2. The OODA loop is an excellent way to think about using data to continuously improvement.
  3. Always remember the human element.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Keeping track of current events for continuous improvement Keeping track of current events for continuous improvements a part of the mandates found in the 2019 Guidance. The DOJ clearly expects companies to update its risk assessment, policies, procedures and practices in light of changing circumstances. This means that if a third-party changes characteristics, so that it becomes subject to FCPA scrutiny, a company must be able to evaluate and react appropriately to such change. For the compliance practitioner, the Hitachi SEC enforcement action provides a valuable reminder that the FCPA covers more than foreign government officials and officials of state-owned enterprises. Political parties are also covered so that if part of your corporate social responsibility includes payments to political party front groups, your company could get into FCPA hot water. Yet it also means you will need to keep abreast of just who your counter-parties are during the entire course of your commercial relationship. This means that keeping up with current events is a must and can facilitate continuous improvement.  Three key takeaways:  The Hitachi FCPA enforcement action demonstrates the need to keep track of current events for continuous improvement. Many product and services providers in the compliance space provide ongoing monitoring for PEPs and SDNs. Make sure your partners are still who they say they are! Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 20 Apr 2020 16:46:54 -0000 Keeping track of current events for continuous improvement full Thomas Fox Keeping track of current events for continuous improvement of your compliance program. Keeping track of current events for continuous improvements a part of the mandates found in the 2019 Guidance. The DOJ clearly expects companies to update its risk assessment, policies, procedures and practices in light of changing circumstances. This means that if a third-party changes characteristics, so that it becomes subject to FCPA scrutiny, a company must be able to evaluate and react appropriately to such change. For the compliance practitioner, the Hitachi SEC enforcement action provides a valuable reminder that the FCPA covers more than foreign government officials and officials of state-owned enterprises. Political parties are also covered so that if part of your corporate social responsibility includes payments to political party front groups, your company could get into FCPA hot water. Yet it also means you will need to keep abreast of just who your counter-parties are during the entire course of your commercial relationship. This means that keeping up with current events is a must and can facilitate continuous improvement.  Three key takeaways:  The Hitachi FCPA enforcement action demonstrates the need to keep track of current events for continuous improvement. Many product and services providers in the compliance space provide ongoing monitoring for PEPs and SDNs. Make sure your partners are still who they say they are! Learn more about your ad choices. Visit megaphone.fm/adchoices Keeping track of current events for continuous improvements a part of the mandates found in the 2019 Guidance. The DOJ clearly expects companies to update its risk assessment, policies, procedures and practices in light of changing circumstances. This means that if a third-party changes characteristics, so that it becomes subject to FCPA scrutiny, a company must be able to evaluate and react appropriately to such change.

For the compliance practitioner, the Hitachi SEC enforcement action provides a valuable reminder that the FCPA covers more than foreign government officials and officials of state-owned enterprises. Political parties are also covered so that if part of your corporate social responsibility includes payments to political party front groups, your company could get into FCPA hot water. Yet it also means you will need to keep abreast of just who your counter-parties are during the entire course of your commercial relationship. This means that keeping up with current events is a must and can facilitate continuous improvement. 

Three key takeaways: 

  1. The Hitachi FCPA enforcement action demonstrates the need to keep track of current events for continuous improvement.
  2. Many product and services providers in the compliance space provide ongoing monitoring for PEPs and SDNs.
  3. Make sure your partners are still who they say they are!


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Monitoring for continuous improvement Another mechanism for continuous improvement of your compliance program is through risk-based monitoring. Under the topic of Control Testing DOJ’s 2019 Guidance posed the following questions, Has the company reviewed and audited its compliance program in the area relating to the misconduct? More generally, what testing of controls, collection and analysis of compliance data, and interviews of employees and third-parties does the company undertake? How are the results reported and action items tracked? Finally, the beauty of all these techniques articulated by Locwin is that they are tools that can make companies more efficient and, at the end of the day, more profitable. They also move compliance into the fabric and DNA of an organization or operationalize compliance. Her intonation to operationalize compliance speaks to the use of a wide variety of tools to input information, so you can continuously improve your compliance program. Risk-based monitoring is certainly one mechanism to obtain information and feed back into your compliance program in both the prevent and detect prongs.  Three key takeaways:  How do you monitor manifested risks? A risk-based monitoring approach allows you to see things in almost real-time. Management of risk can serve your compliance program in a variety of ways. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 17 Apr 2020 05:07:00 -0000 Monitoring for continuous improvement full Thomas Fox What is continuous monitoring and how does it lead to continuous improvement? Find out in this episode of 31 Days to a More Effective Compliance Program. Another mechanism for continuous improvement of your compliance program is through risk-based monitoring. Under the topic of Control Testing DOJ’s 2019 Guidance posed the following questions, Has the company reviewed and audited its compliance program in the area relating to the misconduct? More generally, what testing of controls, collection and analysis of compliance data, and interviews of employees and third-parties does the company undertake? How are the results reported and action items tracked? Finally, the beauty of all these techniques articulated by Locwin is that they are tools that can make companies more efficient and, at the end of the day, more profitable. They also move compliance into the fabric and DNA of an organization or operationalize compliance. Her intonation to operationalize compliance speaks to the use of a wide variety of tools to input information, so you can continuously improve your compliance program. Risk-based monitoring is certainly one mechanism to obtain information and feed back into your compliance program in both the prevent and detect prongs.  Three key takeaways:  How do you monitor manifested risks? A risk-based monitoring approach allows you to see things in almost real-time. Management of risk can serve your compliance program in a variety of ways. Learn more about your ad choices. Visit megaphone.fm/adchoices Another mechanism for continuous improvement of your compliance program is through risk-based monitoring. Under the topic of Control Testing DOJ’s 2019 Guidance posed the following questions, Has the company reviewed and audited its compliance program in the area relating to the misconduct? More generally, what testing of controls, collection and analysis of compliance data, and interviews of employees and third-parties does the company undertake? How are the results reported and action items tracked?

Finally, the beauty of all these techniques articulated by Locwin is that they are tools that can make companies more efficient and, at the end of the day, more profitable. They also move compliance into the fabric and DNA of an organization or operationalize compliance. Her intonation to operationalize compliance speaks to the use of a wide variety of tools to input information, so you can continuously improve your compliance program. Risk-based monitoring is certainly one mechanism to obtain information and feed back into your compliance program in both the prevent and detect prongs.

 Three key takeaways: 

  1. How do you monitor manifested risks?
  2. A risk-based monitoring approach allows you to see things in almost real-time.
  3. Management of risk can serve your compliance program in a variety of ways.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no The mock audit A program manager in a power plant process group told me about the “mock audit” that his company performs in its power plants across the country. He explained that his industry is heavily regulated at both the state and federal level. Power plants are subject to numerous levels of oversight including various ISO standards to which they must comply. ISO is the International Organization for Standardization, and it develops and publishes International Standards for various industries and organizations. The DOJ has continually made clear that compliance audits, with actionable remediation plans, are a key component of any effective compliance program. The concept of the mock audit is one that can facilitate continuous improvement. It is a process designed to help your employees do business in a more compliant manner and it is a tool that should not be overlooked. Three key takeaways:  Always remember compliance folks and the business folks wear the same color shirt. Review your findings with the group being assessed. Use the mock audit to both learn and educate. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 16 Apr 2020 05:13:00 -0000 The mock audit full Thomas Fox The mock audit can be a powerful tool for a compliance professional. Find out more in today's 31 Days to a More Effective Compliance Program. A program manager in a power plant process group told me about the “mock audit” that his company performs in its power plants across the country. He explained that his industry is heavily regulated at both the state and federal level. Power plants are subject to numerous levels of oversight including various ISO standards to which they must comply. ISO is the International Organization for Standardization, and it develops and publishes International Standards for various industries and organizations. The DOJ has continually made clear that compliance audits, with actionable remediation plans, are a key component of any effective compliance program. The concept of the mock audit is one that can facilitate continuous improvement. It is a process designed to help your employees do business in a more compliant manner and it is a tool that should not be overlooked. Three key takeaways:  Always remember compliance folks and the business folks wear the same color shirt. Review your findings with the group being assessed. Use the mock audit to both learn and educate. Learn more about your ad choices. Visit megaphone.fm/adchoices A program manager in a power plant process group told me about the “mock audit” that his company performs in its power plants across the country. He explained that his industry is heavily regulated at both the state and federal level. Power plants are subject to numerous levels of oversight including various ISO standards to which they must comply. ISO is the International Organization for Standardization, and it develops and publishes International Standards for various industries and organizations.

The DOJ has continually made clear that compliance audits, with actionable remediation plans, are a key component of any effective compliance program. The concept of the mock audit is one that can facilitate continuous improvement. It is a process designed to help your employees do business in a more compliant manner and it is a tool that should not be overlooked.

Three key takeaways: 

  1. Always remember compliance folks and the business folks wear the same color shirt.
  2. Review your findings with the group being assessed.
  3. Use the mock audit to both learn and educate.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no The Integrity Audit Yet another way to consider using audit for continuous improvement is through the Integrity Audit. Mary Jo White in an article entitled “What I’ve Learned About White Collar Crime” provided insight into not only white-collar criminals but the integrity of companies. Her framework lays out a way for you to think through an underutilized tool for continuous improvement, the integrity audit. When Mary Jo White or Jonathan Marks write, you need to read, digest what they have to say and implement their suggestions. The ideas that they forward are not new, revolutionary or in the least bit controversial. Yet integrity is not often considered by compliance professionals. With the Business Roundtable’s Statement of Corporate Purpose integrity has been driven to the forefront in the rasion d’etre of a corporation. Failing to have integrity at the top or down through your organization can lead to significant corporate calamity. Three key takeaways:  The Integrity Audit is an underutilized tool. Ego and arrogance at the CEO level can lead to catastrophic corporate failures. A robust report culture can demonstrate and facilitate corporate integrity. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 15 Apr 2020 17:22:10 -0000 The Integrity Audit full Thomas Fox What is the Integrity Audit and how does it facilitate continuous improvement? Find out in today's 31 Days to a More Effective Compliance Program. Yet another way to consider using audit for continuous improvement is through the Integrity Audit. Mary Jo White in an article entitled “What I’ve Learned About White Collar Crime” provided insight into not only white-collar criminals but the integrity of companies. Her framework lays out a way for you to think through an underutilized tool for continuous improvement, the integrity audit. When Mary Jo White or Jonathan Marks write, you need to read, digest what they have to say and implement their suggestions. The ideas that they forward are not new, revolutionary or in the least bit controversial. Yet integrity is not often considered by compliance professionals. With the Business Roundtable’s Statement of Corporate Purpose integrity has been driven to the forefront in the rasion d’etre of a corporation. Failing to have integrity at the top or down through your organization can lead to significant corporate calamity. Three key takeaways:  The Integrity Audit is an underutilized tool. Ego and arrogance at the CEO level can lead to catastrophic corporate failures. A robust report culture can demonstrate and facilitate corporate integrity. Learn more about your ad choices. Visit megaphone.fm/adchoices Yet another way to consider using audit for continuous improvement is through the Integrity Audit. Mary Jo White in an article entitled “What I’ve Learned About White Collar Crime” provided insight into not only white-collar criminals but the integrity of companies. Her framework lays out a way for you to think through an underutilized tool for continuous improvement, the integrity audit.

When Mary Jo White or Jonathan Marks write, you need to read, digest what they have to say and implement their suggestions. The ideas that they forward are not new, revolutionary or in the least bit controversial. Yet integrity is not often considered by compliance professionals. With the Business Roundtable’s Statement of Corporate Purpose integrity has been driven to the forefront in the rasion d’etre of a corporation. Failing to have integrity at the top or down through your organization can lead to significant corporate calamity.

Three key takeaways: 

  1. The Integrity Audit is an underutilized tool.
  2. Ego and arrogance at the CEO level can lead to catastrophic corporate failures.
  3. A robust report culture can demonstrate and facilitate corporate integrity.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no The Fraud Audit Consider how a fraud audit using data analytics can help to detect or prevent bribery and corruption where the primary sales force used by a company are China based employees defrauding their company by using false expense reports to create a pot of money to use as a slush fund to pay bribes. Here you can think back to the Eli Lilly FCPA enforcement action up to the GSK problems as examples of where employees used their expense accounts not for personal use but for greater corporate malfeasance. This double dipping technique led to two anti-bribery compliance enforcement actions. One in the U.S. involving Eli Lily and a second in China involving the U.K. pharmaceutical entity GSK. The risk is real and by using ongoing data monitoring you might not only get ahead of the legal violation, but you would have a much more efficient business process going forward. Three key takeaways:  The typical fraud audit will get down into the weeds with data analytics. Split dollar expenses are key metric. Double-dipping can lead to larger problems. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 14 Apr 2020 05:06:00 -0000 The Fraud Audit full Thomas Fox What is the fraud audit and how does it help continuous improvement in a compliance program? Find out in today's episode of 31 Days to a More Effective Compliance Program. Consider how a fraud audit using data analytics can help to detect or prevent bribery and corruption where the primary sales force used by a company are China based employees defrauding their company by using false expense reports to create a pot of money to use as a slush fund to pay bribes. Here you can think back to the Eli Lilly FCPA enforcement action up to the GSK problems as examples of where employees used their expense accounts not for personal use but for greater corporate malfeasance. This double dipping technique led to two anti-bribery compliance enforcement actions. One in the U.S. involving Eli Lily and a second in China involving the U.K. pharmaceutical entity GSK. The risk is real and by using ongoing data monitoring you might not only get ahead of the legal violation, but you would have a much more efficient business process going forward. Three key takeaways:  The typical fraud audit will get down into the weeds with data analytics. Split dollar expenses are key metric. Double-dipping can lead to larger problems. Learn more about your ad choices. Visit megaphone.fm/adchoices Consider how a fraud audit using data analytics can help to detect or prevent bribery and corruption where the primary sales force used by a company are China based employees defrauding their company by using false expense reports to create a pot of money to use as a slush fund to pay bribes. Here you can think back to the Eli Lilly FCPA enforcement action up to the GSK problems as examples of where employees used their expense accounts not for personal use but for greater corporate malfeasance.

This double dipping technique led to two anti-bribery compliance enforcement actions. One in the U.S. involving Eli Lily and a second in China involving the U.K. pharmaceutical entity GSK. The risk is real and by using ongoing data monitoring you might not only get ahead of the legal violation, but you would have a much more efficient business process going forward.

Three key takeaways: 

  1. The typical fraud audit will get down into the weeds with data analytics.
  2. Split dollar expenses are key metric.
  3. Double-dipping can lead to larger problems.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no The culture audit What is organizational culture? Eric R. Feldman, SVP at Affiliated Monitors Inc. (AMI), has said it comprises the mission, vision and values of an organization. A similar way to consider it might be as a company’s values, visions, norms and beliefs. Whichever way you define it or look at it, corporate culture affects how groups within a company interact with each other. A key inquiry is whether the corporate incentive structure supports the articulated beliefs of a company. How does one measure or audit these articulations? Companies must have a high-performance corporate culture for doing business ethically. One of the ways to do so is through the culture audit. It can also be a powerful tool for continuous improvement going forward. Find out what your employees are saying about your corporate mission, vision and values and most importantly remediate if those mission, vision and values are found wanting.  Three key takeaways:  What are the mission, vision and values of a company? What are the compensation and promotion incentives in the culture? Is your motto “Always be closing” or closer to “doing business ethically and in compliance”? Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 13 Apr 2020 16:31:45 -0000 The culture audit full Thomas Fox How does a culture audit facilitate continuous improvement? Find out in today's episode of 31 Days to a More Effective Compliance Program. What is organizational culture? Eric R. Feldman, SVP at Affiliated Monitors Inc. (AMI), has said it comprises the mission, vision and values of an organization. A similar way to consider it might be as a company’s values, visions, norms and beliefs. Whichever way you define it or look at it, corporate culture affects how groups within a company interact with each other. A key inquiry is whether the corporate incentive structure supports the articulated beliefs of a company. How does one measure or audit these articulations? Companies must have a high-performance corporate culture for doing business ethically. One of the ways to do so is through the culture audit. It can also be a powerful tool for continuous improvement going forward. Find out what your employees are saying about your corporate mission, vision and values and most importantly remediate if those mission, vision and values are found wanting.  Three key takeaways:  What are the mission, vision and values of a company? What are the compensation and promotion incentives in the culture? Is your motto “Always be closing” or closer to “doing business ethically and in compliance”? Learn more about your ad choices. Visit megaphone.fm/adchoices What is organizational culture? Eric R. Feldman, SVP at Affiliated Monitors Inc. (AMI), has said it comprises the mission, vision and values of an organization. A similar way to consider it might be as a company’s values, visions, norms and beliefs. Whichever way you define it or look at it, corporate culture affects how groups within a company interact with each other. A key inquiry is whether the corporate incentive structure supports the articulated beliefs of a company. How does one measure or audit these articulations?

Companies must have a high-performance corporate culture for doing business ethically. One of the ways to do so is through the culture audit. It can also be a powerful tool for continuous improvement going forward. Find out what your employees are saying about your corporate mission, vision and values and most importantly remediate if those mission, vision and values are found wanting.

 Three key takeaways: 

  1. What are the mission, vision and values of a company?
  2. What are the compensation and promotion incentives in the culture?
  3. Is your motto “Always be closing” or closer to “doing business ethically and in compliance”?


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Supply Chain audits In my last corporate position, my company was at the compliance forefront because we required compliance related audits for vendors in the supply chain. This was cutting edge in 2007-08. However, now an audit for adherence to compliance requirements has become a standard best practice in the management of business relationships with third-party vendors in the supply chain. In several settlements of enforcement actions through both DPAs and NPAs, in the 2012 FCPA Guidance and, most recently, in the 2019 Guidance, the DOJ made it clear that a best practices compliance program includes the right to conduct audits of the books and records of its suppliers to ensure compliance. Many companies have yet to begin their audit process for FCPA compliance on vendors in their supply chain. This is a missed opportunity from both the compliance perspective and greater business efficiency. Any organization which audits a business partner in its supply chain should consult with legal, audit, financial and supply chain professionals to determine the full scope of the audit and a thorough and complete work plan should be created based upon all these professional inputs. After an audit, an audit report should be issued. This audit report should detail incidents of non-compliance with the compliance program and recommendations for improvements. Any reported incidents of non-compliance should reference the basis, such as contractual clauses, legal requirement or company policies.  Three key takeaways:  Is your supply chain vendor committed to the audit process? Capture the data, analyze the data, report on the data. Supply chain audits are no longer cutting edge but are now simply best practices. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 10 Apr 2020 17:00:00 -0000 Supply Chain audits full Thomas Fox Why is a Supply Chain audit critical for any best practices compliance program? Find out in today's 31 Days to a More Effective Compliance Program. In my last corporate position, my company was at the compliance forefront because we required compliance related audits for vendors in the supply chain. This was cutting edge in 2007-08. However, now an audit for adherence to compliance requirements has become a standard best practice in the management of business relationships with third-party vendors in the supply chain. In several settlements of enforcement actions through both DPAs and NPAs, in the 2012 FCPA Guidance and, most recently, in the 2019 Guidance, the DOJ made it clear that a best practices compliance program includes the right to conduct audits of the books and records of its suppliers to ensure compliance. Many companies have yet to begin their audit process for FCPA compliance on vendors in their supply chain. This is a missed opportunity from both the compliance perspective and greater business efficiency. Any organization which audits a business partner in its supply chain should consult with legal, audit, financial and supply chain professionals to determine the full scope of the audit and a thorough and complete work plan should be created based upon all these professional inputs. After an audit, an audit report should be issued. This audit report should detail incidents of non-compliance with the compliance program and recommendations for improvements. Any reported incidents of non-compliance should reference the basis, such as contractual clauses, legal requirement or company policies.  Three key takeaways:  Is your supply chain vendor committed to the audit process? Capture the data, analyze the data, report on the data. Supply chain audits are no longer cutting edge but are now simply best practices. Learn more about your ad choices. Visit megaphone.fm/adchoices In my last corporate position, my company was at the compliance forefront because we required compliance related audits for vendors in the supply chain. This was cutting edge in 2007-08. However, now an audit for adherence to compliance requirements has become a standard best practice in the management of business relationships with third-party vendors in the supply chain. In several settlements of enforcement actions through both DPAs and NPAs, in the 2012 FCPA Guidance and, most recently, in the 2019 Guidance, the DOJ made it clear that a best practices compliance program includes the right to conduct audits of the books and records of its suppliers to ensure compliance. Many companies have yet to begin their audit process for FCPA compliance on vendors in their supply chain. This is a missed opportunity from both the compliance perspective and greater business efficiency.

Any organization which audits a business partner in its supply chain should consult with legal, audit, financial and supply chain professionals to determine the full scope of the audit and a thorough and complete work plan should be created based upon all these professional inputs. After an audit, an audit report should be issued. This audit report should detail incidents of non-compliance with the compliance program and recommendations for improvements. Any reported incidents of non-compliance should reference the basis, such as contractual clauses, legal requirement or company policies.

 Three key takeaways: 

  1. Is your supply chain vendor committed to the audit process?
  2. Capture the data, analyze the data, report on the data.
  3. Supply chain audits are no longer cutting edge but are now simply best practices.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Financial health of third-parties Continuous improvement can take many ways, shapes and forms. One thing that is most generally not considered is the financial health of the third-party. It turns out such an oversight may have some significantly ramifications for an accurate picture of a third-party. The financial health of third-parties is not only a key metric but also a key due diligence tool which allows a more robust assessment prior to contract signing and in managing the relationship after the contract has been signed.  Continuous improvement through monitoring of ongoing financial health is a tool where technological solutions can have an impact. Understanding the financial viability of third-parties can help the compliance practitioner meet the DOJ requirement to more fully operationalize a compliance program. It can also lead to more and better operational stability and with that ever-sought increase in corporate profitability. As compliance moves into the business process, this type of review should become part of your compliance toolkit going forward.  Three key takeaways:  What is the financial health of your third-parties? Poor financial results can open a company to engaging in risky behavior. Financial health monitoring can be used as continuous improvement. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 09 Apr 2020 17:00:00 -0000 Financial health of third-parties full Thomas Fox Why is the financial health of your 3rd parties a critical due diligence concern? Find out in today's episode of 31 Days to a More Effective Compliance Program. Continuous improvement can take many ways, shapes and forms. One thing that is most generally not considered is the financial health of the third-party. It turns out such an oversight may have some significantly ramifications for an accurate picture of a third-party. The financial health of third-parties is not only a key metric but also a key due diligence tool which allows a more robust assessment prior to contract signing and in managing the relationship after the contract has been signed.  Continuous improvement through monitoring of ongoing financial health is a tool where technological solutions can have an impact. Understanding the financial viability of third-parties can help the compliance practitioner meet the DOJ requirement to more fully operationalize a compliance program. It can also lead to more and better operational stability and with that ever-sought increase in corporate profitability. As compliance moves into the business process, this type of review should become part of your compliance toolkit going forward.  Three key takeaways:  What is the financial health of your third-parties? Poor financial results can open a company to engaging in risky behavior. Financial health monitoring can be used as continuous improvement. Learn more about your ad choices. Visit megaphone.fm/adchoices Continuous improvement can take many ways, shapes and forms. One thing that is most generally not considered is the financial health of the third-party. It turns out such an oversight may have some significantly ramifications for an accurate picture of a third-party. The financial health of third-parties is not only a key metric but also a key due diligence tool which allows a more robust assessment prior to contract signing and in managing the relationship after the contract has been signed. 

Continuous improvement through monitoring of ongoing financial health is a tool where technological solutions can have an impact. Understanding the financial viability of third-parties can help the compliance practitioner meet the DOJ requirement to more fully operationalize a compliance program. It can also lead to more and better operational stability and with that ever-sought increase in corporate profitability. As compliance moves into the business process, this type of review should become part of your compliance toolkit going forward.

 Three key takeaways: 

  1. What is the financial health of your third-parties?
  2. Poor financial results can open a company to engaging in risky behavior.
  3. Financial health monitoring can be used as continuous improvement.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Monitoring of third-parties How can data analytics be used for continuous improvement where the primary sales force used by a company is third-parties? A clear majority of FCPA violations and related enforcement actions have come from the use of third-parties. While sham contracting (i.e., using a third-party to conduit the payment of a bribe) has lessened in recent years, there are related data analysis that can be performed to ascertain whether a third-party is likely performing legitimate services for your company. There are several more analytics that can be run in combination to identify suspicious third-parties and some of the simplest can be to look for duplicate or erroneous payments, all of which can lead to continuous improvement. Here we focus on the question posed by the 2019 Guidance, How does the company monitor its third parties? The final concept of finding patterns that can be discerned through the aggregation of huge amounts of transactions, is the next step for compliance functions. Yet data analysis does far more than simply allow you to follow the money. It can be a part of your third-party ongoing monitoring as well by allowing you to partner the information on third-parties who might come into your company where there was no proper compliance vetting. The opportunity for continuous improvement through a feedback loop is obvious and a clear step you should take going forward.   Three key takeaways:  Always remember to follow the money to see where a pot of money could be created to fund a bribe. Transaction monitoring techniques around fraud monitoring translate to data analysis for compliance. Do not forget to check names against known PEP and SDN lists. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 08 Apr 2020 17:00:00 -0000 Monitoring of third-parties full Thomas Fox How to think through the monitoring of 3rd parties? Find out in today's episode of 31 Days to a More Effective Compliance Program. How can data analytics be used for continuous improvement where the primary sales force used by a company is third-parties? A clear majority of FCPA violations and related enforcement actions have come from the use of third-parties. While sham contracting (i.e., using a third-party to conduit the payment of a bribe) has lessened in recent years, there are related data analysis that can be performed to ascertain whether a third-party is likely performing legitimate services for your company. There are several more analytics that can be run in combination to identify suspicious third-parties and some of the simplest can be to look for duplicate or erroneous payments, all of which can lead to continuous improvement. Here we focus on the question posed by the 2019 Guidance, How does the company monitor its third parties? The final concept of finding patterns that can be discerned through the aggregation of huge amounts of transactions, is the next step for compliance functions. Yet data analysis does far more than simply allow you to follow the money. It can be a part of your third-party ongoing monitoring as well by allowing you to partner the information on third-parties who might come into your company where there was no proper compliance vetting. The opportunity for continuous improvement through a feedback loop is obvious and a clear step you should take going forward.   Three key takeaways:  Always remember to follow the money to see where a pot of money could be created to fund a bribe. Transaction monitoring techniques around fraud monitoring translate to data analysis for compliance. Do not forget to check names against known PEP and SDN lists. Learn more about your ad choices. Visit megaphone.fm/adchoices How can data analytics be used for continuous improvement where the primary sales force used by a company is third-parties? A clear majority of FCPA violations and related enforcement actions have come from the use of third-parties. While sham contracting (i.e., using a third-party to conduit the payment of a bribe) has lessened in recent years, there are related data analysis that can be performed to ascertain whether a third-party is likely performing legitimate services for your company. There are several more analytics that can be run in combination to identify suspicious third-parties and some of the simplest can be to look for duplicate or erroneous payments, all of which can lead to continuous improvement. Here we focus on the question posed by the 2019 Guidance, How does the company monitor its third parties?

The final concept of finding patterns that can be discerned through the aggregation of huge amounts of transactions, is the next step for compliance functions. Yet data analysis does far more than simply allow you to follow the money. It can be a part of your third-party ongoing monitoring as well by allowing you to partner the information on third-parties who might come into your company where there was no proper compliance vetting. The opportunity for continuous improvement through a feedback loop is obvious and a clear step you should take going forward. 

 Three key takeaways: 

  1. Always remember to follow the money to see where a pot of money could be created to fund a bribe.
  2. Transaction monitoring techniques around fraud monitoring translate to data analysis for compliance.
  3. Do not forget to check names against known PEP and SDN lists.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Auditing of third-parties Third-parties still present the highest risk around compliance. Indeed, in the area of third-parties the 2019 Guidance, posed the following question in a section entitled, Management of Relationships – How has the company considered and analyzed the compensation and incentive structures for third parties against compliance risks? How does the company monitor its third parties? Does the company have audit rights to analyze the books and accounts of third parties, and has the company exercised those rights in the past?  It is therefore critical that you use monitoring and auditing when it comes to continuous improvement for this high-risk area. Next, we consider three aspects of a company’s audit program for its compliance function: the types and purpose of third-party audits, planning for third-party audits and interviewing third-parties. Three key takeaways:  Start planning your third-party audit 4-6 weeks in advance of the actual audit. Use your business sponsor to help facilitate the process with the third-party. This is not a “gotcha” interview but an open Q&A process where you have a golden opportunity to educate as you ask questions. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 07 Apr 2020 17:00:00 -0000 Auditing of third-parties full Thomas Fox What are some of the considerations for auditing 3rd party agents? Find out in this episode of 31 Days to a More Effective Compliance Program. Third-parties still present the highest risk around compliance. Indeed, in the area of third-parties the 2019 Guidance, posed the following question in a section entitled, Management of Relationships – How has the company considered and analyzed the compensation and incentive structures for third parties against compliance risks? How does the company monitor its third parties? Does the company have audit rights to analyze the books and accounts of third parties, and has the company exercised those rights in the past?  It is therefore critical that you use monitoring and auditing when it comes to continuous improvement for this high-risk area. Next, we consider three aspects of a company’s audit program for its compliance function: the types and purpose of third-party audits, planning for third-party audits and interviewing third-parties. Three key takeaways:  Start planning your third-party audit 4-6 weeks in advance of the actual audit. Use your business sponsor to help facilitate the process with the third-party. This is not a “gotcha” interview but an open Q&A process where you have a golden opportunity to educate as you ask questions. Learn more about your ad choices. Visit megaphone.fm/adchoices Third-parties still present the highest risk around compliance. Indeed, in the area of third-parties the 2019 Guidance, posed the following question in a section entitled, Management of Relationships – How has the company considered and analyzed the compensation and incentive structures for third parties against compliance risks? How does the company monitor its third parties? Does the company have audit rights to analyze the books and accounts of third parties, and has the company exercised those rights in the past? 

It is therefore critical that you use monitoring and auditing when it comes to continuous improvement for this high-risk area. Next, we consider three aspects of a company’s audit program for its compliance function: the types and purpose of third-party audits, planning for third-party audits and interviewing third-parties.

Three key takeaways: 

  1. Start planning your third-party audit 4-6 weeks in advance of the actual audit.
  2. Use your business sponsor to help facilitate the process with the third-party.
  3. This is not a “gotcha” interview but an open Q&A process where you have a golden opportunity to educate as you ask questions.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Designing a process for continuous monitoring Most CCOs and compliance practitioners understand the need for continuous monitoring. Whether it be as a part of your overall monitoring of third-parties, employees, or to test the overall effectiveness of internal controls and compliance, continuous monitoring is clearly a part of a best practices compliance program. Further, while most compliance practitioners are aware of the tools which can be applied for continuous monitoring, they may not be as aware of how to engage in the process. Put another way, how do you develop a methodology for building a continuous controls monitoring process that yields sustainable, repeatable results?  Joe Oringel, co-founder and principal at Visual Risk IQ uses a five-step process. The steps are: 1) brainstorm, 2) acquire and map data, 3) write queries, 4) analyze and report, and 5) refine and sustain. If you can establish your extraction and mapping rules, using common data models within your organization, you can use them to generate risk and performance checks going forward. Finally, through thoughtful use of continuous monitoring parameters, you can create metrics that you can internally benchmark your compliance regime against over time to show to any regulators who might come knocking.  Three key takeaways:  Create a process to monitor your controls. Use a compliance SME to work with your internal controls specialist to develop queries from the compliance perspective. Finally, do not forget the feedback loop nature of the process by integrating your results going forward. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 06 Apr 2020 17:00:00 -0000 Designing a process for continuous monitoring full Thomas Fox How can you design a process for continuous monitoring? Find out in today's episode of 31 Days to a More Effective Compliance Program. Most CCOs and compliance practitioners understand the need for continuous monitoring. Whether it be as a part of your overall monitoring of third-parties, employees, or to test the overall effectiveness of internal controls and compliance, continuous monitoring is clearly a part of a best practices compliance program. Further, while most compliance practitioners are aware of the tools which can be applied for continuous monitoring, they may not be as aware of how to engage in the process. Put another way, how do you develop a methodology for building a continuous controls monitoring process that yields sustainable, repeatable results?  Joe Oringel, co-founder and principal at Visual Risk IQ uses a five-step process. The steps are: 1) brainstorm, 2) acquire and map data, 3) write queries, 4) analyze and report, and 5) refine and sustain. If you can establish your extraction and mapping rules, using common data models within your organization, you can use them to generate risk and performance checks going forward. Finally, through thoughtful use of continuous monitoring parameters, you can create metrics that you can internally benchmark your compliance regime against over time to show to any regulators who might come knocking.  Three key takeaways:  Create a process to monitor your controls. Use a compliance SME to work with your internal controls specialist to develop queries from the compliance perspective. Finally, do not forget the feedback loop nature of the process by integrating your results going forward. Learn more about your ad choices. Visit megaphone.fm/adchoices Most CCOs and compliance practitioners understand the need for continuous monitoring. Whether it be as a part of your overall monitoring of third-parties, employees, or to test the overall effectiveness of internal controls and compliance, continuous monitoring is clearly a part of a best practices compliance program. Further, while most compliance practitioners are aware of the tools which can be applied for continuous monitoring, they may not be as aware of how to engage in the process. Put another way, how do you develop a methodology for building a continuous controls monitoring process that yields sustainable, repeatable results?

 Joe Oringel, co-founder and principal at Visual Risk IQ uses a five-step process. The steps are: 1) brainstorm, 2) acquire and map data, 3) write queries, 4) analyze and report, and 5) refine and sustain. If you can establish your extraction and mapping rules, using common data models within your organization, you can use them to generate risk and performance checks going forward. Finally, through thoughtful use of continuous monitoring parameters, you can create metrics that you can internally benchmark your compliance regime against over time to show to any regulators who might come knocking.

 Three key takeaways: 

  1. Create a process to monitor your controls.
  2. Use a compliance SME to work with your internal controls specialist to develop queries from the compliance perspective.
  3. Finally, do not forget the feedback loop nature of the process by integrating your results going forward.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Internal audit and continuous improvement Next, we consider how the internal audit (IA) function can be used to facilitate more effective continuous improvement. According to the Institute of Internal Auditors’ own definition, internal audit is “an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.” Some of the key compliance activities of IA are to maintain its independence; to conduct auditing activity of awareness and adherence to policies, procedures, internal controls and corporate governance, including those relating to legal, compliance and ethics risks; to ensure there is follow up of recommendations made in IA reports, including those relating to compliance and ethics risks, including to track and report on management follow up; assist and collaborate on internal investigations, including having IA provide audit expertise in dealing with internal controls and financial data; assist in both design and auditing of internal controls and follow up as required. Clearly this is a function which is and should be integrated into compliance. For its part, the compliance function can leverage IA resources and professionals on audit techniques and analysis of internal controls and such integration extends the corporate compliance influence through the company’s IA network. Finally, it allows the corporate compliance function to be made aware of relevant concerns uncovered during audits, so compliance is more fully able to participate in recommendations and follow up. Three key takeaways:  Internal audit can be used to provide continuous improvement to and for compliance. Internal audit can also fill a gatekeeper role in your compliance regime. Compliance should leverage IA resources and professionals, on audit techniques and analysis of internal controls. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 03 Apr 2020 16:35:06 -0000 Internal audit and continuous improvement full Thomas Fox How can compliance leverage internal audit for continuous improvement? Find out in today's episode of 31 Days to a More Effective Compliance Program. Next, we consider how the internal audit (IA) function can be used to facilitate more effective continuous improvement. According to the Institute of Internal Auditors’ own definition, internal audit is “an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.” Some of the key compliance activities of IA are to maintain its independence; to conduct auditing activity of awareness and adherence to policies, procedures, internal controls and corporate governance, including those relating to legal, compliance and ethics risks; to ensure there is follow up of recommendations made in IA reports, including those relating to compliance and ethics risks, including to track and report on management follow up; assist and collaborate on internal investigations, including having IA provide audit expertise in dealing with internal controls and financial data; assist in both design and auditing of internal controls and follow up as required. Clearly this is a function which is and should be integrated into compliance. For its part, the compliance function can leverage IA resources and professionals on audit techniques and analysis of internal controls and such integration extends the corporate compliance influence through the company’s IA network. Finally, it allows the corporate compliance function to be made aware of relevant concerns uncovered during audits, so compliance is more fully able to participate in recommendations and follow up. Three key takeaways:  Internal audit can be used to provide continuous improvement to and for compliance. Internal audit can also fill a gatekeeper role in your compliance regime. Compliance should leverage IA resources and professionals, on audit techniques and analysis of internal controls. Learn more about your ad choices. Visit megaphone.fm/adchoices Next, we consider how the internal audit (IA) function can be used to facilitate more effective continuous improvement. According to the Institute of Internal Auditors’ own definition, internal audit is “an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.”

Some of the key compliance activities of IA are to maintain its independence; to conduct auditing activity of awareness and adherence to policies, procedures, internal controls and corporate governance, including those relating to legal, compliance and ethics risks; to ensure there is follow up of recommendations made in IA reports, including those relating to compliance and ethics risks, including to track and report on management follow up; assist and collaborate on internal investigations, including having IA provide audit expertise in dealing with internal controls and financial data; assist in both design and auditing of internal controls and follow up as required. Clearly this is a function which is and should be integrated into compliance.

For its part, the compliance function can leverage IA resources and professionals on audit techniques and analysis of internal controls and such integration extends the corporate compliance influence through the company’s IA network. Finally, it allows the corporate compliance function to be made aware of relevant concerns uncovered during audits, so compliance is more fully able to participate in recommendations and follow up.

Three key takeaways: 

  1. Internal audit can be used to provide continuous improvement to and for compliance.
  2. Internal audit can also fill a gatekeeper role in your compliance regime.
  3. Compliance should leverage IA resources and professionals, on audit techniques and analysis of internal controls.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no The compliance audit One clear best practices to gauge the compliance culture and evaluate the strength of controls, is to conduct periodic audits to ensure that controls are functioning well. Interestingly, compliance in many ways follows some of the paths laid out by corporate safety departments some 20-30 years ago when safety became much more high profile in U.S. corporations. The safety committee and safety audits became mainstays of any best practices in the area of safety for a company. These techniques inform any anti-corruption best practices compliance program. Indeed, audits were specifically delineated as far back as the 2012 FCPA Guidance to assist in the continuous monitoring of your compliance regime. Such an audit can be thought of as a systematic, independent and documented process for obtaining evidence and evaluating it objectively to determine the extent to which the compliance criteria are fulfilled. There are three factors which are critical for a compliance audit to have a chance for success: 1) an effective audit program which specifies all necessary activities for the audit; 2) having competent auditors in place; and 3) an organization that is committed to being audited. Auditing is a more limited review that targets a specific business component, region or market sector during a timeframe to uncover and/or evaluate certain risks, particularly as seen in financial records. However, you should not assume that because your company conducts audits that it is effectively monitoring. In other words, the protocol is simple, everyone understands you need to audit, but try and cut costs or corners and you will pay for it in the long run. Three key takeaways:  Auditing takes a deep dive into your high-risk compliance areas. Internal audit should test your key compliance risk areas as a part of their regular auditor rotation. The findings uncovered in an audit must be used in your compliance regime going forward. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 02 Apr 2020 18:36:52 -0000 The compliance audit full Thomas Fox What is the role of the compliance audit in continuous improvement of a best practices compliance program? Find out in this episode of 31 Days to a More Effective Compliance Program. One clear best practices to gauge the compliance culture and evaluate the strength of controls, is to conduct periodic audits to ensure that controls are functioning well. Interestingly, compliance in many ways follows some of the paths laid out by corporate safety departments some 20-30 years ago when safety became much more high profile in U.S. corporations. The safety committee and safety audits became mainstays of any best practices in the area of safety for a company. These techniques inform any anti-corruption best practices compliance program. Indeed, audits were specifically delineated as far back as the 2012 FCPA Guidance to assist in the continuous monitoring of your compliance regime. Such an audit can be thought of as a systematic, independent and documented process for obtaining evidence and evaluating it objectively to determine the extent to which the compliance criteria are fulfilled. There are three factors which are critical for a compliance audit to have a chance for success: 1) an effective audit program which specifies all necessary activities for the audit; 2) having competent auditors in place; and 3) an organization that is committed to being audited. Auditing is a more limited review that targets a specific business component, region or market sector during a timeframe to uncover and/or evaluate certain risks, particularly as seen in financial records. However, you should not assume that because your company conducts audits that it is effectively monitoring. In other words, the protocol is simple, everyone understands you need to audit, but try and cut costs or corners and you will pay for it in the long run. Three key takeaways:  Auditing takes a deep dive into your high-risk compliance areas. Internal audit should test your key compliance risk areas as a part of their regular auditor rotation. The findings uncovered in an audit must be used in your compliance regime going forward. Learn more about your ad choices. Visit megaphone.fm/adchoices One clear best practices to gauge the compliance culture and evaluate the strength of controls, is to conduct periodic audits to ensure that controls are functioning well. Interestingly, compliance in many ways follows some of the paths laid out by corporate safety departments some 20-30 years ago when safety became much more high profile in U.S. corporations. The safety committee and safety audits became mainstays of any best practices in the area of safety for a company. These techniques inform any anti-corruption best practices compliance program. Indeed, audits were specifically delineated as far back as the 2012 FCPA Guidance to assist in the continuous monitoring of your compliance regime. Such an audit can be thought of as a systematic, independent and documented process for obtaining evidence and evaluating it objectively to determine the extent to which the compliance criteria are fulfilled. There are three factors which are critical for a compliance audit to have a chance for success: 1) an effective audit program which specifies all necessary activities for the audit; 2) having competent auditors in place; and 3) an organization that is committed to being audited.

Auditing is a more limited review that targets a specific business component, region or market sector during a timeframe to uncover and/or evaluate certain risks, particularly as seen in financial records. However, you should not assume that because your company conducts audits that it is effectively monitoring. In other words, the protocol is simple, everyone understands you need to audit, but try and cut costs or corners and you will pay for it in the long run.

Three key takeaways: 

  1. Auditing takes a deep dive into your high-risk compliance areas.
  2. Internal audit should test your key compliance risk areas as a part of their regular auditor rotation.
  3. The findings uncovered in an audit must be used in your compliance regime going forward.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Continuous improvement in a compliance program In this month's podcast series, I consider what techniques to use to create continuous improvement in your compliance program. As the DOJ stated in the 2019 Guidance “One hallmark of an effective compliance program is its capacity to improve and evolve.” Its implementation should help you to uncover and evaluate areas of risk and opportunities for improvement. Moreover as your business changes over time, in such areas as the environments in which it operates, the nature of its customers, the laws applicable to it and industry standards; your compliance program must change as well. All of this simply means business is dynamic and your compliance regime must be so as well. Continuous improvement through continuous monitoring or other techniques will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is in many ways a continuously evolving organism, just as your company is constantly evolving. Three key takeaways:  Your compliance program should be continually evolving. Have a mechanism to incorporate lessons learned from oversight into your compliance program. The DOJ and SEC will give meaningful credit to thoughtful efforts to create a sustainable compliance program if a problem is later discovered. For more information on Affiliated Monitors, visit their website, www.affiliatedmonitors.com.  Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 01 Apr 2020 16:07:00 -0000 Continuous improvement in a compliance program full Thomas Fox In this month's podcast series of 31 Days to a More Effective Compliance Program, I consider the topic of continuous improvement. In this month's podcast series, I consider what techniques to use to create continuous improvement in your compliance program. As the DOJ stated in the 2019 Guidance “One hallmark of an effective compliance program is its capacity to improve and evolve.” Its implementation should help you to uncover and evaluate areas of risk and opportunities for improvement. Moreover as your business changes over time, in such areas as the environments in which it operates, the nature of its customers, the laws applicable to it and industry standards; your compliance program must change as well. All of this simply means business is dynamic and your compliance regime must be so as well. Continuous improvement through continuous monitoring or other techniques will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is in many ways a continuously evolving organism, just as your company is constantly evolving. Three key takeaways:  Your compliance program should be continually evolving. Have a mechanism to incorporate lessons learned from oversight into your compliance program. The DOJ and SEC will give meaningful credit to thoughtful efforts to create a sustainable compliance program if a problem is later discovered. For more information on Affiliated Monitors, visit their website, www.affiliatedmonitors.com.  Learn more about your ad choices. Visit megaphone.fm/adchoices In this month's podcast series, I consider what techniques to use to create continuous improvement in your compliance program. As the DOJ stated in the 2019 Guidance “One hallmark of an effective compliance program is its capacity to improve and evolve.” Its implementation should help you to uncover and evaluate areas of risk and opportunities for improvement. Moreover as your business changes over time, in such areas as the environments in which it operates, the nature of its customers, the laws applicable to it and industry standards; your compliance program must change as well. All of this simply means business is dynamic and your compliance regime must be so as well.

Continuous improvement through continuous monitoring or other techniques will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is in many ways a continuously evolving organism, just as your company is constantly evolving.

Three key takeaways: 

  1. Your compliance program should be continually evolving.
  2. Have a mechanism to incorporate lessons learned from oversight into your compliance program.
  3. The DOJ and SEC will give meaningful credit to thoughtful efforts to create a sustainable compliance program if a problem is later discovered.


For more information on Affiliated Monitors, visit their website, www.affiliatedmonitors.com. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no What does innovation in compliance look like? With the DOJ Evaluation’s emphasis on operationalizing your compliance regime, innovation is an important tool for you to use in this journey, yet one that is too often overlooked. We have considered a variety of innovations in compliance; from innovations in structure, use of social media tools and concepts, to new and different ways to consider your internal resources as ways to innovate in your compliance regime. The DOJ has consistently said that a compliance program must evolve. It must evolve to meet new or updated risks, new opportunities or different regulations. Innovation is one of the best ways to evolve. Finally, and perhaps most importantly as a compliance practitioner, always remember that you are only limited by your imagination.  Three key takeaways: Innovation is one of the most overlooked and under-utilized tools in compliance. Operationalizing your compliance program will require innovation in your compliance program going forward. As with most CCO initiatives, you are only limited by your imagination. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 31 Mar 2020 17:00:00 -0000 What does innovation in compliance look like? full Thomas Fox What does innovation in compliance look like? Find out in our concluding episode of 31 Days to a More Effective Program for innovation in compliance. With the DOJ Evaluation’s emphasis on operationalizing your compliance regime, innovation is an important tool for you to use in this journey, yet one that is too often overlooked. We have considered a variety of innovations in compliance; from innovations in structure, use of social media tools and concepts, to new and different ways to consider your internal resources as ways to innovate in your compliance regime. The DOJ has consistently said that a compliance program must evolve. It must evolve to meet new or updated risks, new opportunities or different regulations. Innovation is one of the best ways to evolve. Finally, and perhaps most importantly as a compliance practitioner, always remember that you are only limited by your imagination.  Three key takeaways: Innovation is one of the most overlooked and under-utilized tools in compliance. Operationalizing your compliance program will require innovation in your compliance program going forward. As with most CCO initiatives, you are only limited by your imagination. Learn more about your ad choices. Visit megaphone.fm/adchoices With the DOJ Evaluation’s emphasis on operationalizing your compliance regime, innovation is an important tool for you to use in this journey, yet one that is too often overlooked.

We have considered a variety of innovations in compliance; from innovations in structure, use of social media tools and concepts, to new and different ways to consider your internal resources as ways to innovate in your compliance regime. The DOJ has consistently said that a compliance program must evolve. It must evolve to meet new or updated risks, new opportunities or different regulations. Innovation is one of the best ways to evolve. Finally, and perhaps most importantly as a compliance practitioner, always remember that you are only limited by your imagination.

 Three key takeaways:

  1. Innovation is one of the most overlooked and under-utilized tools in compliance.
  2. Operationalizing your compliance program will require innovation in your compliance program going forward.
  3. As with most CCO initiatives, you are only limited by your imagination.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Innovation in Compliance Leadership Given the paucity of leadership coming out of Washington during this crisis, I thought it would be a ripe time to consider some innovations in compliance leadership. While many compliance departments may have begun more as a command and control function, set up by lawyers to comply with anti-bribery laws such as the Foreign Corrupt Practices Act (FCPA), this type of leadership model is now becoming outmoded in today’s world. It is not that employees are interested in the ‘why’ they should do business ethically and in compliance with such laws but it is more that power is shifting inside corporations. Given the paucity of leadership coming out of Washington during this crisis, I thought it would be a ripe time to consider some innovations in compliance leadership. While many compliance departments may have begun more as a command and control function, set up by lawyers to comply with anti-bribery laws such as the Foreign Corrupt Practices Act (FCPA), this type of leadership model is now becoming outmoded in today’s world. It is not that employees are interested in the ‘why’ they should do business ethically and in compliance with such laws but it is more that power is shifting inside corporations. As the compliance profession matures, it will become more a component of a company’s business function. This means less of a lawyer’s top down mentality of do it because I said to do it, to more collaboration. Three key takeaways: The lawyer-driven command and control method for compliance is outmoded and outdated. Innovation in compliance leadership is recognizing the bi-lateral nature of power and communications in an organization. A feedback loop can be used in the leadership function as well. For more information on our sponsor, Affiliated Monitors Inc. check out their website, by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 30 Mar 2020 17:01:17 -0000 Innovation in Compliance Leadership full Thomas Fox What is innovation in compliance leadership? Find out in this episode of 31 Days to a More Effective Compliance Program. Given the paucity of leadership coming out of Washington during this crisis, I thought it would be a ripe time to consider some innovations in compliance leadership. While many compliance departments may have begun more as a command and control function, set up by lawyers to comply with anti-bribery laws such as the Foreign Corrupt Practices Act (FCPA), this type of leadership model is now becoming outmoded in today’s world. It is not that employees are interested in the ‘why’ they should do business ethically and in compliance with such laws but it is more that power is shifting inside corporations. Given the paucity of leadership coming out of Washington during this crisis, I thought it would be a ripe time to consider some innovations in compliance leadership. While many compliance departments may have begun more as a command and control function, set up by lawyers to comply with anti-bribery laws such as the Foreign Corrupt Practices Act (FCPA), this type of leadership model is now becoming outmoded in today’s world. It is not that employees are interested in the ‘why’ they should do business ethically and in compliance with such laws but it is more that power is shifting inside corporations. As the compliance profession matures, it will become more a component of a company’s business function. This means less of a lawyer’s top down mentality of do it because I said to do it, to more collaboration. Three key takeaways: The lawyer-driven command and control method for compliance is outmoded and outdated. Innovation in compliance leadership is recognizing the bi-lateral nature of power and communications in an organization. A feedback loop can be used in the leadership function as well. For more information on our sponsor, Affiliated Monitors Inc. check out their website, by clicking here.  Learn more about your ad choices. Visit megaphone.fm/adchoices Given the paucity of leadership coming out of Washington during this crisis, I thought it would be a ripe time to consider some innovations in compliance leadership. While many compliance departments may have begun more as a command and control function, set up by lawyers to comply with anti-bribery laws such as the Foreign Corrupt Practices Act (FCPA), this type of leadership model is now becoming outmoded in today’s world. It is not that employees are interested in the ‘why’ they should do business ethically and in compliance with such laws but it is more that power is shifting inside corporations.

Given the paucity of leadership coming out of Washington during this crisis, I thought it would be a ripe time to consider some innovations in compliance leadership. While many compliance departments may have begun more as a command and control function, set up by lawyers to comply with anti-bribery laws such as the Foreign Corrupt Practices Act (FCPA), this type of leadership model is now becoming outmoded in today’s world. It is not that employees are interested in the ‘why’ they should do business ethically and in compliance with such laws but it is more that power is shifting inside corporations.

As the compliance profession matures, it will become more a component of a company’s business function. This means less of a lawyer’s top down mentality of do it because I said to do it, to more collaboration.

Three key takeaways:

  1. The lawyer-driven command and control method for compliance is outmoded and outdated.
  2. Innovation in compliance leadership is recognizing the bi-lateral nature of power and communications in an organization.
  3. A feedback loop can be used in the leadership function as well.

For more information on our sponsor, Affiliated Monitors Inc. check out their website, by clicking here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Innovation in Investigative Due Diligence Candice Tal is the founder and Chief Executive Officer (CEO) of Infortal Worldwide, and one of the top experts around on due diligence. In an interview, I asked Tal about the use of AI in investigative due diligence and specifically how AI has led innovation in investigative due diligence. Tal believes that AI will be a “game changer” in compliance. Massive data sets require some type of AI to sort through and analyze the information. This is particularly important for internal controls and accounting books and records provisions to identify massive fraud. This is yet another area which is still developing. Tal stated, “I’ll frame that by saying at least in the next few years, there will still be a need for the traditional investigative approach that the boots on the ground, one where an investigator goes out and physically checks on facilities. Artificial intelligence is going to have limited ability to do that.” While drones may become part of an investigators tool kit, Tal believes that AI will be used “in a similar way to most data aggregators today. They find about 80% of the information. Yet there will always be the remaining 20% which they cannot find and you will need human intervention on the investigative side.” Looking down the road to the veiled land of the future, Tal sees continued innovation facilitating investigative due diligence. While AI is more than simply on the horizon, she said it “is a tried and tested methodology that has existed for many years, in terms of how you look for and locate shell companies.” It is also true about finding information about people who are trying to deliberately hide information. The bottom line is some of these investigative techniques involve old-fashioned shoe leather or simply hard diligent investigative work and “that’s not new”. Yet AI and other technological tools can make investigations more efficient and more cost effective, while giving better results. At the end of the day, AI can be used to sharpen and hone the due diligence process. Three key takeaways: AI can help change the face of due diligence. AI will facilitate data aggregation in due diligence investigations. Always remember the human element. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 27 Mar 2020 17:00:00 -0000 Innovation in Investigative Due Diligence full Thomas Fox How will AI change investigative due diligence? Find out in today's episode of 31 Days to a More Effective Compliance Program. Candice Tal is the founder and Chief Executive Officer (CEO) of Infortal Worldwide, and one of the top experts around on due diligence. In an interview, I asked Tal about the use of AI in investigative due diligence and specifically how AI has led innovation in investigative due diligence. Tal believes that AI will be a “game changer” in compliance. Massive data sets require some type of AI to sort through and analyze the information. This is particularly important for internal controls and accounting books and records provisions to identify massive fraud. This is yet another area which is still developing. Tal stated, “I’ll frame that by saying at least in the next few years, there will still be a need for the traditional investigative approach that the boots on the ground, one where an investigator goes out and physically checks on facilities. Artificial intelligence is going to have limited ability to do that.” While drones may become part of an investigators tool kit, Tal believes that AI will be used “in a similar way to most data aggregators today. They find about 80% of the information. Yet there will always be the remaining 20% which they cannot find and you will need human intervention on the investigative side.” Looking down the road to the veiled land of the future, Tal sees continued innovation facilitating investigative due diligence. While AI is more than simply on the horizon, she said it “is a tried and tested methodology that has existed for many years, in terms of how you look for and locate shell companies.” It is also true about finding information about people who are trying to deliberately hide information. The bottom line is some of these investigative techniques involve old-fashioned shoe leather or simply hard diligent investigative work and “that’s not new”. Yet AI and other technological tools can make investigations more efficient and more cost effective, while giving better results. At the end of the day, AI can be used to sharpen and hone the due diligence process. Three key takeaways: AI can help change the face of due diligence. AI will facilitate data aggregation in due diligence investigations. Always remember the human element. Learn more about your ad choices. Visit megaphone.fm/adchoices Candice Tal is the founder and Chief Executive Officer (CEO) of Infortal Worldwide, and one of the top experts around on due diligence. In an interview, I asked Tal about the use of AI in investigative due diligence and specifically how AI has led innovation in investigative due diligence. Tal believes that AI will be a “game changer” in compliance. Massive data sets require some type of AI to sort through and analyze the information. This is particularly important for internal controls and accounting books and records provisions to identify massive fraud. This is yet another area which is still developing. Tal stated, “I’ll frame that by saying at least in the next few years, there will still be a need for the traditional investigative approach that the boots on the ground, one where an investigator goes out and physically checks on facilities. Artificial intelligence is going to have limited ability to do that.” While drones may become part of an investigators tool kit, Tal believes that AI will be used “in a similar way to most data aggregators today. They find about 80% of the information. Yet there will always be the remaining 20% which they cannot find and you will need human intervention on the investigative side.”

Looking down the road to the veiled land of the future, Tal sees continued innovation facilitating investigative due diligence. While AI is more than simply on the horizon, she said it “is a tried and tested methodology that has existed for many years, in terms of how you look for and locate shell companies.” It is also true about finding information about people who are trying to deliberately hide information. The bottom line is some of these investigative techniques involve old-fashioned shoe leather or simply hard diligent investigative work and “that’s not new”. Yet AI and other technological tools can make investigations more efficient and more cost effective, while giving better results. At the end of the day, AI can be used to sharpen and hone the due diligence process.

Three key takeaways:

  1. AI can help change the face of due diligence.
  2. AI will facilitate data aggregation in due diligence investigations.
  3. Always remember the human element.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no The Regional Compliance Committee Innovation can come in various forms for an organization. Innovation can appear in a structural form. You can move compliance more deeply into your organization with new or different structures. One I have seen have success is a Compliance Committee more closely tied to the geographic market in the field or the Regional Compliance Committee.  All of this works to adds a dimension not often seen or even discussed in the compliance profession. The accountability and oversight down to the regional level and the compliance monitoring, reviewing, assessing and recommending that is deemed to be necessary will provide additional endorsements up through the organization that it is actually doing compliance. In compliance, it is execution where the rubber meets the road. A Regional Compliance Committee can provide your compliance program a unique structure to perform these functions.  Three key takeaways: Innovation can occur in structural changes to your compliance function. A Regional Compliance Committee puts compliance closer to the ground in geographic regions outside the U.S. A Regional Compliance Committee facilitates execution of your compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 26 Mar 2020 17:00:00 -0000 The Regional Compliance Committee full Thomas Fox Innovation in compliance can come in many forms. Sometimes that innovation can be structural. Find out more in today's edition of 31 Days to a More Effective Compliance Program. Innovation can come in various forms for an organization. Innovation can appear in a structural form. You can move compliance more deeply into your organization with new or different structures. One I have seen have success is a Compliance Committee more closely tied to the geographic market in the field or the Regional Compliance Committee.  All of this works to adds a dimension not often seen or even discussed in the compliance profession. The accountability and oversight down to the regional level and the compliance monitoring, reviewing, assessing and recommending that is deemed to be necessary will provide additional endorsements up through the organization that it is actually doing compliance. In compliance, it is execution where the rubber meets the road. A Regional Compliance Committee can provide your compliance program a unique structure to perform these functions.  Three key takeaways: Innovation can occur in structural changes to your compliance function. A Regional Compliance Committee puts compliance closer to the ground in geographic regions outside the U.S. A Regional Compliance Committee facilitates execution of your compliance program. Learn more about your ad choices. Visit megaphone.fm/adchoices Innovation can come in various forms for an organization. Innovation can appear in a structural form. You can move compliance more deeply into your organization with new or different structures. One I have seen have success is a Compliance Committee more closely tied to the geographic market in the field or the Regional Compliance Committee.

 All of this works to adds a dimension not often seen or even discussed in the compliance profession. The accountability and oversight down to the regional level and the compliance monitoring, reviewing, assessing and recommending that is deemed to be necessary will provide additional endorsements up through the organization that it is actually doing compliance. In compliance, it is execution where the rubber meets the road. A Regional Compliance Committee can provide your compliance program a unique structure to perform these functions.

 Three key takeaways:

  1. Innovation can occur in structural changes to your compliance function.
  2. A Regional Compliance Committee puts compliance closer to the ground in geographic regions outside the U.S.
  3. A Regional Compliance Committee facilitates execution of your compliance program.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Moving Data Science the Last Mile This is still a tricky area for most legally trained compliance professionals as law schools are far behind the business world in teaching these skills. Yet, not only data analysis but also the presentation of data in a visual format will be a key skill for every Chief Compliance Officer (CCO) and compliance practitioner going forward. However, if you do not possess those skills yourself, you can create a kitchen cabinet of experts, from the talent available across your company, which you can call upon to help you going forward. For the CCO, this will require extensive out of the box thinking to help you not only understand the data and analytics but think through how to present it in the most efficient manner to your leadership. Three key takeaways: Look for talented and curious employees to be a part of your data science team. Encourage cross-mentoring to facilitate skills learning and transference. Moving the final mile is the most challenging. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 25 Mar 2020 17:00:00 -0000 Moving Data Science the Last Mile full Thomas Fox How can a CCO create a data science team for the compliance function? Find out in today's episode of 31 Days to a More Effective Compliance Program. This is still a tricky area for most legally trained compliance professionals as law schools are far behind the business world in teaching these skills. Yet, not only data analysis but also the presentation of data in a visual format will be a key skill for every Chief Compliance Officer (CCO) and compliance practitioner going forward. However, if you do not possess those skills yourself, you can create a kitchen cabinet of experts, from the talent available across your company, which you can call upon to help you going forward. For the CCO, this will require extensive out of the box thinking to help you not only understand the data and analytics but think through how to present it in the most efficient manner to your leadership. Three key takeaways: Look for talented and curious employees to be a part of your data science team. Encourage cross-mentoring to facilitate skills learning and transference. Moving the final mile is the most challenging. Learn more about your ad choices. Visit megaphone.fm/adchoices This is still a tricky area for most legally trained compliance professionals as law schools are far behind the business world in teaching these skills. Yet, not only data analysis but also the presentation of data in a visual format will be a key skill for every Chief Compliance Officer (CCO) and compliance practitioner going forward. However, if you do not possess those skills yourself, you can create a kitchen cabinet of experts, from the talent available across your company, which you can call upon to help you going forward. For the CCO, this will require extensive out of the box thinking to help you not only understand the data and analytics but think through how to present it in the most efficient manner to your leadership.

Three key takeaways:

  1. Look for talented and curious employees to be a part of your data science team.
  2. Encourage cross-mentoring to facilitate skills learning and transference.
  3. Moving the final mile is the most challenging.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Innovation through Originating a Compliance Ecosystem The compliance profession seems to be an inflection point, moving away from the lawyer-driven written policies and procedures to a more operationalized regime where compliance is a part of the overall ecosystem embedded directly in business process focused discipline. Seen in this manner, compliance will be seen not as a cost center but as a value creation center, helping the company to make business processes more efficient and then more profitable. To be the orchestrator and prime mover of a compliance ecosystem, you need a superior compliance service that is hard to replicate. This means some combination of compliance, a large network of internal users and strong branding.  Compliance is undergoing a paradigm shift as a result of technological and digital innovation. CCOs who cannot interpret the data from their own systems will likely find themselves consigned to the dustbin of corporate luddites. Compliance is moving into a new era of collaboration and connection to more fully operationalize compliance to make all business stakeholders more efficient and at the end of the day more profitable. Three Key Takeaways: Compliance is undergoing a paradigm shift as a result of technological and digital innovation. to be the orchestrator and prime mover of a compliance ecosystem, you need a superior service that is hard to replicate. Compliance should help other corporate functions. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 24 Mar 2020 17:00:00 -0000 Innovation through Originating a Compliance Ecosystem full Thomas Fox Compliance is moving into a new era of collaboration and connection to more fully operationalize compliance to make all business stakeholders more efficient and at the end of the day more profitable. One way to do so is with a compliance ecosystem. The compliance profession seems to be an inflection point, moving away from the lawyer-driven written policies and procedures to a more operationalized regime where compliance is a part of the overall ecosystem embedded directly in business process focused discipline. Seen in this manner, compliance will be seen not as a cost center but as a value creation center, helping the company to make business processes more efficient and then more profitable. To be the orchestrator and prime mover of a compliance ecosystem, you need a superior compliance service that is hard to replicate. This means some combination of compliance, a large network of internal users and strong branding.  Compliance is undergoing a paradigm shift as a result of technological and digital innovation. CCOs who cannot interpret the data from their own systems will likely find themselves consigned to the dustbin of corporate luddites. Compliance is moving into a new era of collaboration and connection to more fully operationalize compliance to make all business stakeholders more efficient and at the end of the day more profitable. Three Key Takeaways: Compliance is undergoing a paradigm shift as a result of technological and digital innovation. to be the orchestrator and prime mover of a compliance ecosystem, you need a superior service that is hard to replicate. Compliance should help other corporate functions. Learn more about your ad choices. Visit megaphone.fm/adchoices The compliance profession seems to be an inflection point, moving away from the lawyer-driven written policies and procedures to a more operationalized regime where compliance is a part of the overall ecosystem embedded directly in business process focused discipline. Seen in this manner, compliance will be seen not as a cost center but as a value creation center, helping the company to make business processes more efficient and then more profitable. To be the orchestrator and prime mover of a compliance ecosystem, you need a superior compliance service that is hard to replicate. This means some combination of compliance, a large network of internal users and strong branding. 

Compliance is undergoing a paradigm shift as a result of technological and digital innovation. CCOs who cannot interpret the data from their own systems will likely find themselves consigned to the dustbin of corporate luddites. Compliance is moving into a new era of collaboration and connection to more fully operationalize compliance to make all business stakeholders more efficient and at the end of the day more profitable.

Three Key Takeaways:

  1. Compliance is undergoing a paradigm shift as a result of technological and digital innovation.
  2. to be the orchestrator and prime mover of a compliance ecosystem, you need a superior service that is hard to replicate.
  3. Compliance should help other corporate functions.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Using Innovation to Break Through Silos Name any catastrophic corporate compliance failure and every root cause analysis will show there were silos which compliance could not break through. In the Boeing 737 Max design failure there was the siloed nature of the entire design, creation, training, regulatory and implementation team for the safety feature, the failed Maneuvering Characteristics Augmentation System (MCAS). At Wells Fargo, it was the siloed nature of the commercial banking group from other corporate disciplines such as legal, internal audit, human resources and even the Board of Directors. The over-riding theme was the number of compliance miss-steps that led to these disasters. While the siloed nature of these organizations processes led to a literal number of very small steps which contributed to the final disaster, it demonstrated to me even more clearly why compliance must not only have a seat the table but also be embedded throughout your organization. Three Key Takeaways: Every major corporate scandal involves silos. Compliance should rotate senior leadership through its function. A CCO must be curious. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 23 Mar 2020 17:00:00 -0000 Using Innovation to Break Through Silos full Thomas Fox How can compliance use innovation to break through corporate silos? Find out in today's episode of 31 Days to a More Effective Compliance Program. Name any catastrophic corporate compliance failure and every root cause analysis will show there were silos which compliance could not break through. In the Boeing 737 Max design failure there was the siloed nature of the entire design, creation, training, regulatory and implementation team for the safety feature, the failed Maneuvering Characteristics Augmentation System (MCAS). At Wells Fargo, it was the siloed nature of the commercial banking group from other corporate disciplines such as legal, internal audit, human resources and even the Board of Directors. The over-riding theme was the number of compliance miss-steps that led to these disasters. While the siloed nature of these organizations processes led to a literal number of very small steps which contributed to the final disaster, it demonstrated to me even more clearly why compliance must not only have a seat the table but also be embedded throughout your organization. Three Key Takeaways: Every major corporate scandal involves silos. Compliance should rotate senior leadership through its function. A CCO must be curious. Learn more about your ad choices. Visit megaphone.fm/adchoices Name any catastrophic corporate compliance failure and every root cause analysis will show there were silos which compliance could not break through. In the Boeing 737 Max design failure there was the siloed nature of the entire design, creation, training, regulatory and implementation team for the safety feature, the failed Maneuvering Characteristics Augmentation System (MCAS). At Wells Fargo, it was the siloed nature of the commercial banking group from other corporate disciplines such as legal, internal audit, human resources and even the Board of Directors. The over-riding theme was the number of compliance miss-steps that led to these disasters. While the siloed nature of these organizations processes led to a literal number of very small steps which contributed to the final disaster, it demonstrated to me even more clearly why compliance must not only have a seat the table but also be embedded throughout your organization.

Three Key Takeaways:

  1. Every major corporate scandal involves silos.
  2. Compliance should rotate senior leadership through its function.
  3. A CCO must be curious.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no AI as a Competitive Advantage One thing is certain going into 2020 and beyond is that technology that will improve the efficiency of compliance and will assist in the operationalization of compliance into fabric of every business which embraces it. I would posit that the compliance professional who incorporates the techniques they advocate into their organization’s compliance program will not only move their compliance program forward but also make their company run more efficiently and, at the end of the day, more profitably. AI is a step which weds the human interaction and experiences with the data which is available to every company - its own internal information which is most generally sitting in siloed verticals and not being used. This data can provide the foundation for business research and risk-forecasting models and AI. When you couple this data with the insights into what humans do well or poorly; you can pair the best of these two seemingly disparate incongruities. Moreover, when a compliance function embraces the use of AI and embraces this human and technological approach for forecasting and risk assessments and then keeps improving their risk management techniques, it will create a sustainable strategic business, compliance and intelligence advantage over its competition. Three Key Takeaways: Use the big data in your own organization. Break down silos to get the data. Using the data in your own organization will drive greater business efficiency and greater profitability. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 20 Mar 2020 17:00:00 -0000 AI as a Competitive Advantage full Thomas Fox How does AI provide a competitive advantage in business through the compliance function? Find out in today's episode of 31 Days to a More Effective Compliance Program. One thing is certain going into 2020 and beyond is that technology that will improve the efficiency of compliance and will assist in the operationalization of compliance into fabric of every business which embraces it. I would posit that the compliance professional who incorporates the techniques they advocate into their organization’s compliance program will not only move their compliance program forward but also make their company run more efficiently and, at the end of the day, more profitably. AI is a step which weds the human interaction and experiences with the data which is available to every company - its own internal information which is most generally sitting in siloed verticals and not being used. This data can provide the foundation for business research and risk-forecasting models and AI. When you couple this data with the insights into what humans do well or poorly; you can pair the best of these two seemingly disparate incongruities. Moreover, when a compliance function embraces the use of AI and embraces this human and technological approach for forecasting and risk assessments and then keeps improving their risk management techniques, it will create a sustainable strategic business, compliance and intelligence advantage over its competition. Three Key Takeaways: Use the big data in your own organization. Break down silos to get the data. Using the data in your own organization will drive greater business efficiency and greater profitability. Learn more about your ad choices. Visit megaphone.fm/adchoices One thing is certain going into 2020 and beyond is that technology that will improve the efficiency of compliance and will assist in the operationalization of compliance into fabric of every business which embraces it. I would posit that the compliance professional who incorporates the techniques they advocate into their organization’s compliance program will not only move their compliance program forward but also make their company run more efficiently and, at the end of the day, more profitably.

AI is a step which weds the human interaction and experiences with the data which is available to every company - its own internal information which is most generally sitting in siloed verticals and not being used. This data can provide the foundation for business research and risk-forecasting models and AI. When you couple this data with the insights into what humans do well or poorly; you can pair the best of these two seemingly disparate incongruities. Moreover, when a compliance function embraces the use of AI and embraces this human and technological approach for forecasting and risk assessments and then keeps improving their risk management techniques, it will create a sustainable strategic business, compliance and intelligence advantage over its competition.

Three Key Takeaways:

  1. Use the big data in your own organization.
  2. Break down silos to get the data.
  3. Using the data in your own organization will drive greater business efficiency and greater profitability.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Design Thinking for Compliance Design thinking is another innovation which can help the CCO move forward in a cutting-edge manner to make a compliance program not only more robust but also operationalize it into the fabric of the company. Such a mechanism would help to drive compliance into the operational nature of a company. This design thinking protocol can help to create a more effective ethics and compliance training model by using employees to provide the initial input to improve its effectiveness and relevance to the front-line employees. The compliance team then implements several proposed solutions until the most operative one or ones becomes apparent. These are then rolled out companywide for better and more effective compliance training. As the entire process is documented, when the regulators, such as the DOJ or SEC, come knocking, you will have the ability to not only explain your training but also demonstrate its effectiveness. Three key takeaways: Design thinking concepts are not simply for product innovation but for culture innovation. Design thinking works around the users’ needs rather internal operating efficiencies. For a compliance program, this means employees, third-parties and customers. Design thinking works to improve your compliance regime by building from the ground up rather than a legalistic top-down approach. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 19 Mar 2020 17:00:00 -0000 Design Thinking for Compliance full Thomas Fox What is design thinking and how can it help to innovate in compliance? Find out in today's episode of 31 Days to a More Effective Compliance Program. Design thinking is another innovation which can help the CCO move forward in a cutting-edge manner to make a compliance program not only more robust but also operationalize it into the fabric of the company. Such a mechanism would help to drive compliance into the operational nature of a company. This design thinking protocol can help to create a more effective ethics and compliance training model by using employees to provide the initial input to improve its effectiveness and relevance to the front-line employees. The compliance team then implements several proposed solutions until the most operative one or ones becomes apparent. These are then rolled out companywide for better and more effective compliance training. As the entire process is documented, when the regulators, such as the DOJ or SEC, come knocking, you will have the ability to not only explain your training but also demonstrate its effectiveness. Three key takeaways: Design thinking concepts are not simply for product innovation but for culture innovation. Design thinking works around the users’ needs rather internal operating efficiencies. For a compliance program, this means employees, third-parties and customers. Design thinking works to improve your compliance regime by building from the ground up rather than a legalistic top-down approach. Learn more about your ad choices. Visit megaphone.fm/adchoices Design thinking is another innovation which can help the CCO move forward in a cutting-edge manner to make a compliance program not only more robust but also operationalize it into the fabric of the company. Such a mechanism would help to drive compliance into the operational nature of a company.

This design thinking protocol can help to create a more effective ethics and compliance training model by using employees to provide the initial input to improve its effectiveness and relevance to the front-line employees. The compliance team then implements several proposed solutions until the most operative one or ones becomes apparent. These are then rolled out companywide for better and more effective compliance training. As the entire process is documented, when the regulators, such as the DOJ or SEC, come knocking, you will have the ability to not only explain your training but also demonstrate its effectiveness.

Three key takeaways:

  1. Design thinking concepts are not simply for product innovation but for culture innovation.
  2. Design thinking works around the users’ needs rather internal operating efficiencies. For a compliance program, this means employees, third-parties and customers.
  3. Design thinking works to improve your compliance regime by building from the ground up rather than a legalistic top-down approach.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Blockchain will transform compliance One of the most significant innovations in compliance will come through the incorporation of blockchain into compliance. I see great value propositions for the compliance function. There are two specific areas where I see blockchain directly impacting the compliance profession. The first is with third-parties. The second area where blockchain provides a potential game changer is contracts, specifically around compliance terms and conditions.  This final point is operationalizing compliance. It will be interesting to see when the DOJ or SEC will begin to comment on blockchain as a part of a best practices compliance program. Three key takeaways: Blockchain has great potential for the compliance profession. Blockchain can facilitate the third-party due diligence and update requirements. Blockchain can provide a clear trigger for compliance terms and conditions. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 18 Mar 2020 17:00:00 -0000 Blockchain will transform compliance full Thomas Fox How will blockchain transform compliance? Find out in today's episode of 31 Days to a More Effective Compliance Program One of the most significant innovations in compliance will come through the incorporation of blockchain into compliance. I see great value propositions for the compliance function. There are two specific areas where I see blockchain directly impacting the compliance profession. The first is with third-parties. The second area where blockchain provides a potential game changer is contracts, specifically around compliance terms and conditions.  This final point is operationalizing compliance. It will be interesting to see when the DOJ or SEC will begin to comment on blockchain as a part of a best practices compliance program. Three key takeaways: Blockchain has great potential for the compliance profession. Blockchain can facilitate the third-party due diligence and update requirements. Blockchain can provide a clear trigger for compliance terms and conditions. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the most significant innovations in compliance will come through the incorporation of blockchain into compliance. I see great value propositions for the compliance function. There are two specific areas where I see blockchain directly impacting the compliance profession. The first is with third-parties. The second area where blockchain provides a potential game changer is contracts, specifically around compliance terms and conditions. 

This final point is operationalizing compliance. It will be interesting to see when the DOJ or SEC will begin to comment on blockchain as a part of a best practices compliance program.

Three key takeaways:

  1. Blockchain has great potential for the compliance profession.
  2. Blockchain can facilitate the third-party due diligence and update requirements.
  3. Blockchain can provide a clear trigger for compliance terms and conditions.



Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Superforecasting Imagine that as a CCO, you could create a team which might well dramatically improve your company’s compliance and risk forecasting ability, but to do so you would be required to expose just how unreliable the professional corporate forecasters have been. Could you do so and, more importantly, would you do so? Most generally this is the predictive capability that organizations have used. However, the new “superforecasting” movement, led by Philip E. Tetlock and others, has been gaining strength to help improve this capability. The concepts around superforecasting came of age after the intelligence failures leading up to the Iraq War. This led to the founding of the Good Judgment Project, which had as a key component a multi-year predictive tournament, which was a series of gaming exercises pitting amateurs against professional intelligence analysts. The results of the Good Judgment Project. Today, I explain its applicability to compliance. Three key takeaways: Imagine you could create a team which might well dramatically improve your company’s compliance and risk forecasting ability. It is essential to track the prediction outcomes and provide timely feedback to improve forecasting going forward. Like any innovation, there must be a commitment from management on moving forward. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 17 Mar 2020 17:00:00 -0000 Superforecasting full Thomas Fox What is Superforecasting in Compliance? Find out in today's edition of 31 Days to a More Effective Compliance Program. Imagine that as a CCO, you could create a team which might well dramatically improve your company’s compliance and risk forecasting ability, but to do so you would be required to expose just how unreliable the professional corporate forecasters have been. Could you do so and, more importantly, would you do so? Most generally this is the predictive capability that organizations have used. However, the new “superforecasting” movement, led by Philip E. Tetlock and others, has been gaining strength to help improve this capability. The concepts around superforecasting came of age after the intelligence failures leading up to the Iraq War. This led to the founding of the Good Judgment Project, which had as a key component a multi-year predictive tournament, which was a series of gaming exercises pitting amateurs against professional intelligence analysts. The results of the Good Judgment Project. Today, I explain its applicability to compliance. Three key takeaways: Imagine you could create a team which might well dramatically improve your company’s compliance and risk forecasting ability. It is essential to track the prediction outcomes and provide timely feedback to improve forecasting going forward. Like any innovation, there must be a commitment from management on moving forward. Learn more about your ad choices. Visit megaphone.fm/adchoices Imagine that as a CCO, you could create a team which might well dramatically improve your company’s compliance and risk forecasting ability, but to do so you would be required to expose just how unreliable the professional corporate forecasters have been. Could you do so and, more importantly, would you do so? Most generally this is the predictive capability that organizations have used. However, the new “superforecasting” movement, led by Philip E. Tetlock and others, has been gaining strength to help improve this capability.

The concepts around superforecasting came of age after the intelligence failures leading up to the Iraq War. This led to the founding of the Good Judgment Project, which had as a key component a multi-year predictive tournament, which was a series of gaming exercises pitting amateurs against professional intelligence analysts. The results of the Good Judgment Project. Today, I explain its applicability to compliance.

Three key takeaways:

  1. Imagine you could create a team which might well dramatically improve your company’s compliance and risk forecasting ability.
  2. It is essential to track the prediction outcomes and provide timely feedback to improve forecasting going forward.
  3. Like any innovation, there must be a commitment from management on moving forward.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no The Digital Twin and P&L of One How can you use the tools of Artificial Intelligence (AI) and data analytics in a best practices compliance program. Vincent M. Walden, a partner at Alvarez and Marsal (A&M), wrote an article entitled “Profit & Loss-of-One” (P&L-of-One) where he detailed how he and his then colleagues at Ernest & Young (EY) worked in conjunction with the General Electric (GE) compliance function to “improve compliance by using forensic data analytics to provide behavioral insights to their compliance program.” They did this through the innovative use of “digital twins” which Walden described as “digital replicas of physical assets that organizations can use for multiple purposes such as the maintenance of power generation equipment, jet engines and heavy machinery. The innovation demonstrated through the P&L-of-One shows how the digital transformation of compliance through true operationalization will not only burn compliance into the fabric of an organization but illustrates how more robust compliance can make a company run more efficiently and, at the end of the day, more profitably. Walden concludes by stating, “The compliance vision of the future seeks to further move compliance towards a more proactive, advocacy role, which helps organizations by providing needed communications, trainings and responses in an automated, intriguing and relevant fashion. This is the compliance vision of the future and what the authors call the P&L-of-One.” Three Key Takeaways: The inspiration of this innovation in compliance came from manufacturing. Test through a pilot program. Making your messaging automated, intriguing and relevant.   Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 16 Mar 2020 17:00:00 -0000 The Digital Twin and P&L of One full Thomas Fox What is the Digital Twin and P&L of One? Find out in today's edition of 31 Days to a More Effective Compliance Program. How can you use the tools of Artificial Intelligence (AI) and data analytics in a best practices compliance program. Vincent M. Walden, a partner at Alvarez and Marsal (A&M), wrote an article entitled “Profit & Loss-of-One” (P&L-of-One) where he detailed how he and his then colleagues at Ernest & Young (EY) worked in conjunction with the General Electric (GE) compliance function to “improve compliance by using forensic data analytics to provide behavioral insights to their compliance program.” They did this through the innovative use of “digital twins” which Walden described as “digital replicas of physical assets that organizations can use for multiple purposes such as the maintenance of power generation equipment, jet engines and heavy machinery. The innovation demonstrated through the P&L-of-One shows how the digital transformation of compliance through true operationalization will not only burn compliance into the fabric of an organization but illustrates how more robust compliance can make a company run more efficiently and, at the end of the day, more profitably. Walden concludes by stating, “The compliance vision of the future seeks to further move compliance towards a more proactive, advocacy role, which helps organizations by providing needed communications, trainings and responses in an automated, intriguing and relevant fashion. This is the compliance vision of the future and what the authors call the P&L-of-One.” Three Key Takeaways: The inspiration of this innovation in compliance came from manufacturing. Test through a pilot program. Making your messaging automated, intriguing and relevant.   Learn more about your ad choices. Visit megaphone.fm/adchoices How can you use the tools of Artificial Intelligence (AI) and data analytics in a best practices compliance program. Vincent M. Walden, a partner at Alvarez and Marsal (A&M), wrote an article entitled “Profit & Loss-of-One” (P&L-of-One) where he detailed how he and his then colleagues at Ernest & Young (EY) worked in conjunction with the General Electric (GE) compliance function to “improve compliance by using forensic data analytics to provide behavioral insights to their compliance program.” They did this through the innovative use of “digital twins” which Walden described as “digital replicas of physical assets that organizations can use for multiple purposes such as the maintenance of power generation equipment, jet engines and heavy machinery.

The innovation demonstrated through the P&L-of-One shows how the digital transformation of compliance through true operationalization will not only burn compliance into the fabric of an organization but illustrates how more robust compliance can make a company run more efficiently and, at the end of the day, more profitably. Walden concludes by stating, “The compliance vision of the future seeks to further move compliance towards a more proactive, advocacy role, which helps organizations by providing needed communications, trainings and responses in an automated, intriguing and relevant fashion. This is the compliance vision of the future and what the authors call the P&L-of-One.”

Three Key Takeaways:

  1. The inspiration of this innovation in compliance came from manufacturing.
  2. Test through a pilot program.
  3. Making your messaging automated, intriguing and relevant.

 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Taming Complexity in Compliance One of the lessons we have learned from various Foreign Corrupt Practices Act (FCPA) enforcement actions over the years is how complexity in business organizations can work to defeat compliance programs. Whether a corrupt employee is working to actively hide a pot of money, which can or will be used to pay a bribe, or an improper payment slips through the cracks; complexity can work to defeat a best practices compliance program. If a compliance function does not have visibility into a business unit, how it does business and where its payments are going; it may be due to design or inadvertent complexity. Compliance is now in an era of brisk innovation and evolution. It is prone to technological change and rapid obsolescence of the lawyer-driven, spreadsheet and word document based compliance programs. Going forward the compliance professional needs to understand that a “package of resilience, adaptability, coordination, and inimitability becomes more attractive than the package of efficiency, understandability, manageability, and predictability.” The key is to learn how to harness complexity on a sustainable basis. Three Key Takeaways: If a business is too complex for the compliance function to understand; it is in greater danger of illegal or unethical activity. Taming complexity starts with simple operating principles. Always remember to fix, repair and prune.   Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 13 Mar 2020 17:00:00 -0000 Taming Complexity in Compliance full Thomas Fox How can you tame complexity in compliance? Find out in today's edition of 31 Days to a More Effective Compliance Program. One of the lessons we have learned from various Foreign Corrupt Practices Act (FCPA) enforcement actions over the years is how complexity in business organizations can work to defeat compliance programs. Whether a corrupt employee is working to actively hide a pot of money, which can or will be used to pay a bribe, or an improper payment slips through the cracks; complexity can work to defeat a best practices compliance program. If a compliance function does not have visibility into a business unit, how it does business and where its payments are going; it may be due to design or inadvertent complexity. Compliance is now in an era of brisk innovation and evolution. It is prone to technological change and rapid obsolescence of the lawyer-driven, spreadsheet and word document based compliance programs. Going forward the compliance professional needs to understand that a “package of resilience, adaptability, coordination, and inimitability becomes more attractive than the package of efficiency, understandability, manageability, and predictability.” The key is to learn how to harness complexity on a sustainable basis. Three Key Takeaways: If a business is too complex for the compliance function to understand; it is in greater danger of illegal or unethical activity. Taming complexity starts with simple operating principles. Always remember to fix, repair and prune.   Learn more about your ad choices. Visit megaphone.fm/adchoices One of the lessons we have learned from various Foreign Corrupt Practices Act (FCPA) enforcement actions over the years is how complexity in business organizations can work to defeat compliance programs. Whether a corrupt employee is working to actively hide a pot of money, which can or will be used to pay a bribe, or an improper payment slips through the cracks; complexity can work to defeat a best practices compliance program. If a compliance function does not have visibility into a business unit, how it does business and where its payments are going; it may be due to design or inadvertent complexity.

Compliance is now in an era of brisk innovation and evolution. It is prone to technological change and rapid obsolescence of the lawyer-driven, spreadsheet and word document based compliance programs. Going forward the compliance professional needs to understand that a “package of resilience, adaptability, coordination, and inimitability becomes more attractive than the package of efficiency, understandability, manageability, and predictability.” The key is to learn how to harness complexity on a sustainable basis.

Three Key Takeaways:

  1. If a business is too complex for the compliance function to understand; it is in greater danger of illegal or unethical activity.
  2. Taming complexity starts with simple operating principles.
  3. Always remember to fix, repair and prune.

 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Using AI in Compliance Contracting In the compliance world, consistency is one of the keys to a successful compliance program. One of those areas where consistency is mandated is in contracting. Having consistency in the compliance terms and conditions of any contract is a critical aspect of the compliance professional. While there will certainly be negotiation over a wide variety of terms and conditions, from the financial and payment terms, to the operational terms, to the legal terms, companies need consistency with their compliance terms and conditions. This is particularly true given the paucity of compliance terms which should be put in place. For the compliance professional this means that less may well slip through the cracks and you will not be in an after the fact position of finding out that your agent or distributor in a high-risk venue does not have an audit clause. Three Key Takeaways: AI contracting software can make you contracting process more efficient. AI contracting software is scalable. AI contracting software can allow you to move from a detect to preventative mode.   Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 12 Mar 2020 17:00:00 -0000 Using AI in Compliance Contracting full Thomas Fox How can you utilized AI in compliance contracting? Find out in today's episode of 31 Days to a More Effective Compliance Program. In the compliance world, consistency is one of the keys to a successful compliance program. One of those areas where consistency is mandated is in contracting. Having consistency in the compliance terms and conditions of any contract is a critical aspect of the compliance professional. While there will certainly be negotiation over a wide variety of terms and conditions, from the financial and payment terms, to the operational terms, to the legal terms, companies need consistency with their compliance terms and conditions. This is particularly true given the paucity of compliance terms which should be put in place. For the compliance professional this means that less may well slip through the cracks and you will not be in an after the fact position of finding out that your agent or distributor in a high-risk venue does not have an audit clause. Three Key Takeaways: AI contracting software can make you contracting process more efficient. AI contracting software is scalable. AI contracting software can allow you to move from a detect to preventative mode.   Learn more about your ad choices. Visit megaphone.fm/adchoices In the compliance world, consistency is one of the keys to a successful compliance program. One of those areas where consistency is mandated is in contracting. Having consistency in the compliance terms and conditions of any contract is a critical aspect of the compliance professional. While there will certainly be negotiation over a wide variety of terms and conditions, from the financial and payment terms, to the operational terms, to the legal terms, companies need consistency with their compliance terms and conditions. This is particularly true given the paucity of compliance terms which should be put in place.

For the compliance professional this means that less may well slip through the cracks and you will not be in an after the fact position of finding out that your agent or distributor in a high-risk venue does not have an audit clause.

Three Key Takeaways:

  1. AI contracting software can make you contracting process more efficient.
  2. AI contracting software is scalable.
  3. AI contracting software can allow you to move from a detect to preventative mode.

 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 Finding compliance patterns in raked leaves We previously considered how AI can be used as a business advantage for compliance. The power of AI can extend the more traditional functions of prevention, detection and remediation. The first way is in simply the mass amount of data which could inundate a compliance practitioner. Many compliance practitioners are overwhelmed about the amount of data available to them and do not know how or even where to begin. Patrick Taylor has said that AI allows the compliance practitioner to understand the “subtle clues in that pattern of activity that will clue me in to take a different look.” He likened it to seeing “patterns in raked leaves” which allows you to then step in and take a deeper and broader look at an issue, either through an audit or investigation. This is where compliance practitioner can step back and literally keep an eye on the big picture and longer term as opposed to just the immediate numbers and information in front of them. It may also be the best hope for finding that kind of systemic fraudulent behavior. Three key takeaways: Do you know what your information means? AI can help both the detect and prevent prongs in a best practices compliance program. AI can help you to see the patterns in raked leaves. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 11 Mar 2020 17:00:00 -0000 Finding compliance patterns in raked leaves full Thomas Fox How can you find patterns in the raked leaves of a compliance program? Find out in today's 31 Days to a More Effective Compliance Program. We previously considered how AI can be used as a business advantage for compliance. The power of AI can extend the more traditional functions of prevention, detection and remediation. The first way is in simply the mass amount of data which could inundate a compliance practitioner. Many compliance practitioners are overwhelmed about the amount of data available to them and do not know how or even where to begin. Patrick Taylor has said that AI allows the compliance practitioner to understand the “subtle clues in that pattern of activity that will clue me in to take a different look.” He likened it to seeing “patterns in raked leaves” which allows you to then step in and take a deeper and broader look at an issue, either through an audit or investigation. This is where compliance practitioner can step back and literally keep an eye on the big picture and longer term as opposed to just the immediate numbers and information in front of them. It may also be the best hope for finding that kind of systemic fraudulent behavior. Three key takeaways: Do you know what your information means? AI can help both the detect and prevent prongs in a best practices compliance program. AI can help you to see the patterns in raked leaves. Learn more about your ad choices. Visit megaphone.fm/adchoices We previously considered how AI can be used as a business advantage for compliance. The power of AI can extend the more traditional functions of prevention, detection and remediation. The first way is in simply the mass amount of data which could inundate a compliance practitioner. Many compliance practitioners are overwhelmed about the amount of data available to them and do not know how or even where to begin.

Patrick Taylor has said that AI allows the compliance practitioner to understand the “subtle clues in that pattern of activity that will clue me in to take a different look.” He likened it to seeing “patterns in raked leaves” which allows you to then step in and take a deeper and broader look at an issue, either through an audit or investigation. This is where compliance practitioner can step back and literally keep an eye on the big picture and longer term as opposed to just the immediate numbers and information in front of them. It may also be the best hope for finding that kind of systemic fraudulent behavior.

Three key takeaways:

  1. Do you know what your information means?
  2. AI can help both the detect and prevent prongs in a best practices compliance program.
  3. AI can help you to see the patterns in raked leaves.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Four Practices for Delivering an AI Solution to Compliance Next, we consider the four practices that create the conditions for delivering an AI solution to compliance. Using these four practices can lead to enhanced operational excellence, more efficient business processes, and a more robust compliance experience. They are: (1) developing clear, realistic use cases, (2) managing AI learning, (3) continuous Improvement and (4) thinking cognitively. By applying these practices, business leaders can full operationalize AI applications for compliance into their organizational DNA and set themselves up to reap those rewards. It is a continuous cycle. The capabilities enable employees to execute the practices, and the practices themselves exercise and strengthen the capabilities. This cycle helps companies continually adapt at developing and using AI applications that make operations more efficient and create business value through greater profitability. Three key takeaways: AI is not a panacea. It is not simply about reading numbers, it is thinking critically. Continuous improvement is a key by product of using AI in compliance. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 10 Mar 2020 17:00:00 -0000 Four Practices for Delivering an AI Solution to Compliance full Thomas Fox What are four practices that create the conditions for delivering an AI solution to compliance. Find out in today's episode of 31 Days to a More Effective Compliance Program. Next, we consider the four practices that create the conditions for delivering an AI solution to compliance. Using these four practices can lead to enhanced operational excellence, more efficient business processes, and a more robust compliance experience. They are: (1) developing clear, realistic use cases, (2) managing AI learning, (3) continuous Improvement and (4) thinking cognitively. By applying these practices, business leaders can full operationalize AI applications for compliance into their organizational DNA and set themselves up to reap those rewards. It is a continuous cycle. The capabilities enable employees to execute the practices, and the practices themselves exercise and strengthen the capabilities. This cycle helps companies continually adapt at developing and using AI applications that make operations more efficient and create business value through greater profitability. Three key takeaways: AI is not a panacea. It is not simply about reading numbers, it is thinking critically. Continuous improvement is a key by product of using AI in compliance. Learn more about your ad choices. Visit megaphone.fm/adchoices Next, we consider the four practices that create the conditions for delivering an AI solution to compliance. Using these four practices can lead to enhanced operational excellence, more efficient business processes, and a more robust compliance experience. They are: (1) developing clear, realistic use cases, (2) managing AI learning, (3) continuous Improvement and (4) thinking cognitively.

By applying these practices, business leaders can full operationalize AI applications for compliance into their organizational DNA and set themselves up to reap those rewards. It is a continuous cycle. The capabilities enable employees to execute the practices, and the practices themselves exercise and strengthen the capabilities. This cycle helps companies continually adapt at developing and using AI applications that make operations more efficient and create business value through greater profitability.

Three key takeaways:

  1. AI is not a panacea.
  2. It is not simply about reading numbers, it is thinking critically.
  3. Continuous improvement is a key by product of using AI in compliance.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Compliance Capabilities Needed to Use AI Programs Next we consider the crucial capabilities which a compliance function must have to implement an AI solution. Over the next several pieces, I will use the article Using AI to Enhance Business Operations by Monideepa Tarafdar, Cynthia M. Beath as an introduction into the how the corporate compliance function can use an Artificial Intelligence (AI) program to not only enhance the compliance function but also business operations. Generating value from AI programs is not easy for compliance professionals as there can be multiple roadblocks to successful design and implementation. The problem is, many companies which desired to benefit from AI programs failed to do so have failed to develop the necessary organizational capabilities. The authors identified five capabilities that companies need to splice into their organization’s DNA to create an effective AI program, have adapted for the compliance function. Three key takeaways: What is the power of an AI application? What are the foundations of AI application competence? What are some of the roadblocks to AI competence? Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 09 Mar 2020 17:00:00 -0000 Compliance Capabilities Needed to Use AI Programs full Thomas Fox What are the key capabilities needed for a compliance function to successfully create and use a AI program? Next we consider the crucial capabilities which a compliance function must have to implement an AI solution. Over the next several pieces, I will use the article Using AI to Enhance Business Operations by Monideepa Tarafdar, Cynthia M. Beath as an introduction into the how the corporate compliance function can use an Artificial Intelligence (AI) program to not only enhance the compliance function but also business operations. Generating value from AI programs is not easy for compliance professionals as there can be multiple roadblocks to successful design and implementation. The problem is, many companies which desired to benefit from AI programs failed to do so have failed to develop the necessary organizational capabilities. The authors identified five capabilities that companies need to splice into their organization’s DNA to create an effective AI program, have adapted for the compliance function. Three key takeaways: What is the power of an AI application? What are the foundations of AI application competence? What are some of the roadblocks to AI competence? Learn more about your ad choices. Visit megaphone.fm/adchoices Next we consider the crucial capabilities which a compliance function must have to implement an AI solution. Over the next several pieces, I will use the article Using AI to Enhance Business Operations by Monideepa Tarafdar, Cynthia M. Beath as an introduction into the how the corporate compliance function can use an Artificial Intelligence (AI) program to not only enhance the compliance function but also business operations.

Generating value from AI programs is not easy for compliance professionals as there can be multiple roadblocks to successful design and implementation. The problem is, many companies which desired to benefit from AI programs failed to do so have failed to develop the necessary organizational capabilities. The authors identified five capabilities that companies need to splice into their organization’s DNA to create an effective AI program, have adapted for the compliance function.

Three key takeaways:

  1. What is the power of an AI application?
  2. What are the foundations of AI application competence?
  3. What are some of the roadblocks to AI competence?


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Strategies For and With AI in Compliance Today, I want to consider the article Strategy For and With AI by David Kiron and Michael Schrage. The authors premise is, “A company’s strategy is defined by its key performance indicators. Artificial intelligence can help determine which outcomes to measure, how to measure them, and how to prioritize them.”  Their article had several insights for the Chief Compliance Officer (CCO) or compliance practitioner who is looking to employ Artificial intelligence (AI) to help move their compliance program up a level. One of the first key insights is that it is not enough to simply have a strategy for AI. The authors stated, “Creating strategy with AI matters as much — or even more — in terms of exploring and exploiting strategic opportunity. This distinction is not semantic gamesmanship; it’s at the core of how algorithmic innovation truly works in organizations. Real-world success requires making these strategies both complementary and interdependent. Strategies for novel capabilities demand different managerial skills and emphases than strategies with them.” This makes clear that AI does not supplant the compliance function or the compliance professional, AI complements what the compliance professional can do with the information available to them. Yet the authors believe that when it comes to machine learning, an appropriate compliance strategy is defined by the key performance indicators (KPIs) leaders choose to optimize. This means that a CCO who cannot clearly identify and justify their strategic KPI portfolios has no strategy. The bottom line? AI plays a critical role in determining what and how compliance KPIs are measured and how best to optimize them. Optimizing carefully selected compliance KPIs becomes AI’s strategic purpose in the compliance function. Understanding the value of optimization is key to aligning and integrating strategies forand with AI and machine learning. KPIs create accountability for optimizing strategic aspirations, including compliance. Three key takeaways: Use KPIs to define and measure your innovation strategy. AI should only supplement, not supplant a compliance professional. What are your compliance KPIs? For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit this month’s sponsor Affiliated Monitors at www.affiliatedmonitors.com. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 06 Mar 2020 18:00:00 -0000 Strategies For and With AI in Compliance full Thomas Fox Using KPIs is critical for an AI strategy in compliance. Learn more in today's episode of 31 Days to a More Effective Compliance Program. Today, I want to consider the article Strategy For and With AI by David Kiron and Michael Schrage. The authors premise is, “A company’s strategy is defined by its key performance indicators. Artificial intelligence can help determine which outcomes to measure, how to measure them, and how to prioritize them.”  Their article had several insights for the Chief Compliance Officer (CCO) or compliance practitioner who is looking to employ Artificial intelligence (AI) to help move their compliance program up a level. One of the first key insights is that it is not enough to simply have a strategy for AI. The authors stated, “Creating strategy with AI matters as much — or even more — in terms of exploring and exploiting strategic opportunity. This distinction is not semantic gamesmanship; it’s at the core of how algorithmic innovation truly works in organizations. Real-world success requires making these strategies both complementary and interdependent. Strategies for novel capabilities demand different managerial skills and emphases than strategies with them.” This makes clear that AI does not supplant the compliance function or the compliance professional, AI complements what the compliance professional can do with the information available to them. Yet the authors believe that when it comes to machine learning, an appropriate compliance strategy is defined by the key performance indicators (KPIs) leaders choose to optimize. This means that a CCO who cannot clearly identify and justify their strategic KPI portfolios has no strategy. The bottom line? AI plays a critical role in determining what and how compliance KPIs are measured and how best to optimize them. Optimizing carefully selected compliance KPIs becomes AI’s strategic purpose in the compliance function. Understanding the value of optimization is key to aligning and integrating strategies forand with AI and machine learning. KPIs create accountability for optimizing strategic aspirations, including compliance. Three key takeaways: Use KPIs to define and measure your innovation strategy. AI should only supplement, not supplant a compliance professional. What are your compliance KPIs? For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit this month’s sponsor Affiliated Monitors at www.affiliatedmonitors.com. Learn more about your ad choices. Visit megaphone.fm/adchoices Today, I want to consider the article Strategy For and With AI by David Kiron and Michael Schrage. The authors premise is, “A company’s strategy is defined by its key performance indicators. Artificial intelligence can help determine which outcomes to measure, how to measure them, and how to prioritize them.”

 Their article had several insights for the Chief Compliance Officer (CCO) or compliance practitioner who is looking to employ Artificial intelligence (AI) to help move their compliance program up a level. One of the first key insights is that it is not enough to simply have a strategy for AI. The authors stated, “Creating strategy with AI matters as much — or even more — in terms of exploring and exploiting strategic opportunity. This distinction is not semantic gamesmanship; it’s at the core of how algorithmic innovation truly works in organizations. Real-world success requires making these strategies both complementary and interdependent. Strategies for novel capabilities demand different managerial skills and emphases than strategies with them.”

This makes clear that AI does not supplant the compliance function or the compliance professional, AI complements what the compliance professional can do with the information available to them. Yet the authors believe that when it comes to machine learning, an appropriate compliance strategy is defined by the key performance indicators (KPIs) leaders choose to optimize. This means that a CCO who cannot clearly identify and justify their strategic KPI portfolios has no strategy.

The bottom line? AI plays a critical role in determining what and how compliance KPIs are measured and how best to optimize them. Optimizing carefully selected compliance KPIs becomes AI’s strategic purpose in the compliance function. Understanding the value of optimization is key to aligning and integrating strategies forand with AI and machine learning. KPIs create accountability for optimizing strategic aspirations, including compliance.

Three key takeaways:

  1. Use KPIs to define and measure your innovation strategy.
  2. AI should only supplement, not supplant a compliance professional.
  3. What are your compliance KPIs?


For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit this month’s sponsor Affiliated Monitors at www.affiliatedmonitors.com.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no The Compliance Advantage of Data The Department Of Justice and Securities and Exchange Commission have both made it clear that they expect companies to be more robust in their use of data analytics in compliance programs. This means using data to not only detect and prevent illegal conduct but also in the remediation prong of any best practices compliance program as well through continuous improvement. Former Deputy Assistant Attorney General Matthew Miner said in a speech that the DOJ will inquire whether compliance departments have access to internal data that could help them identify misconduct and whether compliance officers make adequate use of data analytics in their reviews of companies under investigation. Since at least 2016 in the Foreign Corrupt Practices Act (FCPA) enforcement action involving Key Energy Services, Inc., the SEC has been communicating to compliance professionals of the need for increased use of data and data analytics in any compliance program.  The new DOJ Antitrust Division released its Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations (Antitrust Guidance), was the clearest regarding this mandate when it stated, “Does the company use any type of screen, communications monitoring tool, or statistical testing designed to identify potential antitrust violations?” For the anti-corruption compliance professional, this means you need to incorporate a statistical analysis into your ongoing monitoring to see if there are any anomalies which could be indications of FCPA violations. The bottom line is that it is not if but when you begin to incorporate corporate information into your compliance program to make your compliance program more efficient and your business process run more effectively. My suggestion is that you begin now to identify the data you have access to and the data to which you currently do not have access. Find a way to bridge that gap. Three key takeaways: What advantages can data bring to your compliance regime? Both the DOJ and SEC have said companies need to be using data in their compliance programs. Data will make your compliance program more effective, your business process more efficient and your company more profitable. For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit this month’s sponsor Affiliated Monitors at www.affiliatedmonitors.com. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 05 Mar 2020 18:00:00 -0000 The Compliance Advantage of Data full Thomas Fox What are the compliance advantages of data? How can you use data going forward? Find out in today's episode of 31 Days to a More Effective Compliance Program. The Department Of Justice and Securities and Exchange Commission have both made it clear that they expect companies to be more robust in their use of data analytics in compliance programs. This means using data to not only detect and prevent illegal conduct but also in the remediation prong of any best practices compliance program as well through continuous improvement. Former Deputy Assistant Attorney General Matthew Miner said in a speech that the DOJ will inquire whether compliance departments have access to internal data that could help them identify misconduct and whether compliance officers make adequate use of data analytics in their reviews of companies under investigation. Since at least 2016 in the Foreign Corrupt Practices Act (FCPA) enforcement action involving Key Energy Services, Inc., the SEC has been communicating to compliance professionals of the need for increased use of data and data analytics in any compliance program.  The new DOJ Antitrust Division released its Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations (Antitrust Guidance), was the clearest regarding this mandate when it stated, “Does the company use any type of screen, communications monitoring tool, or statistical testing designed to identify potential antitrust violations?” For the anti-corruption compliance professional, this means you need to incorporate a statistical analysis into your ongoing monitoring to see if there are any anomalies which could be indications of FCPA violations. The bottom line is that it is not if but when you begin to incorporate corporate information into your compliance program to make your compliance program more efficient and your business process run more effectively. My suggestion is that you begin now to identify the data you have access to and the data to which you currently do not have access. Find a way to bridge that gap. Three key takeaways: What advantages can data bring to your compliance regime? Both the DOJ and SEC have said companies need to be using data in their compliance programs. Data will make your compliance program more effective, your business process more efficient and your company more profitable. For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit this month’s sponsor Affiliated Monitors at www.affiliatedmonitors.com. Learn more about your ad choices. Visit megaphone.fm/adchoices The Department Of Justice and Securities and Exchange Commission have both made it clear that they expect companies to be more robust in their use of data analytics in compliance programs. This means using data to not only detect and prevent illegal conduct but also in the remediation prong of any best practices compliance program as well through continuous improvement. Former Deputy Assistant Attorney General Matthew Miner said in a speech that the DOJ will inquire whether compliance departments have access to internal data that could help them identify misconduct and whether compliance officers make adequate use of data analytics in their reviews of companies under investigation. Since at least 2016 in the Foreign Corrupt Practices Act (FCPA) enforcement action involving Key Energy Services, Inc., the SEC has been communicating to compliance professionals of the need for increased use of data and data analytics in any compliance program. 

The new DOJ Antitrust Division released its Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations (Antitrust Guidance), was the clearest regarding this mandate when it stated, “Does the company use any type of screen, communications monitoring tool, or statistical testing designed to identify potential antitrust violations?” For the anti-corruption compliance professional, this means you need to incorporate a statistical analysis into your ongoing monitoring to see if there are any anomalies which could be indications of FCPA violations.

The bottom line is that it is not if but when you begin to incorporate corporate information into your compliance program to make your compliance program more efficient and your business process run more effectively. My suggestion is that you begin now to identify the data you have access to and the data to which you currently do not have access. Find a way to bridge that gap.

Three key takeaways:

  1. What advantages can data bring to your compliance regime?
  2. Both the DOJ and SEC have said companies need to be using data in their compliance programs.
  3. Data will make your compliance program more effective, your business process more efficient and your company more profitable.

For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit this month’s sponsor Affiliated Monitors at www.affiliatedmonitors.com.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Skills for Innovating in Compliance Innovation in compliance is one of my passions for every Chief Compliance Officer (CCO) and compliance practitioner. So much so that I dedicate an entire podcast series to the topic, aptly named Innovation in Compliance. I was therefore intrigued with a recent Harvard Business Review (HBR) article, entitled What Kind of Chief Innovation Officer Does Your Company Need?, by Darko Lovric and Greig Schneider. They developed six-character types for innovators, which I have adapted for the different skills set a CCO might need to create innovation in compliance. Research skills - research skills allow folks to come up with new ideas and garner insights from large amounts of data. Engineering Skills - Engineering skills are used to build something that works, as in now. Investor skills- investors see innovation as the means to an end, and that end is growth. Advocacy skills - Advocacy skills help to deliver something new for the end user. Motivational skills- motivational skills in innovation but the authors found they work to unleash the employees’ imaginations. Organizational skills- Organizational skills are the true process focused skill set, focusing on extents like key performance indicators (KPIs), metrics, and stage gates. While you may not find one person with all of those skills, by identifying them a CCO might be able to bring a range of skills to an innovation project. Further, by tempering some of the more extreme aspects of each skill set by partnering it with a countervailing skill set, a CCO can bring a much more robust response to innovating. Also remember that innovation in compliance does not necessarily require a high cost of entry. You can innovate by looking to process improvement and moving outwards. Three key takeaways: Do you have an innovation expert in your compliance team? What skills do compliance professionals have that lend themselves to innovation. Think about broadening out your compliance reach through innovation. For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit this month’s sponsor Affiliated Monitors at www.affiliatedmonitors.com. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 04 Mar 2020 18:00:00 -0000 Skills for Innovating in Compliance full Thomas Fox What are the skills you need for innovation in compliance? Find out in today's episode of 31 Days to a More Effective Compliance Program. Innovation in compliance is one of my passions for every Chief Compliance Officer (CCO) and compliance practitioner. So much so that I dedicate an entire podcast series to the topic, aptly named Innovation in Compliance. I was therefore intrigued with a recent Harvard Business Review (HBR) article, entitled What Kind of Chief Innovation Officer Does Your Company Need?, by Darko Lovric and Greig Schneider. They developed six-character types for innovators, which I have adapted for the different skills set a CCO might need to create innovation in compliance. Research skills - research skills allow folks to come up with new ideas and garner insights from large amounts of data. Engineering Skills - Engineering skills are used to build something that works, as in now. Investor skills- investors see innovation as the means to an end, and that end is growth. Advocacy skills - Advocacy skills help to deliver something new for the end user. Motivational skills- motivational skills in innovation but the authors found they work to unleash the employees’ imaginations. Organizational skills- Organizational skills are the true process focused skill set, focusing on extents like key performance indicators (KPIs), metrics, and stage gates. While you may not find one person with all of those skills, by identifying them a CCO might be able to bring a range of skills to an innovation project. Further, by tempering some of the more extreme aspects of each skill set by partnering it with a countervailing skill set, a CCO can bring a much more robust response to innovating. Also remember that innovation in compliance does not necessarily require a high cost of entry. You can innovate by looking to process improvement and moving outwards. Three key takeaways: Do you have an innovation expert in your compliance team? What skills do compliance professionals have that lend themselves to innovation. Think about broadening out your compliance reach through innovation. For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit this month’s sponsor Affiliated Monitors at www.affiliatedmonitors.com. Learn more about your ad choices. Visit megaphone.fm/adchoices Innovation in compliance is one of my passions for every Chief Compliance Officer (CCO) and compliance practitioner. So much so that I dedicate an entire podcast series to the topic, aptly named Innovation in Compliance. I was therefore intrigued with a recent Harvard Business Review (HBR) article, entitled What Kind of Chief Innovation Officer Does Your Company Need?, by Darko Lovric and Greig Schneider. They developed six-character types for innovators, which I have adapted for the different skills set a CCO might need to create innovation in compliance.

  1. Research skills - research skills allow folks to come up with new ideas and garner insights from large amounts of data.
  2. Engineering Skills - Engineering skills are used to build something that works, as in now.
  3. Investor skills- investors see innovation as the means to an end, and that end is growth.
  4. Advocacy skills - Advocacy skills help to deliver something new for the end user.
  5. Motivational skills- motivational skills in innovation but the authors found they work to unleash the employees’ imaginations.
  6. Organizational skills- Organizational skills are the true process focused skill set, focusing on extents like key performance indicators (KPIs), metrics, and stage gates.


While you may not find one person with all of those skills, by identifying them a CCO might be able to bring a range of skills to an innovation project. Further, by tempering some of the more extreme aspects of each skill set by partnering it with a countervailing skill set, a CCO can bring a much more robust response to innovating. Also remember that innovation in compliance does not necessarily require a high cost of entry. You can innovate by looking to process improvement and moving outwards.

Three key takeaways:

  1. Do you have an innovation expert in your compliance team?
  2. What skills do compliance professionals have that lend themselves to innovation.
  3. Think about broadening out your compliance reach through innovation.

For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit this month’s sponsor Affiliated Monitors at www.affiliatedmonitors.com.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 560 Welcome to ComTech What will be the role of AI in compliance going forward? LawTech disrupted the legal profession and reshaped many areas of private practice. I believe there will is a nascent ComTech industry lurking down the road with multiple implications for the compliance function. Obviously, document review is one area where ComTech would be most useful. There are many companies which provide key word searches and these same concepts translate readily into the compliance world through massive database searches for key words, such as an ongoing review through email sweeps. There is yet another set of AI tools that can review contracts to see if any specific types of clauses are non-standard. Soon compliance will be pushed more to the forefront in AML. AI will allow a more robust KYC approach. Another area where compliance is often left behind is in the arena of M&A. AI can help in this area. There are companies which have software that allows thousands of documents to be reviewed in the M&A context. A prime example of where AI can assist the compliance function is with third-parties in supply chain management. There have always been technological innovations which help make compliance disciplines run more efficiently, more smoothly and more profitably. AI is simply another step in this line of technological developments. There is certainly no reason to be afraid of using it. Given the disruption which has impacted the legal profession through LawTech; disruption is not far behind in the compliance world through ComTech.  Three key takeaways: AI has already disrupted the legal profession; the compliance profession will be next. ComTech will be the result. Document review will be the first area of significant AI use in compliance. Beware the limitations and disadvantages of ComTech. For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit this month’s sponsor Affiliated Monitors at www.affiliatedmonitors.com. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 03 Mar 2020 18:00:00 -0000 Welcome to ComTech full Thomas Fox How will ComTech disrupt compliance? Find out in today's episode of 31 Days to a More Effective Compliance Program. What will be the role of AI in compliance going forward? LawTech disrupted the legal profession and reshaped many areas of private practice. I believe there will is a nascent ComTech industry lurking down the road with multiple implications for the compliance function. Obviously, document review is one area where ComTech would be most useful. There are many companies which provide key word searches and these same concepts translate readily into the compliance world through massive database searches for key words, such as an ongoing review through email sweeps. There is yet another set of AI tools that can review contracts to see if any specific types of clauses are non-standard. Soon compliance will be pushed more to the forefront in AML. AI will allow a more robust KYC approach. Another area where compliance is often left behind is in the arena of M&A. AI can help in this area. There are companies which have software that allows thousands of documents to be reviewed in the M&A context. A prime example of where AI can assist the compliance function is with third-parties in supply chain management. There have always been technological innovations which help make compliance disciplines run more efficiently, more smoothly and more profitably. AI is simply another step in this line of technological developments. There is certainly no reason to be afraid of using it. Given the disruption which has impacted the legal profession through LawTech; disruption is not far behind in the compliance world through ComTech.  Three key takeaways: AI has already disrupted the legal profession; the compliance profession will be next. ComTech will be the result. Document review will be the first area of significant AI use in compliance. Beware the limitations and disadvantages of ComTech. For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit this month’s sponsor Affiliated Monitors at www.affiliatedmonitors.com. Learn more about your ad choices. Visit megaphone.fm/adchoices What will be the role of AI in compliance going forward? LawTech disrupted the legal profession and reshaped many areas of private practice. I believe there will is a nascent ComTech industry lurking down the road with multiple implications for the compliance function.

Obviously, document review is one area where ComTech would be most useful. There are many companies which provide key word searches and these same concepts translate readily into the compliance world through massive database searches for key words, such as an ongoing review through email sweeps. There is yet another set of AI tools that can review contracts to see if any specific types of clauses are non-standard.

Soon compliance will be pushed more to the forefront in AML. AI will allow a more robust KYC approach. Another area where compliance is often left behind is in the arena of M&A. AI can help in this area. There are companies which have software that allows thousands of documents to be reviewed in the M&A context. A prime example of where AI can assist the compliance function is with third-parties in supply chain management.

There have always been technological innovations which help make compliance disciplines run more efficiently, more smoothly and more profitably. AI is simply another step in this line of technological developments. There is certainly no reason to be afraid of using it. Given the disruption which has impacted the legal profession through LawTech; disruption is not far behind in the compliance world through ComTech.

 Three key takeaways:

  1. AI has already disrupted the legal profession; the compliance profession will be next. ComTech will be the result.
  2. Document review will be the first area of significant AI use in compliance.
  3. Beware the limitations and disadvantages of ComTech.

For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit this month’s sponsor Affiliated Monitors at www.affiliatedmonitors.com.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 560 no Innovation strategy for your compliance program In this chapter, we will consider innovation in compliance from a variety of angles including artificial intelligence (AI) and computer technology (ComTech), structural innovations, tools and tactics and innovation in leadership. This will provide you a number of solid ideas you can use to move your compliance program forward. Begin by considering the starting point, which is an innovation strategy. In the most recent DPAs and NPAs issued by the DOJ they all include an element along the following strictures: The Company will conduct periodic reviews and testing of its anti-corruption compliance code, policies, and procedures designed to evaluate and improve their effectiveness in preventing and detecting violations of anti-corruption laws and the Company’s anti-corruption code, policies, and procedures, taking into account relevant developments in the field and evolving international and industry standards.  This means that the DOJ expects innovation in your compliance program to keep up with evolving international and industry standards. This requires you to implement an innovation strategy. Three key takeaways: Both the DOJ and SEC expect innovation in your compliance program. Innovation in compliance should have a strategy going forward. The key is to demonstrate how the compliance innovation will benefit the business going forward. For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit this month’s sponsor Affiliated Monitors at www.affiliatedmonitors.com. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 02 Mar 2020 18:00:00 -0000 Innovation strategy for your compliance program full Thomas Fox What is your innovation strategy for your compliance program? Why should you have one? Find out in this episode of 31 Days to a More Effective Compliance Program. In this chapter, we will consider innovation in compliance from a variety of angles including artificial intelligence (AI) and computer technology (ComTech), structural innovations, tools and tactics and innovation in leadership. This will provide you a number of solid ideas you can use to move your compliance program forward. Begin by considering the starting point, which is an innovation strategy. In the most recent DPAs and NPAs issued by the DOJ they all include an element along the following strictures: The Company will conduct periodic reviews and testing of its anti-corruption compliance code, policies, and procedures designed to evaluate and improve their effectiveness in preventing and detecting violations of anti-corruption laws and the Company’s anti-corruption code, policies, and procedures, taking into account relevant developments in the field and evolving international and industry standards.  This means that the DOJ expects innovation in your compliance program to keep up with evolving international and industry standards. This requires you to implement an innovation strategy. Three key takeaways: Both the DOJ and SEC expect innovation in your compliance program. Innovation in compliance should have a strategy going forward. The key is to demonstrate how the compliance innovation will benefit the business going forward. For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit this month’s sponsor Affiliated Monitors at www.affiliatedmonitors.com. Learn more about your ad choices. Visit megaphone.fm/adchoices In this chapter, we will consider innovation in compliance from a variety of angles including artificial intelligence (AI) and computer technology (ComTech), structural innovations, tools and tactics and innovation in leadership. This will provide you a number of solid ideas you can use to move your compliance program forward. Begin by considering the starting point, which is an innovation strategy. In the most recent DPAs and NPAs issued by the DOJ they all include an element along the following strictures:

The Company will conduct periodic reviews and testing of its anti-corruption compliance code, policies, and procedures designed to evaluate and improve their effectiveness in preventing and detecting violations of anti-corruption laws and the Company’s anti-corruption code, policies, and procedures, taking into account relevant developments in the field and evolving international and industry standards. 

This means that the DOJ expects innovation in your compliance program to keep up with evolving international and industry standards. This requires you to implement an innovation strategy.

Three key takeaways:

  1. Both the DOJ and SEC expect innovation in your compliance program.
  2. Innovation in compliance should have a strategy going forward.
  3. The key is to demonstrate how the compliance innovation will benefit the business going forward.

For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit this month’s sponsor Affiliated Monitors at www.affiliatedmonitors.com.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 558 no 10 compliance questions to pose to HR As we end this month on the intersection of HR and compliance, I have developed a series of goals and objectives which you might want to use as a starting point for operationalizing your compliance initiatives through your corporate HR function.  How are compliance goals cascaded down to individual workers? Does anyone complain that your compliance targets are too complex? How do you deal with repeated compliance failures in a specific business segment or compliance program area? How does your company show that attracting and developing talent who will engage in ethical business conduct is a top priority? How long is compliance underperforming tolerated? What makes it distinctive to work at your company? How do compliance programs that are not working typically get exposed and remediated? What key compliance indicators do you use for compliance tracking? For a given compliance problem, how do you identify the root cause? What are you doing to retain your top employees from the compliance perspective? Compliance practitioners continually face the challenge of keeping up with the ever-evolving compliance best practices with little or no budget increase. By asking yourself and of your compliance program these questions you may create a road map to more fully operationalize your compliance regime. Three key takeaways: What are the unique compliance targets you have set and how interconnected are they to your business unit goals? Use a root cause analysis to determine why compliance initiatives are not successful. Retraining employees in compliance is an under-utilized tool. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 28 Feb 2020 18:00:00 -0000 10 compliance questions to pose to HR full Thomas Fox We end this month exploring the intersection of HR and compliance with Ten Questions to pose to HR about your compliance program. As we end this month on the intersection of HR and compliance, I have developed a series of goals and objectives which you might want to use as a starting point for operationalizing your compliance initiatives through your corporate HR function.  How are compliance goals cascaded down to individual workers? Does anyone complain that your compliance targets are too complex? How do you deal with repeated compliance failures in a specific business segment or compliance program area? How does your company show that attracting and developing talent who will engage in ethical business conduct is a top priority? How long is compliance underperforming tolerated? What makes it distinctive to work at your company? How do compliance programs that are not working typically get exposed and remediated? What key compliance indicators do you use for compliance tracking? For a given compliance problem, how do you identify the root cause? What are you doing to retain your top employees from the compliance perspective? Compliance practitioners continually face the challenge of keeping up with the ever-evolving compliance best practices with little or no budget increase. By asking yourself and of your compliance program these questions you may create a road map to more fully operationalize your compliance regime. Three key takeaways: What are the unique compliance targets you have set and how interconnected are they to your business unit goals? Use a root cause analysis to determine why compliance initiatives are not successful. Retraining employees in compliance is an under-utilized tool. Learn more about your ad choices. Visit megaphone.fm/adchoices As we end this month on the intersection of HR and compliance, I have developed a series of goals and objectives which you might want to use as a starting point for operationalizing your compliance initiatives through your corporate HR function. 

  1. How are compliance goals cascaded down to individual workers?
  2. Does anyone complain that your compliance targets are too complex?
  3. How do you deal with repeated compliance failures in a specific business segment or compliance program area?
  4. How does your company show that attracting and developing talent who will engage in ethical business conduct is a top priority?
  5. How long is compliance underperforming tolerated?
  6. What makes it distinctive to work at your company?
  7. How do compliance programs that are not working typically get exposed and remediated?
  8. What key compliance indicators do you use for compliance tracking?
  9. For a given compliance problem, how do you identify the root cause?
  10. What are you doing to retain your top employees from the compliance perspective?

Compliance practitioners continually face the challenge of keeping up with the ever-evolving compliance best practices with little or no budget increase. By asking yourself and of your compliance program these questions you may create a road map to more fully operationalize your compliance regime.

Three key takeaways:

  1. What are the unique compliance targets you have set and how interconnected are they to your business unit goals?
  2. Use a root cause analysis to determine why compliance initiatives are not successful.
  3. Retraining employees in compliance is an under-utilized tool.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 Compliance Gap Analysis for HR Hopefully you now understand that many of the traditional functions of HR can be seen as compliance internal controls. At every touchpoint in the lifecycle of the employment relationship there is a HR touchpoint. Fulfilling those touchpoints can be controls for compliance. If you think of multiple HR functions as compliance internal controls, one of the questions becomes how can you determine if HR is meeting the standards of a best practices compliance program? One place to start is with a gap analysis to determine what HR has in place that can facilitate your company’s compliance program. Finally, work with HR to create a consolidated Human Resources Compliance Audit Checklist that can be used to audit (and document) the company’s HR Compliance Program. The key to compliance, in my opinion, is having the proper structure to identify the issues, implement policies and procedures to address the issues, audit for compliance and “Document, Document, and Document”.  Three key takeaways: A gap analysis is a key component in the risk assessment process. The ultimate responsibility should lie with the business units and functional discipline to fully operationalize compliance. The role of the compliance department is to oversee, provide subject matter expertise and coordinate.   Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 27 Feb 2020 18:00:00 -0000 Compliance Gap Analysis for HR full Thomas Fox How can you audit the role of HR in compliance? Start with a gap analysis. Hopefully you now understand that many of the traditional functions of HR can be seen as compliance internal controls. At every touchpoint in the lifecycle of the employment relationship there is a HR touchpoint. Fulfilling those touchpoints can be controls for compliance. If you think of multiple HR functions as compliance internal controls, one of the questions becomes how can you determine if HR is meeting the standards of a best practices compliance program? One place to start is with a gap analysis to determine what HR has in place that can facilitate your company’s compliance program. Finally, work with HR to create a consolidated Human Resources Compliance Audit Checklist that can be used to audit (and document) the company’s HR Compliance Program. The key to compliance, in my opinion, is having the proper structure to identify the issues, implement policies and procedures to address the issues, audit for compliance and “Document, Document, and Document”.  Three key takeaways: A gap analysis is a key component in the risk assessment process. The ultimate responsibility should lie with the business units and functional discipline to fully operationalize compliance. The role of the compliance department is to oversee, provide subject matter expertise and coordinate.   Learn more about your ad choices. Visit megaphone.fm/adchoices Hopefully you now understand that many of the traditional functions of HR can be seen as compliance internal controls. At every touchpoint in the lifecycle of the employment relationship there is a HR touchpoint. Fulfilling those touchpoints can be controls for compliance. If you think of multiple HR functions as compliance internal controls, one of the questions becomes how can you determine if HR is meeting the standards of a best practices compliance program? One place to start is with a gap analysis to determine what HR has in place that can facilitate your company’s compliance program.

Finally, work with HR to create a consolidated Human Resources Compliance Audit Checklist that can be used to audit (and document) the company’s HR Compliance Program. The key to compliance, in my opinion, is having the proper structure to identify the issues, implement policies and procedures to address the issues, audit for compliance and “Document, Document, and Document”.

 Three key takeaways:

  1. A gap analysis is a key component in the risk assessment process.
  2. The ultimate responsibility should lie with the business units and functional discipline to fully operationalize compliance.
  3. The role of the compliance department is to oversee, provide subject matter expertise and coordinate.

 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 no Compliance culture at the bottom One of the most important focuses of the DOJ’s 2019 Guidance was around culture. This means how far has the culture of compliance been driven down into an organization. The 2019 Guidance posed the following: Culture of Compliance – How often and how does the company measure its culture of compliance? Does the company seek input from all levels of employees to determine whether they perceive senior and middle management’s commitment to compliance? What steps has the company taken in response to its measurement of the compliance culture? These questions point to a CCO or compliance practitioner demonstrating how a culture of compliance is being burned into the very fabric of an organization. While leadership at and from the top has long been considered by both the DOJ and compliance professionals as a key element to move compliance forward, the 2019 Evaluation has also crystalized thinking around compliance culture throughout the organization, including at the bottom Too often, strategies to move a compliance program or even an initiative come from the top of an organization and are pushed down. To fully operationalize compliance, you must have leadership in compliance further down the organization which (hopefully) has been a part of the design process and can lead the implementation throughout an organization. Three key takeaways: While tone at the top is critical, the tone at the bottom can work to more fully operationalize compliance. 95% of the work is done at this bottom level. Use HR to come up with a strategy to move compliance into the bottom for more complete operationalization.   Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 26 Feb 2020 18:03:00 -0000 Compliance culture at the bottom full Thomas Fox How can you impact tone at the bottom of your organization? Find out on today's episode of 31 Days to a More Effective Compliance Program. One of the most important focuses of the DOJ’s 2019 Guidance was around culture. This means how far has the culture of compliance been driven down into an organization. The 2019 Guidance posed the following: Culture of Compliance – How often and how does the company measure its culture of compliance? Does the company seek input from all levels of employees to determine whether they perceive senior and middle management’s commitment to compliance? What steps has the company taken in response to its measurement of the compliance culture? These questions point to a CCO or compliance practitioner demonstrating how a culture of compliance is being burned into the very fabric of an organization. While leadership at and from the top has long been considered by both the DOJ and compliance professionals as a key element to move compliance forward, the 2019 Evaluation has also crystalized thinking around compliance culture throughout the organization, including at the bottom Too often, strategies to move a compliance program or even an initiative come from the top of an organization and are pushed down. To fully operationalize compliance, you must have leadership in compliance further down the organization which (hopefully) has been a part of the design process and can lead the implementation throughout an organization. Three key takeaways: While tone at the top is critical, the tone at the bottom can work to more fully operationalize compliance. 95% of the work is done at this bottom level. Use HR to come up with a strategy to move compliance into the bottom for more complete operationalization.   Learn more about your ad choices. Visit megaphone.fm/adchoices One of the most important focuses of the DOJ’s 2019 Guidance was around culture. This means how far has the culture of compliance been driven down into an organization. The 2019 Guidance posed the following:

Culture of Compliance – How often and how does the company measure its culture of compliance? Does the company seek input from all levels of employees to determine whether they perceive senior and middle management’s commitment to compliance? What steps has the company taken in response to its measurement of the compliance culture?

These questions point to a CCO or compliance practitioner demonstrating how a culture of compliance is being burned into the very fabric of an organization. While leadership at and from the top has long been considered by both the DOJ and compliance professionals as a key element to move compliance forward, the 2019 Evaluation has also crystalized thinking around compliance culture throughout the organization, including at the bottom

Too often, strategies to move a compliance program or even an initiative come from the top of an organization and are pushed down. To fully operationalize compliance, you must have leadership in compliance further down the organization which (hopefully) has been a part of the design process and can lead the implementation throughout an organization.

Three key takeaways:

  1. While tone at the top is critical, the tone at the bottom can work to more fully operationalize compliance.
  2. 95% of the work is done at this bottom level.
  3. Use HR to come up with a strategy to move compliance into the bottom for more complete operationalization.

 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 no Operationalizing compliance in the middle The DOJ has made clear that middle management is a critical part of any compliance program’s success. While it does all start at the top, with the Board of Directors and senior executives setting the tone for the rest of the company; prosecutors are mandated, under the 2019 Guidance to “how middle management, in turn, have reinforced those standards and encouraged employees to abide by them.” Moreover, the 2019 Guidance posed several question directly to middle management including the following: What actions have middle-management stakeholders taken to demonstrate their commitment to compliance or compliance personnel, including their remediation efforts? Have they persisted in that commitment in the face of competing interests or business objectives?  It is clear that the DOJ expects compliance to be operationalized down into the middle management level. Further experience has widely shown that employees prefer to speak to their direct supervisors about issues or potential compliance violations they become aware of. The question is how can a corporate compliance function reach middle management. This is a key area of assistance that can be provided by Human Resources as one of the ways that HR can help to operationalize compliance is to assist each level of an organization to have a proper tone, specifically, the middle of an organization You must think about your lines of communication and your communication skills when conveying your message of compliance down from the top into the middle of your organization. Three key takeaways: While tone at the top is critical, the tone in the middle can actually work to more fully operationalize compliance. How do you train middle managers? What compliance tool kit do you provide to middle managers? Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 25 Feb 2020 18:03:00 -0000 Operationalizing compliance in the middle full Thomas Fox How can you move compliance tone from the top to the middle? Find out in today's 31 Days to a More Effective Compliance Program. The DOJ has made clear that middle management is a critical part of any compliance program’s success. While it does all start at the top, with the Board of Directors and senior executives setting the tone for the rest of the company; prosecutors are mandated, under the 2019 Guidance to “how middle management, in turn, have reinforced those standards and encouraged employees to abide by them.” Moreover, the 2019 Guidance posed several question directly to middle management including the following: What actions have middle-management stakeholders taken to demonstrate their commitment to compliance or compliance personnel, including their remediation efforts? Have they persisted in that commitment in the face of competing interests or business objectives?  It is clear that the DOJ expects compliance to be operationalized down into the middle management level. Further experience has widely shown that employees prefer to speak to their direct supervisors about issues or potential compliance violations they become aware of. The question is how can a corporate compliance function reach middle management. This is a key area of assistance that can be provided by Human Resources as one of the ways that HR can help to operationalize compliance is to assist each level of an organization to have a proper tone, specifically, the middle of an organization You must think about your lines of communication and your communication skills when conveying your message of compliance down from the top into the middle of your organization. Three key takeaways: While tone at the top is critical, the tone in the middle can actually work to more fully operationalize compliance. How do you train middle managers? What compliance tool kit do you provide to middle managers? Learn more about your ad choices. Visit megaphone.fm/adchoices The DOJ has made clear that middle management is a critical part of any compliance program’s success. While it does all start at the top, with the Board of Directors and senior executives setting the tone for the rest of the company; prosecutors are mandated, under the 2019 Guidance to “how middle management, in turn, have reinforced those standards and encouraged employees to abide by them.” Moreover, the 2019 Guidance posed several question directly to middle management including the following: What actions have middle-management stakeholders taken to demonstrate their commitment to compliance or compliance personnel, including their remediation efforts? Have they persisted in that commitment in the face of competing interests or business objectives?

 It is clear that the DOJ expects compliance to be operationalized down into the middle management level. Further experience has widely shown that employees prefer to speak to their direct supervisors about issues or potential compliance violations they become aware of. The question is how can a corporate compliance function reach middle management. This is a key area of assistance that can be provided by Human Resources as one of the ways that HR can help to operationalize compliance is to assist each level of an organization to have a proper tone, specifically, the middle of an organization

You must think about your lines of communication and your communication skills when conveying your message of compliance down from the top into the middle of your organization.

Three key takeaways:

  1. While tone at the top is critical, the tone in the middle can actually work to more fully operationalize compliance.
  2. How do you train middle managers?
  3. What compliance tool kit do you provide to middle managers?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 no Promotion to operationalize compliance The role of HR in corporate compliance programs, is often underestimated. If your company has a culture where compliance is perceived to be in competition or worse yet antithetical to HR, the company certainly is not hitting on all cylinders and maybe moving towards dysfunction. Another way you can operationalize compliance is in HR’s involvement in employee promotion. Such compliance embedded into the promotion process can also be considered an internal compliance control. By doing so, your compliance may well work to create an effective internal controls regime as mandated by the FCPA and other anti-corruption laws.  Three key takeaways: Denying a promotion or award due to an employee’s ethical lapses. Use promotions to reinforce your company’s commitment to compliance and ethics. Should you wait for great? Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 24 Feb 2020 18:03:00 -0000 Promotion to operationalize compliance full Thomas Fox How can promotion help to operationalize compliance? Find out in today's episode of 31 Days to a More Effective Compliance Program. The role of HR in corporate compliance programs, is often underestimated. If your company has a culture where compliance is perceived to be in competition or worse yet antithetical to HR, the company certainly is not hitting on all cylinders and maybe moving towards dysfunction. Another way you can operationalize compliance is in HR’s involvement in employee promotion. Such compliance embedded into the promotion process can also be considered an internal compliance control. By doing so, your compliance may well work to create an effective internal controls regime as mandated by the FCPA and other anti-corruption laws.  Three key takeaways: Denying a promotion or award due to an employee’s ethical lapses. Use promotions to reinforce your company’s commitment to compliance and ethics. Should you wait for great? Learn more about your ad choices. Visit megaphone.fm/adchoices The role of HR in corporate compliance programs, is often underestimated. If your company has a culture where compliance is perceived to be in competition or worse yet antithetical to HR, the company certainly is not hitting on all cylinders and maybe moving towards dysfunction. Another way you can operationalize compliance is in HR’s involvement in employee promotion. Such compliance embedded into the promotion process can also be considered an internal compliance control. By doing so, your compliance may well work to create an effective internal controls regime as mandated by the FCPA and other anti-corruption laws.

 Three key takeaways:

  1. Denying a promotion or award due to an employee’s ethical lapses.
  2. Use promotions to reinforce your company’s commitment to compliance and ethics.
  3. Should you wait for great?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 no The exit interview The exit interview can be a further mechanism to operationalize compliance. This type of interview is used when someone voluntarily departs from a company, as opposed to a lay-off or reduction in force exercise. Typically departing employees are more willing to share about their experiences, concerns and issues which led to their employment departure. Three key takeaways: The exit interview is an excellent opportunity to obtain information to inform your compliance program. Use the exit interview to create advocates from departing employees. Use the exit interview for probing and insightful questions around compliance.   Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 21 Feb 2020 18:00:00 -0000 The exit interview full Thomas Fox How can the exit interview of a departing employee facilitate your compliance program? Find out in today's episode of 31 Days to a More Effective Compliance Program. The exit interview can be a further mechanism to operationalize compliance. This type of interview is used when someone voluntarily departs from a company, as opposed to a lay-off or reduction in force exercise. Typically departing employees are more willing to share about their experiences, concerns and issues which led to their employment departure. Three key takeaways: The exit interview is an excellent opportunity to obtain information to inform your compliance program. Use the exit interview to create advocates from departing employees. Use the exit interview for probing and insightful questions around compliance.   Learn more about your ad choices. Visit megaphone.fm/adchoices The exit interview can be a further mechanism to operationalize compliance. This type of interview is used when someone voluntarily departs from a company, as opposed to a lay-off or reduction in force exercise. Typically departing employees are more willing to share about their experiences, concerns and issues which led to their employment departure.

Three key takeaways:

  1. The exit interview is an excellent opportunity to obtain information to inform your compliance program.
  2. Use the exit interview to create advocates from departing employees.
  3. Use the exit interview for probing and insightful questions around compliance.

 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 no Employment separation Issues Employment separation and layoffs can present some unique challenges for the compliance practitioner. Employees can use layoffs to claim that they were retaliated against for a wide variety of complaints, including those for concerns that impact the compliance practitioner. Yet there are several ways that operationalization will help to protect your company as much as possible. The reasons for these actions are to allow you to demonstrate that any laid off employee was not separated because of a hotline or whistleblower allegation but due to your overall layoff scheme. However, it could be that you may need this person to provide your compliance department additional information, to be a resource to you going forward, or even a witness that you can reasonably anticipate the government may want to interview. If any of these situations exist, if you do not plan for their eventuality before you lay off the employee, said (now) ex-employee may not be inclined to cooperate with you going forward. Also, if you do demonstrate that you are sincerely interested in a meritorious hotline complaint, it may keep this person from becoming a SEC whistleblower. Three key takeaways: Treat departing employees with dignity. Make sure your separation documents meet SEC requirements regarding disclosures re: whistleblowing. You must check your hotline and anonymous reporting systems to make sure you do not lay off a whistleblower.   Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 20 Feb 2020 18:00:00 -0000 Employment separation Issues full Thomas Fox What is the role of compliance in employment separation? Find out in this episode of 31 Days to a More Effective Compliance Program. Employment separation and layoffs can present some unique challenges for the compliance practitioner. Employees can use layoffs to claim that they were retaliated against for a wide variety of complaints, including those for concerns that impact the compliance practitioner. Yet there are several ways that operationalization will help to protect your company as much as possible. The reasons for these actions are to allow you to demonstrate that any laid off employee was not separated because of a hotline or whistleblower allegation but due to your overall layoff scheme. However, it could be that you may need this person to provide your compliance department additional information, to be a resource to you going forward, or even a witness that you can reasonably anticipate the government may want to interview. If any of these situations exist, if you do not plan for their eventuality before you lay off the employee, said (now) ex-employee may not be inclined to cooperate with you going forward. Also, if you do demonstrate that you are sincerely interested in a meritorious hotline complaint, it may keep this person from becoming a SEC whistleblower. Three key takeaways: Treat departing employees with dignity. Make sure your separation documents meet SEC requirements regarding disclosures re: whistleblowing. You must check your hotline and anonymous reporting systems to make sure you do not lay off a whistleblower.   Learn more about your ad choices. Visit megaphone.fm/adchoices Employment separation and layoffs can present some unique challenges for the compliance practitioner. Employees can use layoffs to claim that they were retaliated against for a wide variety of complaints, including those for concerns that impact the compliance practitioner. Yet there are several ways that operationalization will help to protect your company as much as possible.

The reasons for these actions are to allow you to demonstrate that any laid off employee was not separated because of a hotline or whistleblower allegation but due to your overall layoff scheme. However, it could be that you may need this person to provide your compliance department additional information, to be a resource to you going forward, or even a witness that you can reasonably anticipate the government may want to interview. If any of these situations exist, if you do not plan for their eventuality before you lay off the employee, said (now) ex-employee may not be inclined to cooperate with you going forward. Also, if you do demonstrate that you are sincerely interested in a meritorious hotline complaint, it may keep this person from becoming a SEC whistleblower.

Three key takeaways:

  1. Treat departing employees with dignity.
  2. Make sure your separation documents meet SEC requirements regarding disclosures re: whistleblowing.
  3. You must check your hotline and anonymous reporting systems to make sure you do not lay off a whistleblower.

 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 no Hiring a CCO: Developing the job profile What should a company do when it desires to hire a CCO? To do so, a company needs to fully understand and appreciate what it needs from such a position going forward. Unfortunately, many companies do not have this insight at the beginning of the recruitment process. The key company stakeholders need to understand the full hiring process. Obviously, this will include HR and others involved in the hiring process for a CCO for the company. It could include the CEO, COO, CFO, CISO, Head of IA and others. They may need to rethink their approach to focus on what they will ask the new hire to accomplish because typically there is a disconnect between what the company thinks it needs and what it really needs. Three key takeaways: Bring in your key stakeholders to flesh out the job description. Consider the top four things you would like a new CCO to accomplish in the first year. For a new CCO to succeed, the company must have a realistic expectation developed before the process begins. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 19 Feb 2020 18:00:00 -0000 Hiring a CCO: Developing the job profile full Thomas Fox What process should a company go through when it wants to hire a new CCO? Find out in today's episode of 31 Days to a More Effective Compliance Program. What should a company do when it desires to hire a CCO? To do so, a company needs to fully understand and appreciate what it needs from such a position going forward. Unfortunately, many companies do not have this insight at the beginning of the recruitment process. The key company stakeholders need to understand the full hiring process. Obviously, this will include HR and others involved in the hiring process for a CCO for the company. It could include the CEO, COO, CFO, CISO, Head of IA and others. They may need to rethink their approach to focus on what they will ask the new hire to accomplish because typically there is a disconnect between what the company thinks it needs and what it really needs. Three key takeaways: Bring in your key stakeholders to flesh out the job description. Consider the top four things you would like a new CCO to accomplish in the first year. For a new CCO to succeed, the company must have a realistic expectation developed before the process begins. Learn more about your ad choices. Visit megaphone.fm/adchoices What should a company do when it desires to hire a CCO? To do so, a company needs to fully understand and appreciate what it needs from such a position going forward. Unfortunately, many companies do not have this insight at the beginning of the recruitment process. The key company stakeholders need to understand the full hiring process. Obviously, this will include HR and others involved in the hiring process for a CCO for the company. It could include the CEO, COO, CFO, CISO, Head of IA and others. They may need to rethink their approach to focus on what they will ask the new hire to accomplish because typically there is a disconnect between what the company thinks it needs and what it really needs.

Three key takeaways:

  1. Bring in your key stakeholders to flesh out the job description.
  2. Consider the top four things you would like a new CCO to accomplish in the first year.
  3. For a new CCO to succeed, the company must have a realistic expectation developed before the process begins.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 no Compliance performance appraisal review One of the ways to operationalize compliance and to drive it into the DNA of an organization is through a performance review. Indeed, the 2019 DOJ Guidance stated: Incentive System…Have there been specific examples of actions taken (e.g., promotions or awards denied) as a result of compliance and ethics considerations? Who determines the compensation, including bonuses, as well as discipline and promotion of compliance personnel? Most HR experts will opine that properly executed performance appraisals are crucial to organizational productivity as well as the development of employee skills and employee morale. Moreover, they can serve a couple of different functions for a best practices compliance program. First, and foremost, they communicate to each employee their job performance from a compliance perspective. However, one key is not to approach the performance appraisal review as an isolated event but rather a continual process. This means that instead of trying to play catch-up at the last minute, supervisors should provide feedback and assess job performance throughout the year so annual reviews are grounded in a year’s worth of experience. This includes the compliance component of each job. The second area performance appraisals impact is compensation. The DOJ expect that your compliance program will have both discipline and incentives. But those incentives need to be based upon something. The score or other performance appraisal metrics will provide to you a standard which you can measure and use to evaluate for other purposes such as employee promotion or advancement to senior management going forward. Three key takeaways: To incentivize compliance, you must be able to accurately appraise senior managers and employees around compliance. Clearly communicate your compliance expectations, then fairly evaluate employees on them. Consider conducting an ongoing review.   Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 18 Feb 2020 18:00:00 -0000 Compliance performance appraisal review full Thomas Fox What is the role of compliance in an employee appraisal? Find out in this episode of 31 Days to a More Effective Compliance Program. One of the ways to operationalize compliance and to drive it into the DNA of an organization is through a performance review. Indeed, the 2019 DOJ Guidance stated: Incentive System…Have there been specific examples of actions taken (e.g., promotions or awards denied) as a result of compliance and ethics considerations? Who determines the compensation, including bonuses, as well as discipline and promotion of compliance personnel? Most HR experts will opine that properly executed performance appraisals are crucial to organizational productivity as well as the development of employee skills and employee morale. Moreover, they can serve a couple of different functions for a best practices compliance program. First, and foremost, they communicate to each employee their job performance from a compliance perspective. However, one key is not to approach the performance appraisal review as an isolated event but rather a continual process. This means that instead of trying to play catch-up at the last minute, supervisors should provide feedback and assess job performance throughout the year so annual reviews are grounded in a year’s worth of experience. This includes the compliance component of each job. The second area performance appraisals impact is compensation. The DOJ expect that your compliance program will have both discipline and incentives. But those incentives need to be based upon something. The score or other performance appraisal metrics will provide to you a standard which you can measure and use to evaluate for other purposes such as employee promotion or advancement to senior management going forward. Three key takeaways: To incentivize compliance, you must be able to accurately appraise senior managers and employees around compliance. Clearly communicate your compliance expectations, then fairly evaluate employees on them. Consider conducting an ongoing review.   Learn more about your ad choices. Visit megaphone.fm/adchoices One of the ways to operationalize compliance and to drive it into the DNA of an organization is through a performance review. Indeed, the 2019 DOJ Guidance stated:

Incentive System…Have there been specific examples of actions taken (e.g., promotions or awards denied) as a result of compliance and ethics considerations? Who determines the compensation, including bonuses, as well as discipline and promotion of compliance personnel?

Most HR experts will opine that properly executed performance appraisals are crucial to organizational productivity as well as the development of employee skills and employee morale. Moreover, they can serve a couple of different functions for a best practices compliance program. First, and foremost, they communicate to each employee their job performance from a compliance perspective. However, one key is not to approach the performance appraisal review as an isolated event but rather a continual process. This means that instead of trying to play catch-up at the last minute, supervisors should provide feedback and assess job performance throughout the year so annual reviews are grounded in a year’s worth of experience. This includes the compliance component of each job. The second area performance appraisals impact is compensation. The DOJ expect that your compliance program will have both discipline and incentives. But those incentives need to be based upon something. The score or other performance appraisal metrics will provide to you a standard which you can measure and use to evaluate for other purposes such as employee promotion or advancement to senior management going forward.

Three key takeaways:

  1. To incentivize compliance, you must be able to accurately appraise senior managers and employees around compliance.
  2. Clearly communicate your compliance expectations, then fairly evaluate employees on them.
  3. Consider conducting an ongoing review.

 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 no Succession planning around compliance Another area where Human Resources can help to more fully operationalize compliance is in succession planning. Succession planning is just as important as governance, enterprise risk management and strategic oversight. In other words, it is just as important. Sadly, many companies fail to give it the attention it requires. A PricewaterhouseCoopers (PwC) survey, found nearly one-half of the more than 1,000 directors gauged reported dissatisfaction with their companies’ succession plans. Imagine what that number would be if they took into account the compliance aspect of succession planning. Some of the questions you might consider are the following. How did you fully operationalize compliance into the business unit that you managed? What controls did you put in place? And then what did you do when you found out about it? Every time I perform a risk assessment and speak to the company’s HR lead, they immediately understand the role than can play in moving forward a company’s compliance program. Even if the HR role is limited in the hiring process, they can ask potential candidates their views to determine underlying business ethics. HR can also begin the compliance inculcation process, even pre-hiring, by talking about the company’s values in the interview process. This sets an expectation that can be built upon if a candidate is selected and in every HR touch point going forward, including looking at employees in the succession planning process. Three key takeaways: Succession planning is just as important as governance, enterprise risk and strategic oversight. Do not begin your succession planning when a senior manager announces their retirement. You are always being evaluated (or you should be). Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 17 Feb 2020 18:00:00 -0000 Succession planning around compliance full Thomas Fox How can Human Resources help add compliance components to succession planning? Find out in today's edition of 31 Days to a More Effective Compliance. Another area where Human Resources can help to more fully operationalize compliance is in succession planning. Succession planning is just as important as governance, enterprise risk management and strategic oversight. In other words, it is just as important. Sadly, many companies fail to give it the attention it requires. A PricewaterhouseCoopers (PwC) survey, found nearly one-half of the more than 1,000 directors gauged reported dissatisfaction with their companies’ succession plans. Imagine what that number would be if they took into account the compliance aspect of succession planning. Some of the questions you might consider are the following. How did you fully operationalize compliance into the business unit that you managed? What controls did you put in place? And then what did you do when you found out about it? Every time I perform a risk assessment and speak to the company’s HR lead, they immediately understand the role than can play in moving forward a company’s compliance program. Even if the HR role is limited in the hiring process, they can ask potential candidates their views to determine underlying business ethics. HR can also begin the compliance inculcation process, even pre-hiring, by talking about the company’s values in the interview process. This sets an expectation that can be built upon if a candidate is selected and in every HR touch point going forward, including looking at employees in the succession planning process. Three key takeaways: Succession planning is just as important as governance, enterprise risk and strategic oversight. Do not begin your succession planning when a senior manager announces their retirement. You are always being evaluated (or you should be). Learn more about your ad choices. Visit megaphone.fm/adchoices Another area where Human Resources can help to more fully operationalize compliance is in succession planning. Succession planning is just as important as governance, enterprise risk management and strategic oversight. In other words, it is just as important. Sadly, many companies fail to give it the attention it requires. A PricewaterhouseCoopers (PwC) survey, found nearly one-half of the more than 1,000 directors gauged reported dissatisfaction with their companies’ succession plans. Imagine what that number would be if they took into account the compliance aspect of succession planning. Some of the questions you might consider are the following. How did you fully operationalize compliance into the business unit that you managed? What controls did you put in place? And then what did you do when you found out about it?

Every time I perform a risk assessment and speak to the company’s HR lead, they immediately understand the role than can play in moving forward a company’s compliance program. Even if the HR role is limited in the hiring process, they can ask potential candidates their views to determine underlying business ethics. HR can also begin the compliance inculcation process, even pre-hiring, by talking about the company’s values in the interview process. This sets an expectation that can be built upon if a candidate is selected and in every HR touch point going forward, including looking at employees in the succession planning process.

Three key takeaways:

  1. Succession planning is just as important as governance, enterprise risk and strategic oversight.
  2. Do not begin your succession planning when a senior manager announces their retirement.
  3. You are always being evaluated (or you should be).

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 no Institutional Justice and The Fair Process Doctrine Companies have finally come to realize that institutional justice and fairness are perhaps the most basic tenet of any successful workplace. If employees believe they will be treated fairly, it will engender a level of trust that can work to not simply motivate employees but lead to a more successful workplace and, at the end of the day, a more profitable company. This encompasses the entire lifecycle of the employment relationship, from hiring through separation. It works in areas as seeming disparate as compensation and incentives, discipline, promotion and internal reporting. The issue of Institutional Justice is most clearly seen in the area of discipline. This can be in the overall application of a compliance program to all employees, Board members and senior managers. One of the areas which Human Resources can operationalize your compliance program is to ensure that discipline is handed out appropriately and consistently across an organization and to reward those employees who integrate such ethical and compliant behavior into their individual work practices. In addition to providing a financial incentive for ethical behavior, it also provides a sense of institutional justice. Institutional justice comes from procedural fairness and is one area that will bring credibility to your compliance program Three key takeaways: The DOJ and SEC have long called for appropriate and consistent application of both incentives and discipline. The Fair Process Doctrine will help set institutional justice as the norm in your organization. Inconsistent application of discipline will destroy your compliance program credibility.   Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 14 Feb 2020 18:00:00 -0000 Institutional Justice and The Fair Process Doctrine full 10 Thomas Fox Institutional Justice and the Fair Process Doctrine are key concepts to help more fully operationalize your compliance program. Companies have finally come to realize that institutional justice and fairness are perhaps the most basic tenet of any successful workplace. If employees believe they will be treated fairly, it will engender a level of trust that can work to not simply motivate employees but lead to a more successful workplace and, at the end of the day, a more profitable company. This encompasses the entire lifecycle of the employment relationship, from hiring through separation. It works in areas as seeming disparate as compensation and incentives, discipline, promotion and internal reporting. The issue of Institutional Justice is most clearly seen in the area of discipline. This can be in the overall application of a compliance program to all employees, Board members and senior managers. One of the areas which Human Resources can operationalize your compliance program is to ensure that discipline is handed out appropriately and consistently across an organization and to reward those employees who integrate such ethical and compliant behavior into their individual work practices. In addition to providing a financial incentive for ethical behavior, it also provides a sense of institutional justice. Institutional justice comes from procedural fairness and is one area that will bring credibility to your compliance program Three key takeaways: The DOJ and SEC have long called for appropriate and consistent application of both incentives and discipline. The Fair Process Doctrine will help set institutional justice as the norm in your organization. Inconsistent application of discipline will destroy your compliance program credibility.   Learn more about your ad choices. Visit megaphone.fm/adchoices Companies have finally come to realize that institutional justice and fairness are perhaps the most basic tenet of any successful workplace. If employees believe they will be treated fairly, it will engender a level of trust that can work to not simply motivate employees but lead to a more successful workplace and, at the end of the day, a more profitable company. This encompasses the entire lifecycle of the employment relationship, from hiring through separation. It works in areas as seeming disparate as compensation and incentives, discipline, promotion and internal reporting.

The issue of Institutional Justice is most clearly seen in the area of discipline. This can be in the overall application of a compliance program to all employees, Board members and senior managers. One of the areas which Human Resources can operationalize your compliance program is to ensure that discipline is handed out appropriately and consistently across an organization and to reward those employees who integrate such ethical and compliant behavior into their individual work practices. In addition to providing a financial incentive for ethical behavior, it also provides a sense of institutional justice. Institutional justice comes from procedural fairness and is one area that will bring credibility to your compliance program

Three key takeaways:

  1. The DOJ and SEC have long called for appropriate and consistent application of both incentives and discipline.
  2. The Fair Process Doctrine will help set institutional justice as the norm in your organization.
  3. Inconsistent application of discipline will destroy your compliance program credibility.

 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 no Sales incentives and compliance In the DOJ’s 2019 Guidance, Incentives and Disciplinary Measures it stated:  Incentive System – Has the company considered the implications of its incentives and rewards on compliance? How does the company incentivize compliance and ethical behavior? Have there been specific examples of actions taken (e.g., promotions or awards denied) as a result of compliance and ethics considerations? Who determines the compensation, including bonuses, as well as discipline and promotion of compliance personnel? When considering how a company could use incentives to further a compliance program and the role of HR in this process, we should also consider how incentives might lead to the converse, as they did in the now-infamous Wells Fargo fraudulent-accounts scandal. When you misalign these two concepts with a faulty sales strategy it can lead to a catastrophic failure, literally costing the company millions of dollars in fines, loss of business and depreciation of shareholder value. Whatever your incentive structure, there will be employees who try to game the system. Some will do it with the tacit or explicit approval of management. You, as the CCO, may be required to act. Three key takeaways: Even a benign sales incentive program came become skewed. A sales incentive program can become high risk or illegal if not properly monitored. If there is alignment between the strategy, purpose and structure of an incentive system, it often makes the difference between a good and a bad one.   Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 13 Feb 2020 18:00:00 -0000 Sales incentives and compliance full 9 Thomas Fox Sales incentives can guide compliance or skew compliance. The Wells Fargo fraudulent accounts scandal is an example of a benign system gone awry. In the DOJ’s 2019 Guidance, Incentives and Disciplinary Measures it stated:  Incentive System – Has the company considered the implications of its incentives and rewards on compliance? How does the company incentivize compliance and ethical behavior? Have there been specific examples of actions taken (e.g., promotions or awards denied) as a result of compliance and ethics considerations? Who determines the compensation, including bonuses, as well as discipline and promotion of compliance personnel? When considering how a company could use incentives to further a compliance program and the role of HR in this process, we should also consider how incentives might lead to the converse, as they did in the now-infamous Wells Fargo fraudulent-accounts scandal. When you misalign these two concepts with a faulty sales strategy it can lead to a catastrophic failure, literally costing the company millions of dollars in fines, loss of business and depreciation of shareholder value. Whatever your incentive structure, there will be employees who try to game the system. Some will do it with the tacit or explicit approval of management. You, as the CCO, may be required to act. Three key takeaways: Even a benign sales incentive program came become skewed. A sales incentive program can become high risk or illegal if not properly monitored. If there is alignment between the strategy, purpose and structure of an incentive system, it often makes the difference between a good and a bad one.   Learn more about your ad choices. Visit megaphone.fm/adchoices In the DOJ’s 2019 Guidance, Incentives and Disciplinary Measures it stated:

 Incentive System – Has the company considered the implications of its incentives and rewards on compliance? How does the company incentivize compliance and ethical behavior? Have there been specific examples of actions taken (e.g., promotions or awards denied) as a result of compliance and ethics considerations? Who determines the compensation, including bonuses, as well as discipline and promotion of compliance personnel?

When considering how a company could use incentives to further a compliance program and the role of HR in this process, we should also consider how incentives might lead to the converse, as they did in the now-infamous Wells Fargo fraudulent-accounts scandal. When you misalign these two concepts with a faulty sales strategy it can lead to a catastrophic failure, literally costing the company millions of dollars in fines, loss of business and depreciation of shareholder value. Whatever your incentive structure, there will be employees who try to game the system. Some will do it with the tacit or explicit approval of management. You, as the CCO, may be required to act.

Three key takeaways:

  1. Even a benign sales incentive program came become skewed.
  2. A sales incentive program can become high risk or illegal if not properly monitored.
  3. If there is alignment between the strategy, purpose and structure of an incentive system, it often makes the difference between a good and a bad one.

 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 529 no Executives Compensation and compliance incentives A 2015 New York Times article by Gretchen Morgenson, entitled “Ways to Put the Boss’s Skin In the Game”, dealt with a long-standing question about how to make senior executives more responsible for corporate malfeasance? Her article had direct application to compliance programs and compensation for senior management tied to compliance. Morgenson said the issue was “Whenever a big corporation settles an enforcement matter with prosecutors, penalties levied in the case - and they can be enormous - are usually paid by the company’s shareholders. Yet the people who actually did the deeds or oversaw the operations rarely so much as open their wallets.” She went on to explain the economic phenomenon of “perverse incentives” wherein executives are encouraged to take excessive risk because they can profit so much from them, all the while knowing they probably won’t have to pay any fines or face other costly consequences of their actions. To help remedy this situation, the idea has come to the fore about senior managers putting some “skin in the game. Three key takeaways: Perverse incentives are named that for a reason; they really are bad. How can you create positive incentives in your organization? There is a business response to the legal issue. Employ it.   Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 12 Feb 2020 18:00:00 -0000 Executives Compensation and compliance incentives full Thomas Fox To fully incentivize executives around compliance, they must have skin in the game. A 2015 New York Times article by Gretchen Morgenson, entitled “Ways to Put the Boss’s Skin In the Game”, dealt with a long-standing question about how to make senior executives more responsible for corporate malfeasance? Her article had direct application to compliance programs and compensation for senior management tied to compliance. Morgenson said the issue was “Whenever a big corporation settles an enforcement matter with prosecutors, penalties levied in the case - and they can be enormous - are usually paid by the company’s shareholders. Yet the people who actually did the deeds or oversaw the operations rarely so much as open their wallets.” She went on to explain the economic phenomenon of “perverse incentives” wherein executives are encouraged to take excessive risk because they can profit so much from them, all the while knowing they probably won’t have to pay any fines or face other costly consequences of their actions. To help remedy this situation, the idea has come to the fore about senior managers putting some “skin in the game. Three key takeaways: Perverse incentives are named that for a reason; they really are bad. How can you create positive incentives in your organization? There is a business response to the legal issue. Employ it.   Learn more about your ad choices. Visit megaphone.fm/adchoices A 2015 New York Times article by Gretchen Morgenson, entitled “Ways to Put the Boss’s Skin In the Game”, dealt with a long-standing question about how to make senior executives more responsible for corporate malfeasance? Her article had direct application to compliance programs and compensation for senior management tied to compliance. Morgenson said the issue was “Whenever a big corporation settles an enforcement matter with prosecutors, penalties levied in the case - and they can be enormous - are usually paid by the company’s shareholders. Yet the people who actually did the deeds or oversaw the operations rarely so much as open their wallets.”

She went on to explain the economic phenomenon of “perverse incentives” wherein executives are encouraged to take excessive risk because they can profit so much from them, all the while knowing they probably won’t have to pay any fines or face other costly consequences of their actions. To help remedy this situation, the idea has come to the fore about senior managers putting some “skin in the game.

Three key takeaways:

  1. Perverse incentives are named that for a reason; they really are bad.
  2. How can you create positive incentives in your organization?
  3. There is a business response to the legal issue. Employ it.

 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 529 no Designing compensation to operationalize compliance One of the areas that many companies have not paid as much attention to in their anti-corruption compliance programs is designing their compensation system to more fully operationalize compliance. However, the DOJ and SEC have long made clear that they view monetary structure for compensation, rewarding those employees who do business in compliance with their employer’s compliance program, as one of the ways to reinforce the compliance program and the message of compliance.  There are three key questions you should ask yourself in modifying your compensation structure. First, is the change simple? Keep the compensation plan simple and even employee KISS, (Keep It Simple Sir), when designing your program. Second, is the changed aligned with your company values? As the CCO or compliance practitioner, you need to posit the most important compliance goal your entity needs to achieve. From there you should determine how your compensation program can be aligned with that goal. Third, is the effect on behavior immediate due to the change? Finally, under immediacy, it is important that such structures be put in place “immediately” but in a way that incentives employees. Three key takeaways: The DOJ and SEC have long advocated compensation to motivate employees into ethical and compliant behaviors. Keep the compliance aspects of your compensation structure simple and easy for your employees to understand. Have full transparency in the frame of your compensation structure. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 11 Feb 2020 18:00:00 -0000 Designing compensation to operationalize compliance full 7 Thomas Fox What are the 3 key questions you must consider in designing your compensation system to operationalize compliance? One of the areas that many companies have not paid as much attention to in their anti-corruption compliance programs is designing their compensation system to more fully operationalize compliance. However, the DOJ and SEC have long made clear that they view monetary structure for compensation, rewarding those employees who do business in compliance with their employer’s compliance program, as one of the ways to reinforce the compliance program and the message of compliance.  There are three key questions you should ask yourself in modifying your compensation structure. First, is the change simple? Keep the compensation plan simple and even employee KISS, (Keep It Simple Sir), when designing your program. Second, is the changed aligned with your company values? As the CCO or compliance practitioner, you need to posit the most important compliance goal your entity needs to achieve. From there you should determine how your compensation program can be aligned with that goal. Third, is the effect on behavior immediate due to the change? Finally, under immediacy, it is important that such structures be put in place “immediately” but in a way that incentives employees. Three key takeaways: The DOJ and SEC have long advocated compensation to motivate employees into ethical and compliant behaviors. Keep the compliance aspects of your compensation structure simple and easy for your employees to understand. Have full transparency in the frame of your compensation structure. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the areas that many companies have not paid as much attention to in their anti-corruption compliance programs is designing their compensation system to more fully operationalize compliance. However, the DOJ and SEC have long made clear that they view monetary structure for compensation, rewarding those employees who do business in compliance with their employer’s compliance program, as one of the ways to reinforce the compliance program and the message of compliance. 

There are three key questions you should ask yourself in modifying your compensation structure. First, is the change simple? Keep the compensation plan simple and even employee KISS, (Keep It Simple Sir), when designing your program. Second, is the changed aligned with your company values? As the CCO or compliance practitioner, you need to posit the most important compliance goal your entity needs to achieve. From there you should determine how your compensation program can be aligned with that goal. Third, is the effect on behavior immediate due to the change? Finally, under immediacy, it is important that such structures be put in place “immediately” but in a way that incentives employees.

Three key takeaways:

  1. The DOJ and SEC have long advocated compensation to motivate employees into ethical and compliant behaviors.
  2. Keep the compliance aspects of your compensation structure simple and easy for your employees to understand.
  3. Have full transparency in the frame of your compensation structure.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 529 no Six core principles for compliance incentives Most compliance professionals understand the need to discipline employees who may have violated ethics and compliance programs or otherwise engaged in bribery and corruption. However, many Chief Compliance Officers (CCOs) and compliance practitioners do not focus as much attention to compliance incentives. I have developed six core principles for incentives, adapted from Spring 2014 MIT Sloan Management Review article, entitled “Combining Purpose with Profits”, and formulated them for the compliance function in an anti-corruption compliance program. 1.     Compliance incentives don’t have to be elaborate or novel.  2.     Compliance incentives need supporting systems if they are to stick. 3.     Support systems are needed to reinforce compliance incentives. 4.     Compliance incentives need a “counterweight” to endure. 5.     Compliance incentive alignment works in an oblique, not linear, way. 6.     Compliance incentive initiatives can be implemented at all levels. Obviously, this list is not exhaustive. Yet it is now more important than ever that you demonstrate tangible incentives for your employees to gain benefits, both financial and hierarchical, through doing business ethically, in compliance with your own Code of Conduct and most certainly in compliance with relevant anti-bribery laws. It is also a requirement that such actions be documented so they can be demonstrated to the regulators, if they come knocking.  Three key takeaways: Compliance incentives do not have to be elaborate or novel. You must create support systems for your compliance incentives.  Compliance incentives should be implemented at all levels.  Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 10 Feb 2020 18:00:00 -0000 Six core principles for compliance incentives full 6 Thomas Fox How can HR help compliance design an incentive program? Most compliance professionals understand the need to discipline employees who may have violated ethics and compliance programs or otherwise engaged in bribery and corruption. However, many Chief Compliance Officers (CCOs) and compliance practitioners do not focus as much attention to compliance incentives. I have developed six core principles for incentives, adapted from Spring 2014 MIT Sloan Management Review article, entitled “Combining Purpose with Profits”, and formulated them for the compliance function in an anti-corruption compliance program. 1.     Compliance incentives don’t have to be elaborate or novel.  2.     Compliance incentives need supporting systems if they are to stick. 3.     Support systems are needed to reinforce compliance incentives. 4.     Compliance incentives need a “counterweight” to endure. 5.     Compliance incentive alignment works in an oblique, not linear, way. 6.     Compliance incentive initiatives can be implemented at all levels. Obviously, this list is not exhaustive. Yet it is now more important than ever that you demonstrate tangible incentives for your employees to gain benefits, both financial and hierarchical, through doing business ethically, in compliance with your own Code of Conduct and most certainly in compliance with relevant anti-bribery laws. It is also a requirement that such actions be documented so they can be demonstrated to the regulators, if they come knocking.  Three key takeaways: Compliance incentives do not have to be elaborate or novel. You must create support systems for your compliance incentives.  Compliance incentives should be implemented at all levels.  Learn more about your ad choices. Visit megaphone.fm/adchoices Most compliance professionals understand the need to discipline employees who may have violated ethics and compliance programs or otherwise engaged in bribery and corruption. However, many Chief Compliance Officers (CCOs) and compliance practitioners do not focus as much attention to compliance incentives. I have developed six core principles for incentives, adapted from Spring 2014 MIT Sloan Management Review article, entitled “Combining Purpose with Profits”, and formulated them for the compliance function in an anti-corruption compliance program.

1.     Compliance incentives don’t have to be elaborate or novel. 

2.     Compliance incentives need supporting systems if they are to stick.

3.     Support systems are needed to reinforce compliance incentives.

4.     Compliance incentives need a “counterweight” to endure.

5.     Compliance incentive alignment works in an oblique, not linear, way.

6.     Compliance incentive initiatives can be implemented at all levels.

Obviously, this list is not exhaustive. Yet it is now more important than ever that you demonstrate tangible incentives for your employees to gain benefits, both financial and hierarchical, through doing business ethically, in compliance with your own Code of Conduct and most certainly in compliance with relevant anti-bribery laws. It is also a requirement that such actions be documented so they can be demonstrated to the regulators, if they come knocking. 

Three key takeaways:

  1. Compliance incentives do not have to be elaborate or novel.
  2. You must create support systems for your compliance incentives. 
  3. Compliance incentives should be implemented at all levels. 


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 529 no The Role of Human Resources in Incentivizing Compliance One of the key points that representatives of the DOJ and Securities and Exchange Commission (SEC) have continually raised when discussing any best practices compliance program. The 2012 FCPA Guidance is clear that there should be incentives for not only following your own company’s internal Code of Conduct but also doing business the right way, i.e., not engaging in bribery and corruption. On incentives, the 2012 FCPA Guidance said, “DOJ and SEC recognize that positive incentives can also drive compliant behavior. These incentives can take many forms such as personnel evaluations and promotions, rewards for improving and developing a company’s compliance program, and rewards for ethics and compliance leadership. Some organizations, for example, have made adherence to compliance a significant metric for management’s bonuses so that compliance becomes an integral part of management’s everyday concern.” But it also recognizes that incentives need not only be limited to financial rewards as sometimes simply acknowledging employees for doing the right thing can be a powerful tool as well Incentives can be integrated into the DNA of a company through the hiring and promotion processes. There should be a compliance component to all senior management hires and promotions up to those august ranks within a company. Your HR function can be a great aid to your cause in driving the right type of behavior through the design and implementation of such structures. Employees know who gets promoted and why. If someone who is only known for hitting their numbers continually is promoted, however they accomplished this feat will certainly be observed by his or her co-workers.  Three key takeaways: The DOJ 2019 Guidance specifically calls out incentives for doing business ethically and in compliance. HR can lead the efforts around incentives. Incentives go beyond financial rewards.   Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 07 Feb 2020 18:00:00 -0000 The Role of Human Resources in Incentivizing Compliance full Thomas Fox How can Human Resources help craft a program, incentivizing compliance? Find out in today's offering of 31 Days to a More Effective Compliance Program. One of the key points that representatives of the DOJ and Securities and Exchange Commission (SEC) have continually raised when discussing any best practices compliance program. The 2012 FCPA Guidance is clear that there should be incentives for not only following your own company’s internal Code of Conduct but also doing business the right way, i.e., not engaging in bribery and corruption. On incentives, the 2012 FCPA Guidance said, “DOJ and SEC recognize that positive incentives can also drive compliant behavior. These incentives can take many forms such as personnel evaluations and promotions, rewards for improving and developing a company’s compliance program, and rewards for ethics and compliance leadership. Some organizations, for example, have made adherence to compliance a significant metric for management’s bonuses so that compliance becomes an integral part of management’s everyday concern.” But it also recognizes that incentives need not only be limited to financial rewards as sometimes simply acknowledging employees for doing the right thing can be a powerful tool as well Incentives can be integrated into the DNA of a company through the hiring and promotion processes. There should be a compliance component to all senior management hires and promotions up to those august ranks within a company. Your HR function can be a great aid to your cause in driving the right type of behavior through the design and implementation of such structures. Employees know who gets promoted and why. If someone who is only known for hitting their numbers continually is promoted, however they accomplished this feat will certainly be observed by his or her co-workers.  Three key takeaways: The DOJ 2019 Guidance specifically calls out incentives for doing business ethically and in compliance. HR can lead the efforts around incentives. Incentives go beyond financial rewards.   Learn more about your ad choices. Visit megaphone.fm/adchoices One of the key points that representatives of the DOJ and Securities and Exchange Commission (SEC) have continually raised when discussing any best practices compliance program. The 2012 FCPA Guidance is clear that there should be incentives for not only following your own company’s internal Code of Conduct but also doing business the right way, i.e., not engaging in bribery and corruption. On incentives, the 2012 FCPA Guidance said, “DOJ and SEC recognize that positive incentives can also drive compliant behavior.

These incentives can take many forms such as personnel evaluations and promotions, rewards for improving and developing a company’s compliance program, and rewards for ethics and compliance leadership. Some organizations, for example, have made adherence to compliance a significant metric for management’s bonuses so that compliance becomes an integral part of management’s everyday concern.” But it also recognizes that incentives need not only be limited to financial rewards as sometimes simply acknowledging employees for doing the right thing can be a powerful tool as well

Incentives can be integrated into the DNA of a company through the hiring and promotion processes. There should be a compliance component to all senior management hires and promotions up to those august ranks within a company. Your HR function can be a great aid to your cause in driving the right type of behavior through the design and implementation of such structures. Employees know who gets promoted and why. If someone who is only known for hitting their numbers continually is promoted, however they accomplished this feat will certainly be observed by his or her co-workers.

 Three key takeaways:

  1. The DOJ 2019 Guidance specifically calls out incentives for doing business ethically and in compliance.
  2. HR can lead the efforts around incentives.
  3. Incentives go beyond financial rewards.

 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 529 no Using the Reference Check to Operationalize Compliance As far back as 2004, in Opinion Release 04-02, the DOJ realized this was an important part of an overall compliance program when it approved a proposed compliance program that had the following requirement, "Clearly articulated procedures which ensure that discretionary authority is not delegated to persons who the company knows have a propensity to engage in illegal or improper activities." One tool that is often overlooked in the hiring process is the reference check. Many practitioners feel that a reference is not of value because prospective candidates will only list references that they believe will provide glowing recommendations of character. This leads to a pro forma reference check. The hiring of someone who will perform business activities in compliance with anti-corruption laws such as the FCPA will continue to be as much art as science because the hiring of quality employees for senior management positions is similarly situated. But that does not mean a company cannot work to not hire those persons who might have a propensity to engage in bribery and corruption if the situation presented itself. The hiring process is just one more tool that can be utilized to build an effective and operationalized compliance program.  Three key takeaways: The hiring process is the first step in operationalizing your compliance program. The DOJ spoke to hiring as part of a best practices compliance program as far back as 2004. Reference checks are an underutilized part of the hiring process and a key internal HR control.  Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 06 Feb 2020 18:00:00 -0000 Using the Reference Check to Operationalize Compliance full Thomas Fox The reference check can be an important tool in the HR arsenal to more fully operationalize your compliance program. As far back as 2004, in Opinion Release 04-02, the DOJ realized this was an important part of an overall compliance program when it approved a proposed compliance program that had the following requirement, "Clearly articulated procedures which ensure that discretionary authority is not delegated to persons who the company knows have a propensity to engage in illegal or improper activities." One tool that is often overlooked in the hiring process is the reference check. Many practitioners feel that a reference is not of value because prospective candidates will only list references that they believe will provide glowing recommendations of character. This leads to a pro forma reference check. The hiring of someone who will perform business activities in compliance with anti-corruption laws such as the FCPA will continue to be as much art as science because the hiring of quality employees for senior management positions is similarly situated. But that does not mean a company cannot work to not hire those persons who might have a propensity to engage in bribery and corruption if the situation presented itself. The hiring process is just one more tool that can be utilized to build an effective and operationalized compliance program.  Three key takeaways: The hiring process is the first step in operationalizing your compliance program. The DOJ spoke to hiring as part of a best practices compliance program as far back as 2004. Reference checks are an underutilized part of the hiring process and a key internal HR control.  Learn more about your ad choices. Visit megaphone.fm/adchoices As far back as 2004, in Opinion Release 04-02, the DOJ realized this was an important part of an overall compliance program when it approved a proposed compliance program that had the following requirement, "Clearly articulated procedures which ensure that discretionary authority is not delegated to persons who the company knows have a propensity to engage in illegal or improper activities." One tool that is often overlooked in the hiring process is the reference check. Many practitioners feel that a reference is not of value because prospective candidates will only list references that they believe will provide glowing recommendations of character. This leads to a pro forma reference check.

The hiring of someone who will perform business activities in compliance with anti-corruption laws such as the FCPA will continue to be as much art as science because the hiring of quality employees for senior management positions is similarly situated. But that does not mean a company cannot work to not hire those persons who might have a propensity to engage in bribery and corruption if the situation presented itself. The hiring process is just one more tool that can be utilized to build an effective and operationalized compliance program. 


Three key takeaways:

  1. The hiring process is the first step in operationalizing your compliance program.
  2. The DOJ spoke to hiring as part of a best practices compliance program as far back as 2004.
  3. Reference checks are an underutilized part of the hiring process and a key internal HR control. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 532 no The Hiring Process as a Step to Operationalize Compliance One of the conventional wisdoms about compliance training is that you will never be able to reach 5% of your workforce with compliance training because they are predisposed to lie, cheat and steal anyway. Whether they are simply sociopaths, scumbags or just bad people; it really does not matter. No amount of training is going to convince them to follow the rules, as they do not think such laws apply to them. They will lie, cheat and steal no matter what industry they are in and what training you provide to them. But knowing such people exist and they may be able to lie, con or otherwise dissimilate their way into your organization does not protect your company from FCPA liability when they inevitably violate the law by engaging in bribery and corruption. It is still the responsibility of your company to prevent and detect such conduct and then remediate if it occurs. This is where your HR function has a dual role, with both their traditional hiring role and in a compliance function. They can work to help weed out such miscreants and to communicate your corporate values of doing business ethically, in compliance and aligned with your corporate values of integrity. Through a structured series of questions, however, a properly trained HR professional can begin to assess whether an employee might have a propensity to engage in bribery and corruption. By adding information about your company’s values towards doing business ethically and in compliance, you can introduce this topic at either the interview evaluating process or in the promotion process. While true sociopaths will most certainly lie to you, perhaps even convincingly, by introducing the topic at such a pre-employment stage, they may be encouraged to take their skills elsewhere Three key takeaways: Use the interview process to determine who will be an ethical and compliance fit for your organization. Consider the skill, will and fit approach. Ask open-ended questions. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 05 Feb 2020 18:00:00 -0000 The Hiring Process as a Step to Operationalize Compliance full Thomas Fox Human Resources plays a key role in the hiring process. You can use that role to more fully operationalize your compliance regime with some simply questions. One of the conventional wisdoms about compliance training is that you will never be able to reach 5% of your workforce with compliance training because they are predisposed to lie, cheat and steal anyway. Whether they are simply sociopaths, scumbags or just bad people; it really does not matter. No amount of training is going to convince them to follow the rules, as they do not think such laws apply to them. They will lie, cheat and steal no matter what industry they are in and what training you provide to them. But knowing such people exist and they may be able to lie, con or otherwise dissimilate their way into your organization does not protect your company from FCPA liability when they inevitably violate the law by engaging in bribery and corruption. It is still the responsibility of your company to prevent and detect such conduct and then remediate if it occurs. This is where your HR function has a dual role, with both their traditional hiring role and in a compliance function. They can work to help weed out such miscreants and to communicate your corporate values of doing business ethically, in compliance and aligned with your corporate values of integrity. Through a structured series of questions, however, a properly trained HR professional can begin to assess whether an employee might have a propensity to engage in bribery and corruption. By adding information about your company’s values towards doing business ethically and in compliance, you can introduce this topic at either the interview evaluating process or in the promotion process. While true sociopaths will most certainly lie to you, perhaps even convincingly, by introducing the topic at such a pre-employment stage, they may be encouraged to take their skills elsewhere Three key takeaways: Use the interview process to determine who will be an ethical and compliance fit for your organization. Consider the skill, will and fit approach. Ask open-ended questions. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the conventional wisdoms about compliance training is that you will never be able to reach 5% of your workforce with compliance training because they are predisposed to lie, cheat and steal anyway. Whether they are simply sociopaths, scumbags or just bad people; it really does not matter. No amount of training is going to convince them to follow the rules, as they do not think such laws apply to them. They will lie, cheat and steal no matter what industry they are in and what training you provide to them. But knowing such people exist and they may be able to lie, con or otherwise dissimilate their way into your organization does not protect your company from FCPA liability when they inevitably violate the law by engaging in bribery and corruption. It is still the responsibility of your company to prevent and detect such conduct and then remediate if it occurs.

This is where your HR function has a dual role, with both their traditional hiring role and in a compliance function. They can work to help weed out such miscreants and to communicate your corporate values of doing business ethically, in compliance and aligned with your corporate values of integrity.

Through a structured series of questions, however, a properly trained HR professional can begin to assess whether an employee might have a propensity to engage in bribery and corruption. By adding information about your company’s values towards doing business ethically and in compliance, you can introduce this topic at either the interview evaluating process or in the promotion process. While true sociopaths will most certainly lie to you, perhaps even convincingly, by introducing the topic at such a pre-employment stage, they may be encouraged to take their skills elsewhere

Three key takeaways:

  1. Use the interview process to determine who will be an ethical and compliance fit for your organization.
  2. Consider the skill, will and fit approach.
  3. Ask open-ended questions.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 531 no The Role of HR in Creating an Ethical Culture The Evaluation of Corporate Compliance Programs, 2019 Guidance, makes clear that operationalization of compliance into an organization should be done at multiple levels. The 2019 Guidance also called out culture as a key indicia for an ethical culture. Creating an ethical culture is an important step for any company to burn compliance into the DNA of a business. It must be done at every level of an organization on a continuous basis. Human Resources (HR) can play a key role in both the creation and maintenance of an ethical culture. Ethics and compliance blend together in the corporate world. It is not just the responsibility of CCOs and compliance practitioners but of HR to support those employees who want to do the right thing. While written protocols are significant in both detection and prevention, one should never lose sight of a corporate culture as a way to positively impact your workforce and company going forward. Three key takeaways: Beware of the three obstacles to creating an ethical culture. What really matters in your company? A speak up culture will improve the operational performance of your business. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 04 Feb 2020 18:00:00 -0000 The Role of HR in Creating an Ethical Culture full Thomas Fox What is the role of Human Resources in creating an ethical culture? Find out in today's edition of the role of HR in compliance. The Evaluation of Corporate Compliance Programs, 2019 Guidance, makes clear that operationalization of compliance into an organization should be done at multiple levels. The 2019 Guidance also called out culture as a key indicia for an ethical culture. Creating an ethical culture is an important step for any company to burn compliance into the DNA of a business. It must be done at every level of an organization on a continuous basis. Human Resources (HR) can play a key role in both the creation and maintenance of an ethical culture. Ethics and compliance blend together in the corporate world. It is not just the responsibility of CCOs and compliance practitioners but of HR to support those employees who want to do the right thing. While written protocols are significant in both detection and prevention, one should never lose sight of a corporate culture as a way to positively impact your workforce and company going forward. Three key takeaways: Beware of the three obstacles to creating an ethical culture. What really matters in your company? A speak up culture will improve the operational performance of your business. Learn more about your ad choices. Visit megaphone.fm/adchoices The Evaluation of Corporate Compliance Programs, 2019 Guidance, makes clear that operationalization of compliance into an organization should be done at multiple levels. The 2019 Guidance also called out culture as a key indicia for an ethical culture. Creating an ethical culture is an important step for any company to burn compliance into the DNA of a business. It must be done at every level of an organization on a continuous basis. Human Resources (HR) can play a key role in both the creation and maintenance of an ethical culture.

Ethics and compliance blend together in the corporate world. It is not just the responsibility of CCOs and compliance practitioners but of HR to support those employees who want to do the right thing. While written protocols are significant in both detection and prevention, one should never lose sight of a corporate culture as a way to positively impact your workforce and company going forward.

Three key takeaways:

  1. Beware of the three obstacles to creating an ethical culture.
  2. What really matters in your company?
  3. A speak up culture will improve the operational performance of your business.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 520 no The Role of Human Resources in Operationalizing Compliance-Introduction Ed. Note-my series in January, 31 Days to a More Effective Compliance Program, was so popular, I decided to extend it through 2020. Each month, I will focus on one topic in a best practices compliance program. I begin in February with the role of Human Resources in compliance. The series has its own iTunes channel, 31 Days to a More Effective Compliance Program. I hope you will find these podcasts useful. Tom Fox I have long advocated for a greater role of Human Resources (HR) in compliance. Indeed, one sign of a mature compliance and ethics program is the extent to which a company’s HR Department is involved in implementing a compliance solution. While many practitioners do not immediately consider HR as a key component of a best practices compliance solution, it can be one of the lynch pins in spreading a company’s commitment to compliance throughout the employee base. HR can also be used to ‘connect the dots’ in many divergent elements of a compliance and ethics program. Even more important is the operationalization of compliance into the fabric of the business. One of the key indicia of compliance program effectiveness is how thoroughly each separate corporate discipline incorporates compliance into its everyday job functions. An active and functioning compliance program will literally be alive in each department in an organization. HR has as many touchpoints as any other corporation function with employees. From interviews to onboarding, through evaluations and performance appraisals, even to the separation process; HR leads many of the corporate touchpoints. Each one of these touchpoints can be used to teach, educate and reinforce the message of doing business ethically and in compliance with anti-corruption laws Three key takeaways: What are the HR-employee touchpoints at your company? HR professionals can bring new, dynamic and innovative techniques to compliance Go down and have a cup of coffee with the head of your corporate HR department. Find out what they do and how they do it. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 03 Feb 2020 18:00:00 -0000 The Role of Human Resources in Operationalizing Compliance-Introduction full Thomas Fox In February 31 Days to a More Effective Compliance Program will consider the role of Human Resources in compliance. Today I introduce the topic. Ed. Note-my series in January, 31 Days to a More Effective Compliance Program, was so popular, I decided to extend it through 2020. Each month, I will focus on one topic in a best practices compliance program. I begin in February with the role of Human Resources in compliance. The series has its own iTunes channel, 31 Days to a More Effective Compliance Program. I hope you will find these podcasts useful. Tom Fox I have long advocated for a greater role of Human Resources (HR) in compliance. Indeed, one sign of a mature compliance and ethics program is the extent to which a company’s HR Department is involved in implementing a compliance solution. While many practitioners do not immediately consider HR as a key component of a best practices compliance solution, it can be one of the lynch pins in spreading a company’s commitment to compliance throughout the employee base. HR can also be used to ‘connect the dots’ in many divergent elements of a compliance and ethics program. Even more important is the operationalization of compliance into the fabric of the business. One of the key indicia of compliance program effectiveness is how thoroughly each separate corporate discipline incorporates compliance into its everyday job functions. An active and functioning compliance program will literally be alive in each department in an organization. HR has as many touchpoints as any other corporation function with employees. From interviews to onboarding, through evaluations and performance appraisals, even to the separation process; HR leads many of the corporate touchpoints. Each one of these touchpoints can be used to teach, educate and reinforce the message of doing business ethically and in compliance with anti-corruption laws Three key takeaways: What are the HR-employee touchpoints at your company? HR professionals can bring new, dynamic and innovative techniques to compliance Go down and have a cup of coffee with the head of your corporate HR department. Find out what they do and how they do it. Learn more about your ad choices. Visit megaphone.fm/adchoices Ed. Note-my series in January, 31 Days to a More Effective Compliance Program, was so popular, I decided to extend it through 2020. Each month, I will focus on one topic in a best practices compliance program. I begin in February with the role of Human Resources in compliance. The series has its own iTunes channel, 31 Days to a More Effective Compliance Program. I hope you will find these podcasts useful. Tom Fox


I have long advocated for a greater role of Human Resources (HR) in compliance. Indeed, one sign of a mature compliance and ethics program is the extent to which a company’s HR Department is involved in implementing a compliance solution. While many practitioners do not immediately consider HR as a key component of a best practices compliance solution, it can be one of the lynch pins in spreading a company’s commitment to compliance throughout the employee base. HR can also be used to ‘connect the dots’ in many divergent elements of a compliance and ethics program.

Even more important is the operationalization of compliance into the fabric of the business. One of the key indicia of compliance program effectiveness is how thoroughly each separate corporate discipline incorporates compliance into its everyday job functions. An active and functioning compliance program will literally be alive in each department in an organization.

HR has as many touchpoints as any other corporation function with employees. From interviews to onboarding, through evaluations and performance appraisals, even to the separation process; HR leads many of the corporate touchpoints. Each one of these touchpoints can be used to teach, educate and reinforce the message of doing business ethically and in compliance with anti-corruption laws

Three key takeaways:

  1. What are the HR-employee touchpoints at your company?
  2. HR professionals can bring new, dynamic and innovative techniques to compliance
  3. Go down and have a cup of coffee with the head of your corporate HR department. Find out what they do and how they do it.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 495 no Day 31 | Levels of due diligence Due diligence is generally recognized in three levels: Level I, Level II and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward. The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward. A three-step approach was discussed in Opinion Release 10-02, in which the DOJ discussed the due diligence that the requesting entity performed. This Opinion Release sets out a clear break which every compliance practitioner should use in considering an appropriate level of due diligence to engage with your third-party risk management process or when considering the level of due diligence required on a potential business venture partner. A very good description of the three levels of due diligence was presented by Candice Tal, Founder and CEO of Infortal Worldwide, in an article entitled “Deep Level Due Diligence: What You Need to Know” Three key takeaways: A Level I due diligence should only be used where there is a low risk of corruption. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared. Level III due diligence is deep dive, boots on the ground investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 31 Jan 2020 06:00:00 -0000 Day 31 | Levels of due diligence full 31 Thomas Fox What are the 3 levels of due diligence? Due diligence is generally recognized in three levels: Level I, Level II and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward. The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward. A three-step approach was discussed in Opinion Release 10-02, in which the DOJ discussed the due diligence that the requesting entity performed. This Opinion Release sets out a clear break which every compliance practitioner should use in considering an appropriate level of due diligence to engage with your third-party risk management process or when considering the level of due diligence required on a potential business venture partner. A very good description of the three levels of due diligence was presented by Candice Tal, Founder and CEO of Infortal Worldwide, in an article entitled “Deep Level Due Diligence: What You Need to Know” Three key takeaways: A Level I due diligence should only be used where there is a low risk of corruption. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared. Level III due diligence is deep dive, boots on the ground investigation. Learn more about your ad choices. Visit megaphone.fm/adchoices Due diligence is generally recognized in three levels: Level I, Level II and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward. The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward.

A three-step approach was discussed in Opinion Release 10-02, in which the DOJ discussed the due diligence that the requesting entity performed. This Opinion Release sets out a clear break which every compliance practitioner should use in considering an appropriate level of due diligence to engage with your third-party risk management process or when considering the level of due diligence required on a potential business venture partner. A very good description of the three levels of due diligence was presented by Candice Tal, Founder and CEO of Infortal Worldwide, in an article entitled “Deep Level Due Diligence: What You Need to Know”

Three key takeaways:

  1. A Level I due diligence should only be used where there is a low risk of corruption.
  2. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared.
  3. Level III due diligence is deep dive, boots on the ground investigation.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 641 no Day 30 | Using a root cause analysis for remediation We previously considered the Prong in the Evaluation that was not present in the Ten Hallmarks of an Effective Compliance Program; that being root cause analysis. The requirement was first raised in the 2017 Evaluation. It was then carried forward as a requirement in the FCPA Corporate Enforcement Policy, later in 2017. It was discussed again in the 2019 Guidance. You should begin with the question of who should perform the remediation; should it be an investigator or an investigative team which were a part of the root cause analysis? Jonathan Marks, believes the key is both “independence and objectivity.” It may be that an investigator or investigative team is a subject matter expert and “therefore more qualified to get that particular recourse”. Yet to perform the remediation, the key is to integrate the information developed from the root cause analysis into the solution. Marks further noted that the company may also have deficiencies in internal controls. More importantly, the failure to remediate gaps in internal controls “provides the opportunity for additional errors or misconduct to occur, and thus could damage the company’s credibility with regulators” by allowing the same or similar conduct to reoccur. Finally, with both the 2019 Guidance and FCPA Corporate Enforcement Policy, the DOJ has added its voice to prior SEC statements that regulators “will focus on what steps the company took upon learning of the misconduct, whether the company immediately stopped the misconduct, and what new and more effective internal controls or procedures the company has adopted or plans to adopt to prevent a recurrence. Three key takeaways: The key is objectivity and independence. The critical element is how did you use the information you developed in the root cause analysis? The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 30 Jan 2020 06:00:00 -0000 Day 30 | Using a root cause analysis for remediation full 30 Thomas Fox We previously considered the Prong in the Evaluation that was not present in the Ten Hallmarks of an Effective Compliance Program; that being root cause analysis. The requirement was first raised in the 2017 Evaluation. It was then carried forward as a requirement in the FCPA Corporate Enforcement Policy, later in 2017. It was discussed again in the 2019 Guidance. You should begin with the question of who should perform the remediation; should it be an investigator or an investigative team which were a part of the root cause analysis? Jonathan Marks, believes the key is both “independence and objectivity.” It may be that an investigator or investigative team is a subject matter expert and “therefore more qualified to get that particular recourse”. Yet to perform the remediation, the key is to integrate the information developed from the root cause analysis into the solution. Marks further noted that the company may also have deficiencies in internal controls. More importantly, the failure to remediate gaps in internal controls “provides the opportunity for additional errors or misconduct to occur, and thus could damage the company’s credibility with regulators” by allowing the same or similar conduct to reoccur. Finally, with both the 2019 Guidance and FCPA Corporate Enforcement Policy, the DOJ has added its voice to prior SEC statements that regulators “will focus on what steps the company took upon learning of the misconduct, whether the company immediately stopped the misconduct, and what new and more effective internal controls or procedures the company has adopted or plans to adopt to prevent a recurrence. Three key takeaways: The key is objectivity and independence. The critical element is how did you use the information you developed in the root cause analysis? The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization. Learn more about your ad choices. Visit megaphone.fm/adchoices We previously considered the Prong in the Evaluation that was not present in the Ten Hallmarks of an Effective Compliance Program; that being root cause analysis. The requirement was first raised in the 2017 Evaluation. It was then carried forward as a requirement in the FCPA Corporate Enforcement Policy, later in 2017. It was discussed again in the 2019 Guidance.

You should begin with the question of who should perform the remediation; should it be an investigator or an investigative team which were a part of the root cause analysis? Jonathan Marks, believes the key is both “independence and objectivity.” It may be that an investigator or investigative team is a subject matter expert and “therefore more qualified to get that particular recourse”. Yet to perform the remediation, the key is to integrate the information developed from the root cause analysis into the solution.

Marks further noted that the company may also have deficiencies in internal controls. More importantly, the failure to remediate gaps in internal controls “provides the opportunity for additional errors or misconduct to occur, and thus could damage the company’s credibility with regulators” by allowing the same or similar conduct to reoccur. Finally, with both the 2019 Guidance and FCPA Corporate Enforcement Policy, the DOJ has added its voice to prior SEC statements that regulators “will focus on what steps the company took upon learning of the misconduct, whether the company immediately stopped the misconduct, and what new and more effective internal controls or procedures the company has adopted or plans to adopt to prevent a recurrence.

Three key takeaways:

  1. The key is objectivity and independence.
  2. The critical element is how did you use the information you developed in the root cause analysis?
  3. The key is that after you have identified the causes of problems, consider the solutions that can be implemented by developing a logical approach, using data that already exists in the organization.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 549 no Day 29 | What is a root cause analysis? Well known fraud investigator Jonathan Marks, defined a root cause analysis as “a research based approach to identifying the bottom line reason of a problem or an issue; with the root cause, not the proximate cause the root cause representing the source of the problem.” He contrasted this definition with that of a risk assessment which he said “is something performed on a proactive basis based on various facts. A root cause analysis analyzes a problem that (hopefully) was previously identified through a risk assessment.” He went on to note a, “Root cause analysis is a tool to help identify not only what and how an event occurred, but also why it happened. When we are able to determine why an event or failure occurred, we can then recommend workable corrective measures that deter future events of the type observed.” Marks also contrasted a root cause analysis with an investigation. He noted, “in an investigation we are try to either prove or disprove an allegation.” This means that in a compliance investigation you may be trying to prove or disprove that certain transactions could form the basis of a corrupt payment or bribe by garnering evidence to either support or refute specific allegations. You do not assess blame and that is the point where a root cause should follow to determine how the compliance failure occurred or was allowed to occur Three key takeaways: A root cause analysis is now required if you have a reportable compliance failure. There is no one process for performing a root cause analysis. You should select the one which works for you and follow it. To properly perform a root cause analysis, you need trained professionals who really understand what they’re doing.   Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 30 Jan 2020 00:46:20 -0000 Day 29 | What is a root cause analysis? full 29 Thomas Fox Well known fraud investigator Jonathan Marks, defined a root cause analysis as “a research based approach to identifying the bottom line reason of a problem or an issue; with the root cause, not the proximate cause the root cause representing the source of the problem.” He contrasted this definition with that of a risk assessment which he said “is something performed on a proactive basis based on various facts. A root cause analysis analyzes a problem that (hopefully) was previously identified through a risk assessment.” He went on to note a, “Root cause analysis is a tool to help identify not only what and how an event occurred, but also why it happened. When we are able to determine why an event or failure occurred, we can then recommend workable corrective measures that deter future events of the type observed.” Marks also contrasted a root cause analysis with an investigation. He noted, “in an investigation we are try to either prove or disprove an allegation.” This means that in a compliance investigation you may be trying to prove or disprove that certain transactions could form the basis of a corrupt payment or bribe by garnering evidence to either support or refute specific allegations. You do not assess blame and that is the point where a root cause should follow to determine how the compliance failure occurred or was allowed to occur Three key takeaways: A root cause analysis is now required if you have a reportable compliance failure. There is no one process for performing a root cause analysis. You should select the one which works for you and follow it. To properly perform a root cause analysis, you need trained professionals who really understand what they’re doing.   Learn more about your ad choices. Visit megaphone.fm/adchoices Well known fraud investigator Jonathan Marks, defined a root cause analysis as “a research based approach to identifying the bottom line reason of a problem or an issue; with the root cause, not the proximate cause the root cause representing the source of the problem.” He contrasted this definition with that of a risk assessment which he said “is something performed on a proactive basis based on various facts. A root cause analysis analyzes a problem that (hopefully) was previously identified through a risk assessment.” He went on to note a, “Root cause analysis is a tool to help identify not only what and how an event occurred, but also why it happened. When we are able to determine why an event or failure occurred, we can then recommend workable corrective measures that deter future events of the type observed.”

Marks also contrasted a root cause analysis with an investigation. He noted, “in an investigation we are try to either prove or disprove an allegation.” This means that in a compliance investigation you may be trying to prove or disprove that certain transactions could form the basis of a corrupt payment or bribe by garnering evidence to either support or refute specific allegations. You do not assess blame and that is the point where a root cause should follow to determine how the compliance failure occurred or was allowed to occur

Three key takeaways:

  1. A root cause analysis is now required if you have a reportable compliance failure.
  2. There is no one process for performing a root cause analysis. You should select the one which works for you and follow it.
  3. To properly perform a root cause analysis, you need trained professionals who really understand what they’re doing.

 

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 549 no Day 28 | Post-acquisition integration plan Your company has just made its largest acquisition ever and your CEO says they want you to have a compliance post-acquisition integration plan on their desk in one week. Where do you begin? A good place to start would be the 2012 FCPA Guidance language: Pre-acquisition due diligence, however, is normally only a portion of the compliance process for mergers and acquisitions. DOJ and SEC evaluate whether the acquiring company promptly incorporated the acquired company into all of its internal controls, including its compliance program. Companies should consider training new employees, reevaluating third parties under company standards, and, where appropriate, conducting audits on new business units. As reported by New and Trahanas, in a July 2018 speech, former Deputy Assistant Attorney General Matthew Miner emphasized that DOJ would apply the principles contained in the FCPA Corporate Enforcement Policy to successor companies that discover potential violations subsequent to an acquisition, as well as to acquirers who detect potential corrupt activities during the due diligence process. He also encouraged acquiring companies to seek guidance through the FCPA Opinion Procedures. Miner said the DOJ would apply the principles contained in the FCPA Corporate Enforcement Policy to acquiring companies that uncover potential FCPA violations in the mergers and acquisitions context. This means if you meet the four requirements under the FCPA Corporate Enforcement Policy, the default DOJ position would be a declination would be granted Three key takeaways: Planning is critical in the post-acquisition phase. Build upon what you learned in pre-acquisition due diligence. You literally need to be ready to hit the ground running when a transaction closes. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 30 Jan 2020 00:44:54 -0000 Day 28 | Post-acquisition integration plan full 28 Thomas Fox Your company has just made its largest acquisition ever and your CEO says they want you to have a compliance post-acquisition integration plan on their desk in one week. Where do you begin? A good place to start would be the 2012 FCPA Guidance language: Pre-acquisition due diligence, however, is normally only a portion of the compliance process for mergers and acquisitions. DOJ and SEC evaluate whether the acquiring company promptly incorporated the acquired company into all of its internal controls, including its compliance program. Companies should consider training new employees, reevaluating third parties under company standards, and, where appropriate, conducting audits on new business units. As reported by New and Trahanas, in a July 2018 speech, former Deputy Assistant Attorney General Matthew Miner emphasized that DOJ would apply the principles contained in the FCPA Corporate Enforcement Policy to successor companies that discover potential violations subsequent to an acquisition, as well as to acquirers who detect potential corrupt activities during the due diligence process. He also encouraged acquiring companies to seek guidance through the FCPA Opinion Procedures. Miner said the DOJ would apply the principles contained in the FCPA Corporate Enforcement Policy to acquiring companies that uncover potential FCPA violations in the mergers and acquisitions context. This means if you meet the four requirements under the FCPA Corporate Enforcement Policy, the default DOJ position would be a declination would be granted Three key takeaways: Planning is critical in the post-acquisition phase. Build upon what you learned in pre-acquisition due diligence. You literally need to be ready to hit the ground running when a transaction closes. Learn more about your ad choices. Visit megaphone.fm/adchoices Your company has just made its largest acquisition ever and your CEO says they want you to have a compliance post-acquisition integration plan on their desk in one week. Where do you begin? A good place to start would be the 2012 FCPA Guidance language: Pre-acquisition due diligence, however, is normally only a portion of the compliance process for mergers and acquisitions. DOJ and SEC evaluate whether the acquiring company promptly incorporated the acquired company into all of its internal controls, including its compliance program. Companies should consider training new employees, reevaluating third parties under company standards, and, where appropriate, conducting audits on new business units.

As reported by New and Trahanas, in a July 2018 speech, former Deputy Assistant Attorney General Matthew Miner emphasized that DOJ would apply the principles contained in the FCPA Corporate Enforcement Policy to successor companies that discover potential violations subsequent to an acquisition, as well as to acquirers who detect potential corrupt activities during the due diligence process. He also encouraged acquiring companies to seek guidance through the FCPA Opinion Procedures. Miner said the DOJ would apply the principles contained in the FCPA Corporate Enforcement Policy to acquiring companies that uncover potential FCPA violations in the mergers and acquisitions context. This means if you meet the four requirements under the FCPA Corporate Enforcement Policy, the default DOJ position would be a declination would be granted

Three key takeaways:

  1. Planning is critical in the post-acquisition phase.
  2. Build upon what you learned in pre-acquisition due diligence.
  3. You literally need to be ready to hit the ground running when a transaction closes.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 549 no Day 27 | Pre-acquisition due diligence in mergers and acquisitions A company that does not perform adequate due diligence prior to a merger or acquisition may face both legal and business risks. Perhaps most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. While most compliance practitioners have been long aware of the requirement in the post-acquisition context, the 2012 FCPA Guidance focused many compliance practitioners of the need to engage in robust pre-acquisition due diligence. This was expanded again in the 2017 Evaluation but the 2019 Guidance made even more clear the need for a robust compliance presence in the pre-acquisition phase. It stated, “A well-designed compliance program should include comprehensive due diligence of any acquisition targets. Pre-M&A due diligence enables the acquiring company to evaluate more accurately each target’s value and negotiate for the costs of any corruption or misconduct to be borne by the target. Flawed or incomplete due diligence can allow misconduct to continue at the target company, causing resulting harm to a business’s profitability and reputation and risking civil and criminal liability. Three key takeaways: The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward. Periodically review your M&A due diligence protocol. If red flags appear in pre-acquisition due diligence, they should be cleared. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 30 Jan 2020 00:43:40 -0000 Day 27 | Pre-acquisition due diligence in mergers and acquisitions full 27 Thomas Fox A company that does not perform adequate due diligence prior to a merger or acquisition may face both legal and business risks. Perhaps most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. While most compliance practitioners have been long aware of the requirement in the post-acquisition context, the 2012 FCPA Guidance focused many compliance practitioners of the need to engage in robust pre-acquisition due diligence. This was expanded again in the 2017 Evaluation but the 2019 Guidance made even more clear the need for a robust compliance presence in the pre-acquisition phase. It stated, “A well-designed compliance program should include comprehensive due diligence of any acquisition targets. Pre-M&A due diligence enables the acquiring company to evaluate more accurately each target’s value and negotiate for the costs of any corruption or misconduct to be borne by the target. Flawed or incomplete due diligence can allow misconduct to continue at the target company, causing resulting harm to a business’s profitability and reputation and risking civil and criminal liability. Three key takeaways: The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward. Periodically review your M&A due diligence protocol. If red flags appear in pre-acquisition due diligence, they should be cleared. Learn more about your ad choices. Visit megaphone.fm/adchoices A company that does not perform adequate due diligence prior to a merger or acquisition may face both legal and business risks. Perhaps most commonly, inadequate due diligence can allow a course of bribery to continue - with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. While most compliance practitioners have been long aware of the requirement in the post-acquisition context, the 2012 FCPA Guidance focused many compliance practitioners of the need to engage in robust pre-acquisition due diligence.

This was expanded again in the 2017 Evaluation but the 2019 Guidance made even more clear the need for a robust compliance presence in the pre-acquisition phase. It stated, “A well-designed compliance program should include comprehensive due diligence of any acquisition targets. Pre-M&A due diligence enables the acquiring company to evaluate more accurately each target’s value and negotiate for the costs of any corruption or misconduct to be borne by the target. Flawed or incomplete due diligence can allow misconduct to continue at the target company, causing resulting harm to a business’s profitability and reputation and risking civil and criminal liability.

Three key takeaways:

  1. The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward.
  2. Periodically review your M&A due diligence protocol.
  3. If red flags appear in pre-acquisition due diligence, they should be cleared.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 549 no Day 26 | Operationalizing compliance through payroll One of the areas articulated in the 2019 Guidance was around payments and payroll. For the both the compliance professional and the corporate payroll function, there is a significant role to play in the operationalization of a corporate compliance program. The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) was replete with references to payment and its critical nature to any best practices compliance program. This includes references to payments to foreign officials, payments to third parties and hiding bribes in payments to distributors. The 2019 Guidance begins with an admonition to stop wasting time on low hanging fruit when there are much higher risks in your business operations. It stated: Risk-Tailored Resource Allocation – Does the company devote a disproportionate amount of time to policing low-risk areas instead of high-risk areas, such as questionable payments to third-party consultants, suspicious trading activity, or excessive discounts to resellers and distributors? Does the company give greater scrutiny, as warranted, to high-risk transactions (for instance, a large-dollar contract with a government agency in a high-risk country) than more modest and routine hospitality and entertainment?  The 2019 Guidance then drills down into the payment and payroll system, stating: Appropriate Controls – How does the company ensure there is an appropriate business rationale for the use of third parties? If third parties were involved in the underlying misconduct, what was the business rationale for using those third parties? What mechanisms exist to ensure that the contract terms specifically describe the services to be performed, that the payment terms are appropriate, that the described contractual work is performed, and that compensation is commensurate with the services rendered?   Taken together, these questions may not seem particularly new, innovative, or even something different from what payroll currently does for an organization. However, the 2019 Guidance , clearly demonstrates the role of payroll in compliance. The 2019 Guidance requires that payroll not only form a part of any best practices compliance program, but when it comes to the specific subject matter expertise, payroll is on the front lines of any attempts to prevent, detect, and then remediate anti-corruption compliance violations. Three key takeaways: Payroll can be a key prevent and detect control. The Evaluationspecified the tying of the corporate compliance function to the corporate payroll function. Offshore payments remain a key indicator for a red flag. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 26 Jan 2020 18:00:00 -0000 Day 26 | Operationalizing compliance through payroll full 26 Thomas Fox How can you operationalize your compliance program through payroll? One of the areas articulated in the 2019 Guidance was around payments and payroll. For the both the compliance professional and the corporate payroll function, there is a significant role to play in the operationalization of a corporate compliance program. The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) was replete with references to payment and its critical nature to any best practices compliance program. This includes references to payments to foreign officials, payments to third parties and hiding bribes in payments to distributors. The 2019 Guidance begins with an admonition to stop wasting time on low hanging fruit when there are much higher risks in your business operations. It stated: Risk-Tailored Resource Allocation – Does the company devote a disproportionate amount of time to policing low-risk areas instead of high-risk areas, such as questionable payments to third-party consultants, suspicious trading activity, or excessive discounts to resellers and distributors? Does the company give greater scrutiny, as warranted, to high-risk transactions (for instance, a large-dollar contract with a government agency in a high-risk country) than more modest and routine hospitality and entertainment?  The 2019 Guidance then drills down into the payment and payroll system, stating: Appropriate Controls – How does the company ensure there is an appropriate business rationale for the use of third parties? If third parties were involved in the underlying misconduct, what was the business rationale for using those third parties? What mechanisms exist to ensure that the contract terms specifically describe the services to be performed, that the payment terms are appropriate, that the described contractual work is performed, and that compensation is commensurate with the services rendered?   Taken together, these questions may not seem particularly new, innovative, or even something different from what payroll currently does for an organization. However, the 2019 Guidance , clearly demonstrates the role of payroll in compliance. The 2019 Guidance requires that payroll not only form a part of any best practices compliance program, but when it comes to the specific subject matter expertise, payroll is on the front lines of any attempts to prevent, detect, and then remediate anti-corruption compliance violations. Three key takeaways: Payroll can be a key prevent and detect control. The Evaluationspecified the tying of the corporate compliance function to the corporate payroll function. Offshore payments remain a key indicator for a red flag. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the areas articulated in the 2019 Guidance was around payments and payroll. For the both the compliance professional and the corporate payroll function, there is a significant role to play in the operationalization of a corporate compliance program. The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) was replete with references to payment and its critical nature to any best practices compliance program. This includes references to payments to foreign officials, payments to third parties and hiding bribes in payments to distributors.

The 2019 Guidance begins with an admonition to stop wasting time on low hanging fruit when there are much higher risks in your business operations. It stated: Risk-Tailored Resource Allocation – Does the company devote a disproportionate amount of time to policing low-risk areas instead of high-risk areas, such as questionable payments to third-party consultants, suspicious trading activity, or excessive discounts to resellers and distributors? Does the company give greater scrutiny, as warranted, to high-risk transactions (for instance, a large-dollar contract with a government agency in a high-risk country) than more modest and routine hospitality and entertainment?  The 2019 Guidance then drills down into the payment and payroll system, stating: Appropriate Controls – How does the company ensure there is an appropriate business rationale for the use of third parties? If third parties were involved in the underlying misconduct, what was the business rationale for using those third parties? What mechanisms exist to ensure that the contract terms specifically describe the services to be performed, that the payment terms are appropriate, that the described contractual work is performed, and that compensation is commensurate with the services rendered?  

Taken together, these questions may not seem particularly new, innovative, or even something different from what payroll currently does for an organization. However, the 2019 Guidance , clearly demonstrates the role of payroll in compliance. The 2019 Guidance requires that payroll not only form a part of any best practices compliance program, but when it comes to the specific subject matter expertise, payroll is on the front lines of any attempts to prevent, detect, and then remediate anti-corruption compliance violations.

Three key takeaways:

  1. Payroll can be a key prevent and detect control.
  2. The Evaluationspecified the tying of the corporate compliance function to the corporate payroll function.
  3. Offshore payments remain a key indicator for a red flag.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 549 no Day 25 | Compliance function in an organization The role of the compliance professional and the compliance function in a corporation has steadily grown in stature and prestige over the years. When it came to the corporate compliance function, 2012 FCPA Guidance, under Hallmark Three of the Ten Hallmarks of an Effective Compliance Program, simply noted the government would “consider whether the company devoted adequate staffing and resources to the compliance program given the size, structure, and risk profile of the business.” This Hallmark was significantly expanded in both the 2019 Guidance and the FCPA Corporate Enforcement Policy. And in so doing, the DOJ has increased the prestige, authority and role of both the corporate compliance function. The 2019 Guidance has four general areas of inquiry around the corporate compliance function. (1) What is the seniority and stature of the compliance function within an organization? (2) What are the experience and stature of the compliance personnel with an organization? (3) What is the funding and resources made available to the compliance function? (4) How much autonomy does the compliance function have to report to the Board of Directors? Three key takeaways: How is compliance treated in the budget process? Has your compliance function had any decisions over-ridden by senior management? Beware outsourcing of compliance as any such contractor must have access to company documents and personnel. Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 25 Jan 2020 06:00:00 -0000 Day 25 | Compliance function in an organization full Thomas Fox What is a compliance function in an organization? The role of the compliance professional and the compliance function in a corporation has steadily grown in stature and prestige over the years. When it came to the corporate compliance function, 2012 FCPA Guidance, under Hallmark Three of the Ten Hallmarks of an Effective Compliance Program, simply noted the government would “consider whether the company devoted adequate staffing and resources to the compliance program given the size, structure, and risk profile of the business.” This Hallmark was significantly expanded in both the 2019 Guidance and the FCPA Corporate Enforcement Policy. And in so doing, the DOJ has increased the prestige, authority and role of both the corporate compliance function. The 2019 Guidance has four general areas of inquiry around the corporate compliance function. (1) What is the seniority and stature of the compliance function within an organization? (2) What are the experience and stature of the compliance personnel with an organization? (3) What is the funding and resources made available to the compliance function? (4) How much autonomy does the compliance function have to report to the Board of Directors? Three key takeaways: How is compliance treated in the budget process? Has your compliance function had any decisions over-ridden by senior management? Beware outsourcing of compliance as any such contractor must have access to company documents and personnel. Learn more about your ad choices. Visit megaphone.fm/adchoices The role of the compliance professional and the compliance function in a corporation has steadily grown in stature and prestige over the years. When it came to the corporate compliance function, 2012 FCPA Guidance, under Hallmark Three of the Ten Hallmarks of an Effective Compliance Program, simply noted the government would “consider whether the company devoted adequate staffing and resources to the compliance program given the size, structure, and risk profile of the business.”

This Hallmark was significantly expanded in both the 2019 Guidance and the FCPA Corporate Enforcement Policy. And in so doing, the DOJ has increased the prestige, authority and role of both the corporate compliance function. The 2019 Guidance has four general areas of inquiry around the corporate compliance function. (1) What is the seniority and stature of the compliance function within an organization? (2) What are the experience and stature of the compliance personnel with an organization? (3) What is the funding and resources made available to the compliance function? (4) How much autonomy does the compliance function have to report to the Board of Directors?

Three key takeaways:

  1. How is compliance treated in the budget process?
  2. Has your compliance function had any decisions over-ridden by senior management?
  3. Beware outsourcing of compliance as any such contractor must have access to company documents and personnel.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 549 no Day 24 | CCO authority and independence The role of the CCO has steadily grown in stature and prestige over the years. In the 2012 FCPA Guidance, under Hallmark Three of the Ten Hallmarks of an Effective Compliance Program, it focused on the whether the CCO held senior management status and had a direct reporting line to the Board; stating: In appraising a compliance program, DOJ and SEC also consider whether a company has assigned responsibility for the oversight and implementation of a company’s compliance program to one or more specific senior executives within an organization. Those individuals must have appropriate authority within the organization, adequate autonomy from management, and sufficient resources to ensure that the company’s compliance program is implemented effectively. Adequate autonomy generally includes direct access to an organization’s governing authority, such as the board of directors and committees of the board of directors. This Hallmark was significantly expanded in both the 2019 Guidance and the FCPA Corporate Enforcement Policy. And in so doing, the DOJ has increased the prestige, authority and role of both the CCO and corporate compliance function. The 2019 Guidance has four general areas of inquiry around the CCO and corporate compliance function. (1) How does the CCO salary and stature within the organization compare to other senior executives within the company. (2) What are the experience and stature of the CCO with an organization? Does the CCO have appropriate training for the role? (3) How much autonomy does the CCO have to report to the Board of Directors? How often do the CCO meet with directors? Are members of the senior management present for these meetings with the Board of Directors or of the Audit Committee? (4) Is the compliance function run by a designated chief compliance officer, or another executive within the company, and does that person have other roles within the company? Three key takeaways: How can you show the CCO really has a seat at the senior executive table? What are the professional qualifications of your CCO? Does your CCO have true independence to report directly to the Board of Directors? Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 24 Jan 2020 18:00:00 -0000 Day 24 | CCO authority and independence full Thomas Fox What is CCO authority? The role of the CCO has steadily grown in stature and prestige over the years. In the 2012 FCPA Guidance, under Hallmark Three of the Ten Hallmarks of an Effective Compliance Program, it focused on the whether the CCO held senior management status and had a direct reporting line to the Board; stating: In appraising a compliance program, DOJ and SEC also consider whether a company has assigned responsibility for the oversight and implementation of a company’s compliance program to one or more specific senior executives within an organization. Those individuals must have appropriate authority within the organization, adequate autonomy from management, and sufficient resources to ensure that the company’s compliance program is implemented effectively. Adequate autonomy generally includes direct access to an organization’s governing authority, such as the board of directors and committees of the board of directors. This Hallmark was significantly expanded in both the 2019 Guidance and the FCPA Corporate Enforcement Policy. And in so doing, the DOJ has increased the prestige, authority and role of both the CCO and corporate compliance function. The 2019 Guidance has four general areas of inquiry around the CCO and corporate compliance function. (1) How does the CCO salary and stature within the organization compare to other senior executives within the company. (2) What are the experience and stature of the CCO with an organization? Does the CCO have appropriate training for the role? (3) How much autonomy does the CCO have to report to the Board of Directors? How often do the CCO meet with directors? Are members of the senior management present for these meetings with the Board of Directors or of the Audit Committee? (4) Is the compliance function run by a designated chief compliance officer, or another executive within the company, and does that person have other roles within the company? Three key takeaways: How can you show the CCO really has a seat at the senior executive table? What are the professional qualifications of your CCO? Does your CCO have true independence to report directly to the Board of Directors? Learn more about your ad choices. Visit megaphone.fm/adchoices The role of the CCO has steadily grown in stature and prestige over the years. In the 2012 FCPA Guidance, under Hallmark Three of the Ten Hallmarks of an Effective Compliance Program, it focused on the whether the CCO held senior management status and had a direct reporting line to the Board; stating:

In appraising a compliance program, DOJ and SEC also consider whether a company has assigned responsibility for the oversight and implementation of a company’s compliance program to one or more specific senior executives within an organization. Those individuals must have appropriate authority within the organization, adequate autonomy from management, and sufficient resources to ensure that the company’s compliance program is implemented effectively. Adequate autonomy generally includes direct access to an organization’s governing authority, such as the board of directors and committees of the board of directors.

This Hallmark was significantly expanded in both the 2019 Guidance and the FCPA Corporate Enforcement Policy. And in so doing, the DOJ has increased the prestige, authority and role of both the CCO and corporate compliance function. The 2019 Guidance has four general areas of inquiry around the CCO and corporate compliance function. (1) How does the CCO salary and stature within the organization compare to other senior executives within the company. (2) What are the experience and stature of the CCO with an organization? Does the CCO have appropriate training for the role? (3) How much autonomy does the CCO have to report to the Board of Directors? How often do the CCO meet with directors? Are members of the senior management present for these meetings with the Board of Directors or of the Audit Committee? (4) Is the compliance function run by a designated chief compliance officer, or another executive within the company, and does that person have other roles within the company?

Three key takeaways:

  1. How can you show the CCO really has a seat at the senior executive table?
  2. What are the professional qualifications of your CCO?
  3. Does your CCO have true independence to report directly to the Board of Directors?


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 549 no Day 23 | Updates and feedback One of the critical elements found in the 2019 Guidance is the need to use the information you obtain, whether through risk assessment, root cause analysis, investigation, hotline report or any other manner to remediate the situation which allowed it to arise. It stated: Evolving Updates – How often has the company updated its risk assessments and reviewed its compliance policies, procedures, and practices? Has the company undertaken a gap analysis to determine if particular areas of risk are not sufficiently addressed in its policies, controls, or training? What steps has the company taken to determine whether policies/procedures/practices make sense for particular business segments/subsidiaries? Your company should establish a regular monitoring system to spot issues and address them. Effective monitoring means applying a consistent set of protocols, checks, and controls tailored to your company’s risks to detect and remediate compliance problems on an ongoing basis. To address this, your compliance team should be checking in routinely with local finance departments in your foreign offices to ask if they have noticed recent accounting irregularities. Regional directors should be required to keep tabs on potential improper activity in the countries in which they manage. These ongoing efforts demonstrate that your company is serious about compliance.  Three key takeaways: Innovation can come through a new way to think about and use data going forward. Have a plan in place to use the information garnered in your monitoring incorporated back into your compliance program. Always remember that Document Document Document is critical if the regulators come knocking. Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 23 Jan 2020 18:00:00 -0000 Day 23 | Updates and feedback full Thomas Fox How to update a compliance program? One of the critical elements found in the 2019 Guidance is the need to use the information you obtain, whether through risk assessment, root cause analysis, investigation, hotline report or any other manner to remediate the situation which allowed it to arise. It stated: Evolving Updates – How often has the company updated its risk assessments and reviewed its compliance policies, procedures, and practices? Has the company undertaken a gap analysis to determine if particular areas of risk are not sufficiently addressed in its policies, controls, or training? What steps has the company taken to determine whether policies/procedures/practices make sense for particular business segments/subsidiaries? Your company should establish a regular monitoring system to spot issues and address them. Effective monitoring means applying a consistent set of protocols, checks, and controls tailored to your company’s risks to detect and remediate compliance problems on an ongoing basis. To address this, your compliance team should be checking in routinely with local finance departments in your foreign offices to ask if they have noticed recent accounting irregularities. Regional directors should be required to keep tabs on potential improper activity in the countries in which they manage. These ongoing efforts demonstrate that your company is serious about compliance.  Three key takeaways: Innovation can come through a new way to think about and use data going forward. Have a plan in place to use the information garnered in your monitoring incorporated back into your compliance program. Always remember that Document Document Document is critical if the regulators come knocking. Learn more about your ad choices. Visit megaphone.fm/adchoices One of the critical elements found in the 2019 Guidance is the need to use the information you obtain, whether through risk assessment, root cause analysis, investigation, hotline report or any other manner to remediate the situation which allowed it to arise. It stated:

Evolving Updates – How often has the company updated its risk assessments and reviewed its compliance policies, procedures, and practices? Has the company undertaken a gap analysis to determine if particular areas of risk are not sufficiently addressed in its policies, controls, or training? What steps has the company taken to determine whether policies/procedures/practices make sense for particular business segments/subsidiaries?

Your company should establish a regular monitoring system to spot issues and address them. Effective monitoring means applying a consistent set of protocols, checks, and controls tailored to your company’s risks to detect and remediate compliance problems on an ongoing basis. To address this, your compliance team should be checking in routinely with local finance departments in your foreign offices to ask if they have noticed recent accounting irregularities. Regional directors should be required to keep tabs on potential improper activity in the countries in which they manage. These ongoing efforts demonstrate that your company is serious about compliance.

 Three key takeaways:

  1. Innovation can come through a new way to think about and use data going forward.
  2. Have a plan in place to use the information garnered in your monitoring incorporated back into your compliance program.
  3. Always remember that Document Document Document is critical if the regulators come knocking.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 549 no Day 22 | Assessing compliance internal controls Control Testing – Has the company reviewed and audited its compliance program in the area relating to the misconduct? More generally, what testing of controls, collection and analysis of compliance data, and interviews of employees and third-parties does the company undertake? How are the results reported and action items tracked?    Fortunately, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) 2013 Internal Controls Framework considers assessing compliance internal controls. In “Internal Controls – Integrated Framework, Illustrative Tools for Assessing Effectiveness of a System of Internal Controls”, COSO laid out its views on assessing the effectiveness of internal controls. It noted that an effective system of internal controls provides “reasonable assurance of achievement of the entity’s objectives, relating to operations, reporting and compliance.” Moreover, there are two over-arching requirements that can only be met through such a structured protocol. First, each of the five components are present and functioning. Second, that the five components operate in an integrated fashion with each other. One of the most critical components of the COSO Framework is that it sets internal control standards against those which you can audit to assess the strength of your compliance internal controls. Three key takeaways: An effective system of internal controls provides reasonable assurance of achievement of the company’s objectives, relating to operations, reporting and compliance. There are two over-arching requirements for effective internal controls. First, each of the five components are present and function. Second, are the five components operating together in an integrated approach. For an anti-corruption compliance program, you can use the Ten Hallmarks of an Effective Compliance Program as your guide to test against. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 22 Jan 2020 18:00:00 -0000 Day 22 | Assessing compliance internal controls full Thomas Fox How do you assess internal controls? Control Testing – Has the company reviewed and audited its compliance program in the area relating to the misconduct? More generally, what testing of controls, collection and analysis of compliance data, and interviews of employees and third-parties does the company undertake? How are the results reported and action items tracked?    Fortunately, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) 2013 Internal Controls Framework considers assessing compliance internal controls. In “Internal Controls – Integrated Framework, Illustrative Tools for Assessing Effectiveness of a System of Internal Controls”, COSO laid out its views on assessing the effectiveness of internal controls. It noted that an effective system of internal controls provides “reasonable assurance of achievement of the entity’s objectives, relating to operations, reporting and compliance.” Moreover, there are two over-arching requirements that can only be met through such a structured protocol. First, each of the five components are present and functioning. Second, that the five components operate in an integrated fashion with each other. One of the most critical components of the COSO Framework is that it sets internal control standards against those which you can audit to assess the strength of your compliance internal controls. Three key takeaways: An effective system of internal controls provides reasonable assurance of achievement of the company’s objectives, relating to operations, reporting and compliance. There are two over-arching requirements for effective internal controls. First, each of the five components are present and function. Second, are the five components operating together in an integrated approach. For an anti-corruption compliance program, you can use the Ten Hallmarks of an Effective Compliance Program as your guide to test against. Learn more about your ad choices. Visit megaphone.fm/adchoices Control Testing – Has the company reviewed and audited its compliance program in the area relating to the misconduct? More generally, what testing of controls, collection and analysis of compliance data, and interviews of employees and third-parties does the company undertake? How are the results reported and action items tracked?   

Fortunately, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) 2013 Internal Controls Framework considers assessing compliance internal controls. In “Internal Controls – Integrated Framework, Illustrative Tools for Assessing Effectiveness of a System of Internal Controls”, COSO laid out its views on assessing the effectiveness of internal controls. It noted that an effective system of internal controls provides “reasonable assurance of achievement of the entity’s objectives, relating to operations, reporting and compliance.” Moreover, there are two over-arching requirements that can only be met through such a structured protocol. First, each of the five components are present and functioning. Second, that the five components operate in an integrated fashion with each other. One of the most critical components of the COSO Framework is that it sets internal control standards against those which you can audit to assess the strength of your compliance internal controls.

Three key takeaways:

  1. An effective system of internal controls provides reasonable assurance of achievement of the company’s objectives, relating to operations, reporting and compliance.
  2. There are two over-arching requirements for effective internal controls. First, each of the five components are present and function. Second, are the five components operating together in an integrated approach.
  3. For an anti-corruption compliance program, you can use the Ten Hallmarks of an Effective Compliance Program as your guide to test against.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 553 no Day 21 | Continuous improvement in a compliance program The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) was very clear about the need for continuous improvement in any compliance program. It stated quite succinctly, “One hallmark of an effective compliance program is its capacity to improve and evolve. The actual implementation of controls in practice will necessarily reveal areas of risk and potential adjustment. A company’s business changes over time, as do the environments in which it operates, the nature of its customers, the laws that govern its actions, and the applicable industry standards. Accordingly, prosecutors should consider whether the company has engaged in meaningful efforts to review its compliance program and ensure that it is not stale.” This was further specified in the DOJ’s 2019 Guidance which listed three types of continuous improvement, each further refined with multiple attendant questions. It also added a new area of inquiry that every compliance practitioner needs to incorporate into their assessment, improvement and management cycles; culture.  Three key takeaways: Your compliance program should be continually evolving. Monitoring and auditing are different, yet complimentary tools for continuous improvement. Culture assessment and monitoring are also now required as well. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 21 Jan 2020 18:00:00 -0000 Day 21 | Continuous improvement in a compliance program full Thomas Fox What is continuous improvement? The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) was very clear about the need for continuous improvement in any compliance program. It stated quite succinctly, “One hallmark of an effective compliance program is its capacity to improve and evolve. The actual implementation of controls in practice will necessarily reveal areas of risk and potential adjustment. A company’s business changes over time, as do the environments in which it operates, the nature of its customers, the laws that govern its actions, and the applicable industry standards. Accordingly, prosecutors should consider whether the company has engaged in meaningful efforts to review its compliance program and ensure that it is not stale.” This was further specified in the DOJ’s 2019 Guidance which listed three types of continuous improvement, each further refined with multiple attendant questions. It also added a new area of inquiry that every compliance practitioner needs to incorporate into their assessment, improvement and management cycles; culture.  Three key takeaways: Your compliance program should be continually evolving. Monitoring and auditing are different, yet complimentary tools for continuous improvement. Culture assessment and monitoring are also now required as well. Learn more about your ad choices. Visit megaphone.fm/adchoices The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) was very clear about the need for continuous improvement in any compliance program. It stated quite succinctly, “One hallmark of an effective compliance program is its capacity to improve and evolve. The actual implementation of controls in practice will necessarily reveal areas of risk and potential adjustment. A company’s business changes over time, as do the environments in which it operates, the nature of its customers, the laws that govern its actions, and the applicable industry standards. Accordingly, prosecutors should consider whether the company has engaged in meaningful efforts to review its compliance program and ensure that it is not stale.”

This was further specified in the DOJ’s 2019 Guidance which listed three types of continuous improvement, each further refined with multiple attendant questions. It also added a new area of inquiry that every compliance practitioner needs to incorporate into their assessment, improvement and management cycles; culture.

 Three key takeaways:

  1. Your compliance program should be continually evolving.
  2. Monitoring and auditing are different, yet complimentary tools for continuous improvement.
  3. Culture assessment and monitoring are also now required as well.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 550 no Day 20 | Responding to investigative findings There is nothing like an internal whistleblower report about a compliance violation, the finding of such an issue, or (even worse) a subpoena from the DOJ or notice letter from the SEC to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check. Three key takeaways: A serious FCPA allegation gets the attention of the Board and senior management. Use this time to move the compliance program forward. Be aware of how your investigation can impact and even inform your remediation efforts. Be prepared to deal with the dreaded “where else” question. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 19 Jan 2020 23:28:01 -0000 Day 20 | Responding to investigative findings full 20 Thomas Fox How to respond to investigative findings? There is nothing like an internal whistleblower report about a compliance violation, the finding of such an issue, or (even worse) a subpoena from the DOJ or notice letter from the SEC to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check. Three key takeaways: A serious FCPA allegation gets the attention of the Board and senior management. Use this time to move the compliance program forward. Be aware of how your investigation can impact and even inform your remediation efforts. Be prepared to deal with the dreaded “where else” question. Learn more about your ad choices. Visit megaphone.fm/adchoices There is nothing like an internal whistleblower report about a compliance violation, the finding of such an issue, or (even worse) a subpoena from the DOJ or notice letter from the SEC to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check.

Three key takeaways:

  1. A serious FCPA allegation gets the attention of the Board and senior management. Use this time to move the compliance program forward.
  2. Be aware of how your investigation can impact and even inform your remediation efforts.
  3. Be prepared to deal with the dreaded “where else” question.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 563 no Day 19 | The investigation protocol After the internal report comes in and you have properly triaged the matter, you need to scope out and investigate it, promptly, thoroughly and with competent personnel. Your company should have a detailed written procedure for handling any complaint or allegation of bribery or corruption, regardless of the means through which it is communicated. The mechanism could include the internal company hotline, anonymous tips, or a report directly from the business unit involved. You can make the decision on whether or not to investigate with consultation with other groups such as the Audit Committee of the Board of Directors or the Legal Department. The head of the business unit in which the claim arose may also be notified that an allegation has been made and that the Compliance Department will be handling the matter on a go-forward basis. Through the use of such a detailed written procedure, you can work to ensure there is complete transparency on the rights and obligations of all parties, once an allegation is made. This allows the compliance team to have not only the flexibility but also the responsibility to deal with such matters, from which it can best assess and then decide on how to manage the matter.  Three key takeaways: A written protocol, created before an investigation, is a key starting point. Create specific steps to follow so there will be full transparency and documentation going forward. Consistency in approach is critical. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 19 Jan 2020 23:27:12 -0000 Day 19 | The investigation protocol full 19 Thomas Fox What is your investigation protocol? Find out why you need one and how to create one in 19 of 31 Days to a More Effective Compliance Program After the internal report comes in and you have properly triaged the matter, you need to scope out and investigate it, promptly, thoroughly and with competent personnel. Your company should have a detailed written procedure for handling any complaint or allegation of bribery or corruption, regardless of the means through which it is communicated. The mechanism could include the internal company hotline, anonymous tips, or a report directly from the business unit involved. You can make the decision on whether or not to investigate with consultation with other groups such as the Audit Committee of the Board of Directors or the Legal Department. The head of the business unit in which the claim arose may also be notified that an allegation has been made and that the Compliance Department will be handling the matter on a go-forward basis. Through the use of such a detailed written procedure, you can work to ensure there is complete transparency on the rights and obligations of all parties, once an allegation is made. This allows the compliance team to have not only the flexibility but also the responsibility to deal with such matters, from which it can best assess and then decide on how to manage the matter.  Three key takeaways: A written protocol, created before an investigation, is a key starting point. Create specific steps to follow so there will be full transparency and documentation going forward. Consistency in approach is critical. Learn more about your ad choices. Visit megaphone.fm/adchoices After the internal report comes in and you have properly triaged the matter, you need to scope out and investigate it, promptly, thoroughly and with competent personnel. Your company should have a detailed written procedure for handling any complaint or allegation of bribery or corruption, regardless of the means through which it is communicated. The mechanism could include the internal company hotline, anonymous tips, or a report directly from the business unit involved. You can make the decision on whether or not to investigate with consultation with other groups such as the Audit Committee of the Board of Directors or the Legal Department. The head of the business unit in which the claim arose may also be notified that an allegation has been made and that the Compliance Department will be handling the matter on a go-forward basis. Through the use of such a detailed written procedure, you can work to ensure there is complete transparency on the rights and obligations of all parties, once an allegation is made. This allows the compliance team to have not only the flexibility but also the responsibility to deal with such matters, from which it can best assess and then decide on how to manage the matter.

 Three key takeaways:

  1. A written protocol, created before an investigation, is a key starting point.
  2. Create specific steps to follow so there will be full transparency and documentation going forward.
  3. Consistency in approach is critical.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 549 no Day 18 | Internal reporting and the triaging of claims The call, email or tip comes into your office; an employee reports suspicious activity somewhere across the globe. That activity might well turn into a FCPA issue for your company. As the CCO, it will be up to you to begin the process which will determine, in many instances, how the company will respond going forward. This scenario was driven home by the SEC in a 2015 FCPA enforcement action involving Mead Johnson Nutrition Company. In this enforcement action, the company performed two internal investigations into allegations that its Chinese business unit was engaged in conduct which violated the FCPA. Unfortunately, the first investigation, performed in 2011, did not turn up any evidence of FCPA violations. It was not until 2013, when the SEC made an inquiry to the company that it performed an adequate internal investigation which uncovered FCPA violations. Three key takeaways: The DOJ and SEC put special emphasis on internal reporting lines. Test your hotline on a regular basis to make sure it is working. Have a triage protocol in place before the call comes in so you will be ready to go and not required to scramble to create a protocol. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 19 Jan 2020 23:26:54 -0000 Day 18 | Internal reporting and the triaging of claims full 18 Thomas Fox What is internal reporting and triaging of claims? The call, email or tip comes into your office; an employee reports suspicious activity somewhere across the globe. That activity might well turn into a FCPA issue for your company. As the CCO, it will be up to you to begin the process which will determine, in many instances, how the company will respond going forward. This scenario was driven home by the SEC in a 2015 FCPA enforcement action involving Mead Johnson Nutrition Company. In this enforcement action, the company performed two internal investigations into allegations that its Chinese business unit was engaged in conduct which violated the FCPA. Unfortunately, the first investigation, performed in 2011, did not turn up any evidence of FCPA violations. It was not until 2013, when the SEC made an inquiry to the company that it performed an adequate internal investigation which uncovered FCPA violations. Three key takeaways: The DOJ and SEC put special emphasis on internal reporting lines. Test your hotline on a regular basis to make sure it is working. Have a triage protocol in place before the call comes in so you will be ready to go and not required to scramble to create a protocol. Learn more about your ad choices. Visit megaphone.fm/adchoices The call, email or tip comes into your office; an employee reports suspicious activity somewhere across the globe. That activity might well turn into a FCPA issue for your company. As the CCO, it will be up to you to begin the process which will determine, in many instances, how the company will respond going forward.

This scenario was driven home by the SEC in a 2015 FCPA enforcement action involving Mead Johnson Nutrition Company. In this enforcement action, the company performed two internal investigations into allegations that its Chinese business unit was engaged in conduct which violated the FCPA. Unfortunately, the first investigation, performed in 2011, did not turn up any evidence of FCPA violations. It was not until 2013, when the SEC made an inquiry to the company that it performed an adequate internal investigation which uncovered FCPA violations.

Three key takeaways:

  1. The DOJ and SEC put special emphasis on internal reporting lines.
  2. Test your hotline on a regular basis to make sure it is working.
  3. Have a triage protocol in place before the call comes in so you will be ready to go and not required to scramble to create a protocol.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 549 no Day 17 | Managing your third parties The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the life cycle management of third parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation and compliance terms and conditions in contracts. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also the one where the rubber meets the road of operationalizing compliance. It is also an area the DOJ specifically articulated in the 2019 Evaluation that companies need to consider. The key is to have a strategic approach to how you structure and manage your third-party relationships. This may mean more closely partnering with your third parties to help manage the anti-corruption compliance risk. It would certainly lead towards enabling your company to control risk while optimizing the performance of your third parties. Three key takeaways: Have a strategic approach to third-party risk management. Rank third parties based upon a variety of factors including compliance and business performance, length of relationship, benchmarking metrics and KPIs for ongoing monitoring and auditing. Managing the relationship is where the real work begins. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 19 Jan 2020 23:25:53 -0000 Day 17 | Managing your third parties full Thomas Fox How do you manage 3rd parties? The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the life cycle management of third parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation and compliance terms and conditions in contracts. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also the one where the rubber meets the road of operationalizing compliance. It is also an area the DOJ specifically articulated in the 2019 Evaluation that companies need to consider. The key is to have a strategic approach to how you structure and manage your third-party relationships. This may mean more closely partnering with your third parties to help manage the anti-corruption compliance risk. It would certainly lead towards enabling your company to control risk while optimizing the performance of your third parties. Three key takeaways: Have a strategic approach to third-party risk management. Rank third parties based upon a variety of factors including compliance and business performance, length of relationship, benchmarking metrics and KPIs for ongoing monitoring and auditing. Managing the relationship is where the real work begins. Learn more about your ad choices. Visit megaphone.fm/adchoices The building blocks of any compliance program lay the foundations for a best practices compliance program. For instance, in the life cycle management of third parties, most compliance practitioners understand the need for a business justification, questionnaire, due diligence, evaluation and compliance terms and conditions in contracts. However, as many companies mature in their compliance programs, the issue of third-party management becomes more important. It is also the one where the rubber meets the road of operationalizing compliance. It is also an area the DOJ specifically articulated in the 2019 Evaluation that companies need to consider.

The key is to have a strategic approach to how you structure and manage your third-party relationships. This may mean more closely partnering with your third parties to help manage the anti-corruption compliance risk. It would certainly lead towards enabling your company to control risk while optimizing the performance of your third parties.

Three key takeaways:

  1. Have a strategic approach to third-party risk management.
  2. Rank third parties based upon a variety of factors including compliance and business performance, length of relationship, benchmarking metrics and KPIs for ongoing monitoring and auditing.
  3. Managing the relationship is where the real work begins.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 no Day 16 | The third-party risk management process   As every compliance practitioner is well aware, third parties still present the highest risk under the FCPA. The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) devotes an entire prong to third-party management. It begins with the following: A well-designed compliance program should apply risk-based due diligence to its third-party relationships. Although the degree of appropriate due diligence may vary based on the size and nature of the company or transaction, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.   This clearly specifies that the DOJ expects an integrated approach that is operationalized throughout the company. This means you must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party risk management, which will fulfill the DOJ requirements as laid out in the 2012 FCPA Guidance and in the Ten Hallmarks of an Effective Compliance Program. They five steps in the lifecycle of third-party management are: Business Justification; Questionnaire to Third-party; Due Diligence on Third-party; Compliance Terms and Conditions, including payment terms; and Management and Oversight of Third Parties After Contract Signing. Three key takeaways: Use the full 5-step process for third party management. Make sure you have business development involvement and buy-in. Operationalize all steps going forward by including business unit representatives. Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 19 Jan 2020 23:25:45 -0000 Day 16 | The third-party risk management process full 16 Thomas Fox What is the 3rd party risk management process?   As every compliance practitioner is well aware, third parties still present the highest risk under the FCPA. The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) devotes an entire prong to third-party management. It begins with the following: A well-designed compliance program should apply risk-based due diligence to its third-party relationships. Although the degree of appropriate due diligence may vary based on the size and nature of the company or transaction, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.   This clearly specifies that the DOJ expects an integrated approach that is operationalized throughout the company. This means you must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party risk management, which will fulfill the DOJ requirements as laid out in the 2012 FCPA Guidance and in the Ten Hallmarks of an Effective Compliance Program. They five steps in the lifecycle of third-party management are: Business Justification; Questionnaire to Third-party; Due Diligence on Third-party; Compliance Terms and Conditions, including payment terms; and Management and Oversight of Third Parties After Contract Signing. Three key takeaways: Use the full 5-step process for third party management. Make sure you have business development involvement and buy-in. Operationalize all steps going forward by including business unit representatives. Learn more about your ad choices. Visit megaphone.fm/adchoices  

As every compliance practitioner is well aware, third parties still present the highest risk under the FCPA. The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) devotes an entire prong to third-party management. It begins with the following: A well-designed compliance program should apply risk-based due diligence to its third-party relationships. Although the degree of appropriate due diligence may vary based on the size and nature of the company or transaction, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.  

This clearly specifies that the DOJ expects an integrated approach that is operationalized throughout the company. This means you must have a process for the full life cycle of third-party risk management. There are five steps in the life cycle of third-party risk management, which will fulfill the DOJ requirements as laid out in the 2012 FCPA Guidance and in the Ten Hallmarks of an Effective Compliance Program. They five steps in the lifecycle of third-party management are:

  1. Business Justification;
  2. Questionnaire to Third-party;
  3. Due Diligence on Third-party;
  4. Compliance Terms and Conditions, including payment terms; and
  5. Management and Oversight of Third Parties After Contract Signing.

Three key takeaways:

  1. Use the full 5-step process for third party management.
  2. Make sure you have business development involvement and buy-in.
  3. Operationalize all steps going forward by including business unit representatives.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 no Day 15 | How do you evaluate a risk assessment? After you complete your risk assessment, you must then translate it into a risk profile. If your estimate of where your bribery risk is greatest is wrong, it will be an effort to address it. As Ben Locwin explained in his  BioProcess International article, entitled “Quality Risk Assessment and Management Strategies for Biopharmaceutical Companies”: Once we have assessed risks and determined a process that includes options to resolve and manage those risks whenever appropriate, then we can decide the level of resources with which to prioritize them. There always will be latent risks: those that we understand are there but that we cannot chase forever. But we need to make sure we have classified them correctly. With a good understanding of each of these, we are in a better position to speak about the quality of our businesses. A way to evaluate risks as determined by the company’s risk assessment is through a risk matrix. Once risks are identified, they are then rated according to their significance and likelihood of occurring, and then plotted on a heat map to determine their priority. The most significant risks with the greatest likelihood of occurring are deemed the priority risks, which become the focus of your remedial efforts or for continuous auditing. A variety of solutions and tools can be used to manage these risks going forward, but the key step is to evaluate and rate these risks. All your actions should flow from the risk ranking. Three key takeaways: Even after you complete your risk assessment, you must evaluate those risks for your company. The DOJ and SEC are looking for a well-reasoned approach on how you evaluate your risk. Create a risk matrix and rank your risks; then remediate and monitor as appropriate. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 15 Jan 2020 18:00:00 -0000 Day 15 | How do you evaluate a risk assessment? full 15 Thomas Fox How do you evaluate a risk assessment in a best practices compliance program? After you complete your risk assessment, you must then translate it into a risk profile. If your estimate of where your bribery risk is greatest is wrong, it will be an effort to address it. As Ben Locwin explained in his  BioProcess International article, entitled “Quality Risk Assessment and Management Strategies for Biopharmaceutical Companies”: Once we have assessed risks and determined a process that includes options to resolve and manage those risks whenever appropriate, then we can decide the level of resources with which to prioritize them. There always will be latent risks: those that we understand are there but that we cannot chase forever. But we need to make sure we have classified them correctly. With a good understanding of each of these, we are in a better position to speak about the quality of our businesses. A way to evaluate risks as determined by the company’s risk assessment is through a risk matrix. Once risks are identified, they are then rated according to their significance and likelihood of occurring, and then plotted on a heat map to determine their priority. The most significant risks with the greatest likelihood of occurring are deemed the priority risks, which become the focus of your remedial efforts or for continuous auditing. A variety of solutions and tools can be used to manage these risks going forward, but the key step is to evaluate and rate these risks. All your actions should flow from the risk ranking. Three key takeaways: Even after you complete your risk assessment, you must evaluate those risks for your company. The DOJ and SEC are looking for a well-reasoned approach on how you evaluate your risk. Create a risk matrix and rank your risks; then remediate and monitor as appropriate. Learn more about your ad choices. Visit megaphone.fm/adchoices After you complete your risk assessment, you must then translate it into a risk profile. If your estimate of where your bribery risk is greatest is wrong, it will be an effort to address it. As Ben Locwin explained in his  BioProcess International article, entitled “Quality Risk Assessment and Management Strategies for Biopharmaceutical Companies”:

Once we have assessed risks and determined a process that includes options to resolve and manage those risks whenever appropriate, then we can decide the level of resources with which to prioritize them. There always will be latent risks: those that we understand are there but that we cannot chase forever. But we need to make sure we have classified them correctly. With a good understanding of each of these, we are in a better position to speak about the quality of our businesses.

A way to evaluate risks as determined by the company’s risk assessment is through a risk matrix. Once risks are identified, they are then rated according to their significance and likelihood of occurring, and then plotted on a heat map to determine their priority. The most significant risks with the greatest likelihood of occurring are deemed the priority risks, which become the focus of your remedial efforts or for continuous auditing. A variety of solutions and tools can be used to manage these risks going forward, but the key step is to evaluate and rate these risks. All your actions should flow from the risk ranking.

Three key takeaways:

  1. Even after you complete your risk assessment, you must evaluate those risks for your company.
  2. The DOJ and SEC are looking for a well-reasoned approach on how you evaluate your risk.
  3. Create a risk matrix and rank your risks; then remediate and monitor as appropriate.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 no Day 14 | Risk Assessments One cannot really say enough about risk assessments in the context of anti-corruption programs. This is because every corporate compliance program should be based upon a risk assessment, to understand your organization’s business from the commercial perspective, how your organization has identified, assessed, and defined its risk profile and, finally, the degree to which the program devotes appropriate scrutiny and resources to this range of risks. As far back as 1999, in the Metcalf & Eddy enforcement action, the DOJ has said that risk assessments that measure the likelihood and severity of possible FCPA violations should direct your resources to manage these risks. The 2012 FCPA Guidance stated it succinctly when it said, “Assessment of risk is fundamental to developing a strong compliance program and is another factor DOJ and SEC evaluate when assessing a company’s compliance program.” This language was supplemented in the 2017 FCPA Corporate Enforcement Policy, which stated, “The effectiveness of the company’s risk assessment and the manner in which the company’s compliance program has been tailored based on that risk assessment.” A risk assessment determines the areas at greatest risk for FCPA violations among all types of international business transactions and operations, the business culture of each country in which these activities occur, and the integrity and reputation of third parties engaged on behalf of the company. The reason is straightforward; one cannot define, plan for, or design an effective compliance program to prevent bribery and corruption unless you can measure the risks you face.  Three key takeaways: Since at least 1999, the DOJ has pointed to the risk assessment as the start of an effective compliance program. The DOJ will now consider both your risk assessment methodology for identifying risks and gathered evidence. You should base your compliance program on your risk assessment. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 14 Jan 2020 18:00:00 -0000 Day 14 | Risk Assessments full Thomas Fox The role of risk assessments in a best practices compliance program. One cannot really say enough about risk assessments in the context of anti-corruption programs. This is because every corporate compliance program should be based upon a risk assessment, to understand your organization’s business from the commercial perspective, how your organization has identified, assessed, and defined its risk profile and, finally, the degree to which the program devotes appropriate scrutiny and resources to this range of risks. As far back as 1999, in the Metcalf & Eddy enforcement action, the DOJ has said that risk assessments that measure the likelihood and severity of possible FCPA violations should direct your resources to manage these risks. The 2012 FCPA Guidance stated it succinctly when it said, “Assessment of risk is fundamental to developing a strong compliance program and is another factor DOJ and SEC evaluate when assessing a company’s compliance program.” This language was supplemented in the 2017 FCPA Corporate Enforcement Policy, which stated, “The effectiveness of the company’s risk assessment and the manner in which the company’s compliance program has been tailored based on that risk assessment.” A risk assessment determines the areas at greatest risk for FCPA violations among all types of international business transactions and operations, the business culture of each country in which these activities occur, and the integrity and reputation of third parties engaged on behalf of the company. The reason is straightforward; one cannot define, plan for, or design an effective compliance program to prevent bribery and corruption unless you can measure the risks you face.  Three key takeaways: Since at least 1999, the DOJ has pointed to the risk assessment as the start of an effective compliance program. The DOJ will now consider both your risk assessment methodology for identifying risks and gathered evidence. You should base your compliance program on your risk assessment. Learn more about your ad choices. Visit megaphone.fm/adchoices One cannot really say enough about risk assessments in the context of anti-corruption programs. This is because every corporate compliance program should be based upon a risk assessment, to understand your organization’s business from the commercial perspective, how your organization has identified, assessed, and defined its risk profile and, finally, the degree to which the program devotes appropriate scrutiny and resources to this range of risks.

As far back as 1999, in the Metcalf & Eddy enforcement action, the DOJ has said that risk assessments that measure the likelihood and severity of possible FCPA violations should direct your resources to manage these risks. The 2012 FCPA Guidance stated it succinctly when it said, “Assessment of risk is fundamental to developing a strong compliance program and is another factor DOJ and SEC evaluate when assessing a company’s compliance program.”

This language was supplemented in the 2017 FCPA Corporate Enforcement Policy, which stated, “The effectiveness of the company’s risk assessment and the manner in which the company’s compliance program has been tailored based on that risk assessment.”

A risk assessment determines the areas at greatest risk for FCPA violations among all types of international business transactions and operations, the business culture of each country in which these activities occur, and the integrity and reputation of third parties engaged on behalf of the company. The reason is straightforward; one cannot define, plan for, or design an effective compliance program to prevent bribery and corruption unless you can measure the risks you face.

 Three key takeaways:

  1. Since at least 1999, the DOJ has pointed to the risk assessment as the start of an effective compliance program.
  2. The DOJ will now consider both your risk assessment methodology for identifying risks and gathered evidence.
  3. You should base your compliance program on your risk assessment.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 no Day 13 |Institutional Justice and The Fair Process Doctrine Companies have finally come to realize that institutional justice and fairness are perhaps the most basic tenet of any successful workplace. If employees believe they will be treated fairly, it will engender a level of trust that can work to not simply motivate employees but lead to a more successful workplace and, at the end of the day, a more profitable company. This encompasses the entire lifecycle of the employment relationship, from hiring through separation. It works in areas as seeming disparate as compensation and incentives, discipline, promotion and internal reporting. Three key takeaways: The DOJ and SEC have long called for appropriate and consistent application of both incentives and discipline. The Fair Process Doctrinewill help set institutional justice as the norm in your organization. Inconsistent application of discipline will destroy your compliance program credibility. Learn more about your ad choices. Visit megaphone.fm/adchoices Mon, 13 Jan 2020 18:00:00 -0000 Day 13 |Institutional Justice and The Fair Process Doctrine full 13 Thomas Fox What is the role of institutional justice in a best practices compliance program? Companies have finally come to realize that institutional justice and fairness are perhaps the most basic tenet of any successful workplace. If employees believe they will be treated fairly, it will engender a level of trust that can work to not simply motivate employees but lead to a more successful workplace and, at the end of the day, a more profitable company. This encompasses the entire lifecycle of the employment relationship, from hiring through separation. It works in areas as seeming disparate as compensation and incentives, discipline, promotion and internal reporting. Three key takeaways: The DOJ and SEC have long called for appropriate and consistent application of both incentives and discipline. The Fair Process Doctrinewill help set institutional justice as the norm in your organization. Inconsistent application of discipline will destroy your compliance program credibility. Learn more about your ad choices. Visit megaphone.fm/adchoices Companies have finally come to realize that institutional justice and fairness are perhaps the most basic tenet of any successful workplace. If employees believe they will be treated fairly, it will engender a level of trust that can work to not simply motivate employees but lead to a more successful workplace and, at the end of the day, a more profitable company. This encompasses the entire lifecycle of the employment relationship, from hiring through separation. It works in areas as seeming disparate as compensation and incentives, discipline, promotion and internal reporting.

Three key takeaways:

  1. The DOJ and SEC have long called for appropriate and consistent application of both incentives and discipline.
  2. The Fair Process Doctrinewill help set institutional justice as the norm in your organization.
  3. Inconsistent application of discipline will destroy your compliance program credibility.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 574 Day 12 | Financial Incentives for Compliance One of the areas that many companies have not paid as much attention to in their compliance programs is compensation. However, the DOJ and SEC have long made clear that they view monetary structure for compensation, rewarding those employees who do business in compliance with their employer’s compliance program, as one of the ways to reinforce the compliance program and the message of compliance. As far back as 2004, then SEC Director of Enforcement Stephen M. Cutler noted that integrity, ethics and compliance needed to be part of promotion, compensation and evaluation processes: “At the end of the day, the most effective way to communicate that “doing the right thing” is a priority, is to reward it.” The 2012 FCPA Guidance stated the “DOJ and SEC recognize that positive incentives can also drive compliant behavior. These incentives can take many forms such as personnel evaluations and promotions, rewards for improving and developing a company’s compliance program, and rewards for ethics and compliance leadership.” This same concept around compensation and incentives was brought forward in the 2019 Guidance - Incentives and Disciplinary Measures, which read: Incentive System – Has the company considered the implications of its incentives and rewards on compliance? How does the company incentivize compliance and ethical behavior? Have there been specific examples of actions taken (e.g., promotions or awards denied) as a result of compliance and ethics considerations? Who determines the compensation, including bonuses, as well as discipline and promotion of compliance personnel? The first question posed in the 2019 Guidance requires you to start with the basic question of what does your employee compensation consist of? Is it a straight salary? Is it variable? If so, what does the variable component consist of? Is it a discretionary bonus based upon the overall success of the entire business enterprise or some small subset such as a business unit or geographic region? Is it solely personal? Or is it some combination of all of the above? Three key takeaways: The DOJ and SEC have long advocated compensation as a way to motivate employees into ethical and compliant behaviors Keep the compliance aspects of your compensation structure simple and easy for your employees to understand Have full transparency in the framework of your compensation structure Learn more about your ad choices. Visit megaphone.fm/adchoices Sun, 12 Jan 2020 18:00:00 -0000 Day 12 | Financial Incentives for Compliance full 12 Thomas Fox What is the role of financial incentives in a best practices compliance program? One of the areas that many companies have not paid as much attention to in their compliance programs is compensation. However, the DOJ and SEC have long made clear that they view monetary structure for compensation, rewarding those employees who do business in compliance with their employer’s compliance program, as one of the ways to reinforce the compliance program and the message of compliance. As far back as 2004, then SEC Director of Enforcement Stephen M. Cutler noted that integrity, ethics and compliance needed to be part of promotion, compensation and evaluation processes: “At the end of the day, the most effective way to communicate that “doing the right thing” is a priority, is to reward it.” The 2012 FCPA Guidance stated the “DOJ and SEC recognize that positive incentives can also drive compliant behavior. These incentives can take many forms such as personnel evaluations and promotions, rewards for improving and developing a company’s compliance program, and rewards for ethics and compliance leadership.” This same concept around compensation and incentives was brought forward in the 2019 Guidance - Incentives and Disciplinary Measures, which read: Incentive System – Has the company considered the implications of its incentives and rewards on compliance? How does the company incentivize compliance and ethical behavior? Have there been specific examples of actions taken (e.g., promotions or awards denied) as a result of compliance and ethics considerations? Who determines the compensation, including bonuses, as well as discipline and promotion of compliance personnel? The first question posed in the 2019 Guidance requires you to start with the basic question of what does your employee compensation consist of? Is it a straight salary? Is it variable? If so, what does the variable component consist of? Is it a discretionary bonus based upon the overall success of the entire business enterprise or some small subset such as a business unit or geographic region? Is it solely personal? Or is it some combination of all of the above? Three key takeaways: The DOJ and SEC have long advocated compensation as a way to motivate employees into ethical and compliant behaviors Keep the compliance aspects of your compensation structure simple and easy for your employees to understand Have full transparency in the framework of your compensation structure Learn more about your ad choices. Visit megaphone.fm/adchoices One of the areas that many companies have not paid as much attention to in their compliance programs is compensation. However, the DOJ and SEC have long made clear that they view monetary structure for compensation, rewarding those employees who do business in compliance with their employer’s compliance program, as one of the ways to reinforce the compliance program and the message of compliance. As far back as 2004, then SEC Director of Enforcement Stephen M. Cutler noted that integrity, ethics and compliance needed to be part of promotion, compensation and evaluation processes: “At the end of the day, the most effective way to communicate that “doing the right thing” is a priority, is to reward it.”

The 2012 FCPA Guidance stated the “DOJ and SEC recognize that positive incentives can also drive compliant behavior. These incentives can take many forms such as personnel evaluations and promotions, rewards for improving and developing a company’s compliance program, and rewards for ethics and compliance leadership.”

This same concept around compensation and incentives was brought forward in the 2019 Guidance - Incentives and Disciplinary Measures, which read:

Incentive System – Has the company considered the implications of its incentives and rewards on compliance? How does the company incentivize compliance and ethical behavior? Have there been specific examples of actions taken (e.g., promotions or awards denied) as a result of compliance and ethics considerations? Who determines the compensation, including bonuses, as well as discipline and promotion of compliance personnel?

The first question posed in the 2019 Guidance requires you to start with the basic question of what does your employee compensation consist of? Is it a straight salary? Is it variable? If so, what does the variable component consist of? Is it a discretionary bonus based upon the overall success of the entire business enterprise or some small subset such as a business unit or geographic region? Is it solely personal? Or is it some combination of all of the above?

Three key takeaways:

  1. The DOJ and SEC have long advocated compensation as a way to motivate employees into ethical and compliant behaviors
  2. Keep the compliance aspects of your compensation structure simple and easy for your employees to understand
  3. Have full transparency in the framework of your compensation structure


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 575 no Day 11 | What is Effective Compliance Training? One of the key goals of any compliance program is to train employees in awareness and understanding of the FCPA; your specific company compliance program; and to create and foster a culture of compliance. While it seems axiomatic that compliance training is a mainstay of any best practices compliance program, the conversation around training has evolved over the years. The 2012 FCPA Guidance started the conversation. Beginning in the fall of 2016, through the announcement of the FCPA Enforcement Pilot Program, the DOJ began to talk about whether you have determined the effectiveness of your training. This conversation continued with the 2017 Evaluation where it asked, “How has the company measured the effectiveness of the training?” This point has bedeviled many compliance professionals yet is now a key metric for the government in evaluating compliance training. It evolved further in the 2019 Guidance with the mandate that training must be “truly effective”. Finally, the training must be presented in a language in which the employees understand, which means in a local language, if the training is outside the US or other non-English-speaking countries. Also raised in the 2017 Evaluation was the focus of your training programs, where the DOJ inquired into whether your training was “tailored” for the audience. This added two requirements. The first was to assess your employees for risk to determine the type of training you might need to deliver by risk ranking your employees. Obviously, the sales force would be the highest risk but there may be others who are deserving of high-risk training as well. From this risk ranking, you were required to develop tailored training for the risks those employees will face. The 2019 Guidance spells this out in greater detail. Not only in the design but who receives it, all coupled with backend determination of effectiveness. Finally, all of this must be documented. Three key takeaways: How and why have you tailored your compliance training? The DOJ has mandated demonstrating the effectiveness of compliance training How is your training presented: both in languages and media? Learn more about your ad choices. Visit megaphone.fm/adchoices Sat, 11 Jan 2020 18:56:19 -0000 Day 11 | What is Effective Compliance Training? full 11 Thomas Fox What is effective compliance training? One of the key goals of any compliance program is to train employees in awareness and understanding of the FCPA; your specific company compliance program; and to create and foster a culture of compliance. While it seems axiomatic that compliance training is a mainstay of any best practices compliance program, the conversation around training has evolved over the years. The 2012 FCPA Guidance started the conversation. Beginning in the fall of 2016, through the announcement of the FCPA Enforcement Pilot Program, the DOJ began to talk about whether you have determined the effectiveness of your training. This conversation continued with the 2017 Evaluation where it asked, “How has the company measured the effectiveness of the training?” This point has bedeviled many compliance professionals yet is now a key metric for the government in evaluating compliance training. It evolved further in the 2019 Guidance with the mandate that training must be “truly effective”. Finally, the training must be presented in a language in which the employees understand, which means in a local language, if the training is outside the US or other non-English-speaking countries. Also raised in the 2017 Evaluation was the focus of your training programs, where the DOJ inquired into whether your training was “tailored” for the audience. This added two requirements. The first was to assess your employees for risk to determine the type of training you might need to deliver by risk ranking your employees. Obviously, the sales force would be the highest risk but there may be others who are deserving of high-risk training as well. From this risk ranking, you were required to develop tailored training for the risks those employees will face. The 2019 Guidance spells this out in greater detail. Not only in the design but who receives it, all coupled with backend determination of effectiveness. Finally, all of this must be documented. Three key takeaways: How and why have you tailored your compliance training? The DOJ has mandated demonstrating the effectiveness of compliance training How is your training presented: both in languages and media? Learn more about your ad choices. Visit megaphone.fm/adchoices One of the key goals of any compliance program is to train employees in awareness and understanding of the FCPA; your specific company compliance program; and to create and foster a culture of compliance. While it seems axiomatic that compliance training is a mainstay of any best practices compliance program, the conversation around training has evolved over the years. The 2012 FCPA Guidance started the conversation.

Beginning in the fall of 2016, through the announcement of the FCPA Enforcement Pilot Program, the DOJ began to talk about whether you have determined the effectiveness of your training. This conversation continued with the 2017 Evaluation where it asked, “How has the company measured the effectiveness of the training?” This point has bedeviled many compliance professionals yet is now a key metric for the government in evaluating compliance training. It evolved further in the 2019 Guidance with the mandate that training must be “truly effective”. Finally, the training must be presented in a language in which the employees understand, which means in a local language, if the training is outside the US or other non-English-speaking countries.

Also raised in the 2017 Evaluation was the focus of your training programs, where the DOJ inquired into whether your training was “tailored” for the audience. This added two requirements. The first was to assess your employees for risk to determine the type of training you might need to deliver by risk ranking your employees. Obviously, the sales force would be the highest risk but there may be others who are deserving of high-risk training as well. From this risk ranking, you were required to develop tailored training for the risks those employees will face.

The 2019 Guidance spells this out in greater detail. Not only in the design but who receives it, all coupled with backend determination of effectiveness. Finally, all of this must be documented.

Three key takeaways:

  1. How and why have you tailored your compliance training?
  2. The DOJ has mandated demonstrating the effectiveness of compliance training
  3. How is your training presented: both in languages and media?

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 575 no Day 10 | The use of social media in compliance What is the message of compliance inside of a corporation and how it is distributed? In a compliance program, the largest portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communications are free or available at very low cost. Why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward? Why should you do so? Start with the tech-savvy nature of the today’s workforce. It is not simply about having a younger workforce but a workforce whose primary tool for communication is social media. If your company is in the services business, it probably means your employee base is using technological tools to deliver business solutions. Finally, consider the data-driven nature of business today so using technological tools to deliver products and solutions is something your company most probably does now. Finally, never forget the social part of social media. Social media is a more holistic, multiple-sided communication. Not only are you setting out expectations but also these tools allow you to receive back communications from your employees. You can also see that if you have several concerns expressed it could alert you earlier to begin some detection and move towards prevention in your compliance program. Three key takeaways: Incorporation of social media into your compliance communications can pay big dividends. Focus on the ‘social’ part of social media. Use internal corporate social media to facilitate a 360-degree conversation. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 10 Jan 2020 18:00:00 -0000 Day 10 | The use of social media in compliance full 10 Thomas Fox What is the role of social media in a compliance program? What is the message of compliance inside of a corporation and how it is distributed? In a compliance program, the largest portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communications are free or available at very low cost. Why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward? Why should you do so? Start with the tech-savvy nature of the today’s workforce. It is not simply about having a younger workforce but a workforce whose primary tool for communication is social media. If your company is in the services business, it probably means your employee base is using technological tools to deliver business solutions. Finally, consider the data-driven nature of business today so using technological tools to deliver products and solutions is something your company most probably does now. Finally, never forget the social part of social media. Social media is a more holistic, multiple-sided communication. Not only are you setting out expectations but also these tools allow you to receive back communications from your employees. You can also see that if you have several concerns expressed it could alert you earlier to begin some detection and move towards prevention in your compliance program. Three key takeaways: Incorporation of social media into your compliance communications can pay big dividends. Focus on the ‘social’ part of social media. Use internal corporate social media to facilitate a 360-degree conversation. Learn more about your ad choices. Visit megaphone.fm/adchoices What is the message of compliance inside of a corporation and how it is distributed? In a compliance program, the largest portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communications are free or available at very low cost. Why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward?

Why should you do so? Start with the tech-savvy nature of the today’s workforce. It is not simply about having a younger workforce but a workforce whose primary tool for communication is social media. If your company is in the services business, it probably means your employee base is using technological tools to deliver business solutions. Finally, consider the data-driven nature of business today so using technological tools to deliver products and solutions is something your company most probably does now.

Finally, never forget the social part of social media. Social media is a more holistic, multiple-sided communication. Not only are you setting out expectations but also these tools allow you to receive back communications from your employees. You can also see that if you have several concerns expressed it could alert you earlier to begin some detection and move towards prevention in your compliance program.

Three key takeaways:

  1. Incorporation of social media into your compliance communications can pay big dividends.
  2. Focus on the ‘social’ part of social media.
  3. Use internal corporate social media to facilitate a 360-degree conversation.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 577 no Day 9 | 360 degrees of compliance communications A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is in touch with and visible to your employees at all times. It is about creating a distinctive brand philosophy of compliance which is centered on your consumers. In other words, it helps a compliance practitioner to anticipate all the aspects of your employees needs around compliance. This is especially true when compliance is either perceived as something that comes out of the home office or is perceived as the “Land of No.” A 360-degree view of compliance gives you the opportunity to build a new brand image for your compliance program. This is important as the Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) mandates that for a compliance program to be effective, it must be understood by a wide variety of stakeholders. Communications is often thought of as a two-way street - upward and downward, inbound and outbound, or side-to-side. However, it is better to think of it as a 360-degree effort. You simply can no longer effectively communicate in just two ways. You now communicate in a more holistic manner, and in multiple ways. If you are just thinking about communications in the classic form, you are missing something that is happening around you. 360-degrees of compliance communication is not just a classic form of communication but rather it is a communication in the concept of every interaction, whether they be planned or accidental interactions. It is all a form of communication. This is particularly true if you are a compliance professional, practitioner or Chief Compliance Officer. The things you do, the way you act, and the way people see you, you are always communicating. It is not simply communicating one to one as often you may be communicating to a group across siloed boundaries, to the constituencies you had not even planned to communicate with initially. Three key takeaways: Remember the definition of 360-degrees of communication. It is an effort that moves the compliance identity into a holistic approach so compliance is in touch and visible to your employees at all times. What is your objective? What are you trying to do with your 360-degrees of communications and how are you using that mechanism to deliver the objectives of your compliance program? Evaluate. You need to evaluate three factors: 1) has the message been delivered; 2) has it been heard; and 3) is it being implemented? Learn more about your ad choices. Visit megaphone.fm/adchoices Thu, 09 Jan 2020 18:00:00 -0000 Day 9 | 360 degrees of compliance communications full 9 Thomas Fox What are 360 degrees of communication on compliance? A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is in touch with and visible to your employees at all times. It is about creating a distinctive brand philosophy of compliance which is centered on your consumers. In other words, it helps a compliance practitioner to anticipate all the aspects of your employees needs around compliance. This is especially true when compliance is either perceived as something that comes out of the home office or is perceived as the “Land of No.” A 360-degree view of compliance gives you the opportunity to build a new brand image for your compliance program. This is important as the Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) mandates that for a compliance program to be effective, it must be understood by a wide variety of stakeholders. Communications is often thought of as a two-way street - upward and downward, inbound and outbound, or side-to-side. However, it is better to think of it as a 360-degree effort. You simply can no longer effectively communicate in just two ways. You now communicate in a more holistic manner, and in multiple ways. If you are just thinking about communications in the classic form, you are missing something that is happening around you. 360-degrees of compliance communication is not just a classic form of communication but rather it is a communication in the concept of every interaction, whether they be planned or accidental interactions. It is all a form of communication. This is particularly true if you are a compliance professional, practitioner or Chief Compliance Officer. The things you do, the way you act, and the way people see you, you are always communicating. It is not simply communicating one to one as often you may be communicating to a group across siloed boundaries, to the constituencies you had not even planned to communicate with initially. Three key takeaways: Remember the definition of 360-degrees of communication. It is an effort that moves the compliance identity into a holistic approach so compliance is in touch and visible to your employees at all times. What is your objective? What are you trying to do with your 360-degrees of communications and how are you using that mechanism to deliver the objectives of your compliance program? Evaluate. You need to evaluate three factors: 1) has the message been delivered; 2) has it been heard; and 3) is it being implemented? Learn more about your ad choices. Visit megaphone.fm/adchoices A 360-degree view of compliance is an effort to incorporate your compliance identity into a holistic approach so that compliance is in touch with and visible to your employees at all times. It is about creating a distinctive brand philosophy of compliance which is centered on your consumers. In other words, it helps a compliance practitioner to anticipate all the aspects of your employees needs around compliance. This is especially true when compliance is either perceived as something that comes out of the home office or is perceived as the “Land of No.” A 360-degree view of compliance gives you the opportunity to build a new brand image for your compliance program. This is important as the Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) mandates that for a compliance program to be effective, it must be understood by a wide variety of stakeholders.

Communications is often thought of as a two-way street - upward and downward, inbound and outbound, or side-to-side. However, it is better to think of it as a 360-degree effort. You simply can no longer effectively communicate in just two ways. You now communicate in a more holistic manner, and in multiple ways. If you are just thinking about communications in the classic form, you are missing something that is happening around you.

360-degrees of compliance communication is not just a classic form of communication but rather it is a communication in the concept of every interaction, whether they be planned or accidental interactions. It is all a form of communication. This is particularly true if you are a compliance professional, practitioner or Chief Compliance Officer. The things you do, the way you act, and the way people see you, you are always communicating. It is not simply communicating one to one as often you may be communicating to a group across siloed boundaries, to the constituencies you had not even planned to communicate with initially.

Three key takeaways:

  1. Remember the definition of 360-degrees of communication. It is an effort that moves the compliance identity into a holistic approach so compliance is in touch and visible to your employees at all times.
  2. What is your objective? What are you trying to do with your 360-degrees of communications and how are you using that mechanism to deliver the objectives of your compliance program?
  3. Evaluate. You need to evaluate three factors: 1) has the message been delivered; 2) has it been heard; and 3) is it being implemented?


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 559 no Day 8 | Internal controls and compliance What specifically are internal controls in a compliance program? The starting point is the FCPA itself, which requires issuers to devise and maintain a system of internal controls that can reasonably assure: Transactions are executed in accordance with management’s general or specific authorization; Transactions are recorded as necessary (I) to permit preparation of financial statements in conformity with generally accepted accounting principles or any other criteria applicable to such statements, and (II) to maintain accountability for assets; Access to assets is permitted only in accordance with management’s general or specific authorization; and The recorded accountability for assets is compared with the existing assets at reasonable intervals and appropriate action is taken with respect to any differences. The DOJ and SEC, in the 2012 FCPA Guidance, stated: Internal controls over financial reporting are the processes used by compa­nies to provide reasonable assurances regarding the reliabil­ity of financial reporting and the preparation of financial statements. They include various components, such as: a control environment that covers the tone set by the organi­zation regarding integrity and ethics; risk assessments; con­trol activities that cover policies and procedures designed to ensure that management directives are carried out (e.g., approvals, authorizations, reconciliations, and segregation of duties); information and communication; and monitoring. … The design of a company’s internal controls must take into account the operational realities and risks attendant to the company’s business, such as: the nature of its products or services; how the products or services get to market; the nature of its work force; the degree of regulation; the extent of its government interaction; and the degree to which it has operations in countries with a high risk of corruption. Three key takeaways: Effective internal controls are required under the FCPA. Internal controls are a critical part of any best practices compliance program. There are four significant controls for the compliance practitioner to implement initially. (a) Delegation of authority (DOA); (b) Maintenance of the vendor master file; (c) Contracts with third parties; and (d) Movement of cash/currency. Learn more about your ad choices. Visit megaphone.fm/adchoices Wed, 08 Jan 2020 18:00:00 -0000 Day 8 | Internal controls and compliance full Thomas Fox What is the role of internal controls in compliance? What specifically are internal controls in a compliance program? The starting point is the FCPA itself, which requires issuers to devise and maintain a system of internal controls that can reasonably assure: Transactions are executed in accordance with management’s general or specific authorization; Transactions are recorded as necessary (I) to permit preparation of financial statements in conformity with generally accepted accounting principles or any other criteria applicable to such statements, and (II) to maintain accountability for assets; Access to assets is permitted only in accordance with management’s general or specific authorization; and The recorded accountability for assets is compared with the existing assets at reasonable intervals and appropriate action is taken with respect to any differences. The DOJ and SEC, in the 2012 FCPA Guidance, stated: Internal controls over financial reporting are the processes used by compa­nies to provide reasonable assurances regarding the reliabil­ity of financial reporting and the preparation of financial statements. They include various components, such as: a control environment that covers the tone set by the organi­zation regarding integrity and ethics; risk assessments; con­trol activities that cover policies and procedures designed to ensure that management directives are carried out (e.g., approvals, authorizations, reconciliations, and segregation of duties); information and communication; and monitoring. … The design of a company’s internal controls must take into account the operational realities and risks attendant to the company’s business, such as: the nature of its products or services; how the products or services get to market; the nature of its work force; the degree of regulation; the extent of its government interaction; and the degree to which it has operations in countries with a high risk of corruption. Three key takeaways: Effective internal controls are required under the FCPA. Internal controls are a critical part of any best practices compliance program. There are four significant controls for the compliance practitioner to implement initially. (a) Delegation of authority (DOA); (b) Maintenance of the vendor master file; (c) Contracts with third parties; and (d) Movement of cash/currency. Learn more about your ad choices. Visit megaphone.fm/adchoices What specifically are internal controls in a compliance program? The starting point is the FCPA itself, which requires issuers to devise and maintain a system of internal controls that can reasonably assure:

  1. Transactions are executed in accordance with management’s general or specific authorization;
  2. Transactions are recorded as necessary (I) to permit preparation of financial statements in conformity with generally accepted accounting principles or any other criteria applicable to such statements, and (II) to maintain accountability for assets;
  3. Access to assets is permitted only in accordance with management’s general or specific authorization; and
  4. The recorded accountability for assets is compared with the existing assets at reasonable intervals and appropriate action is taken with respect to any differences.

The DOJ and SEC, in the 2012 FCPA Guidance, stated:

Internal controls over financial reporting are the processes used by compa­nies to provide reasonable assurances regarding the reliabil­ity of financial reporting and the preparation of financial statements. They include various components, such as: a control environment that covers the tone set by the organi­zation regarding integrity and ethics; risk assessments; con­trol activities that cover policies and procedures designed to ensure that management directives are carried out (e.g., approvals, authorizations, reconciliations, and segregation of duties); information and communication; and monitoring. … The design of a company’s internal controls must take into account the operational realities and risks attendant to the company’s business, such as: the nature of its products or services; how the products or services get to market; the nature of its work force; the degree of regulation; the extent of its government interaction; and the degree to which it has operations in countries with a high risk of corruption.

Three key takeaways:

  1. Effective internal controls are required under the FCPA.
  2. Internal controls are a critical part of any best practices compliance program.
  3. There are four significant controls for the compliance practitioner to implement initially. (a) Delegation of authority (DOA); (b) Maintenance of the vendor master file; (c) Contracts with third parties; and (d) Movement of cash/currency.

Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 563 no Day 7 | Policies and Procedures There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as part of its risk assessment process.” This statement made clear that the regulators will take a strong view against a company that does not have well thought out and articulated policies and procedures against bribery and corruption; all of which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital layer of communication and acts as an internal control. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to policies and procedures in anti-corruption compliance. The specific written policies and procedures required for a best practices compliance program are well known and long established. According to the 2012 FCPA Guidance, some of the risks companies should keep in mind include the nature and extent of transactions with foreign governments (including payments to foreign officials); use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments. Policies help form the basis of expectations for standards of conduct in your company. Procedures are the documents that implement these standards of conduct. Compliance policies do not guarantee employees will always make the right decision. However, the effective implementation and enforcement of compliance policies demonstrate to the government that a company is operating professionally and ethically for the benefit of its stakeholders, its employees and the community it serves. Three key takeaways: Written compliance policies and procedures, together the Code of Conduct, with form the backbone of your compliance program. The DOJ and SEC expect a well-thought out and articulated set of compliance policies and procedures and that they be adequately communicated throughout your organization. Institutional fairness for the application of policies and procedures demands consistent application across the globe. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 07 Jan 2020 22:19:21 -0000 Day 7 | Policies and Procedures full Thomas Fox What are the role of policies and procedures? There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as part of its risk assessment process.” This statement made clear that the regulators will take a strong view against a company that does not have well thought out and articulated policies and procedures against bribery and corruption; all of which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital layer of communication and acts as an internal control. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to policies and procedures in anti-corruption compliance. The specific written policies and procedures required for a best practices compliance program are well known and long established. According to the 2012 FCPA Guidance, some of the risks companies should keep in mind include the nature and extent of transactions with foreign governments (including payments to foreign officials); use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments. Policies help form the basis of expectations for standards of conduct in your company. Procedures are the documents that implement these standards of conduct. Compliance policies do not guarantee employees will always make the right decision. However, the effective implementation and enforcement of compliance policies demonstrate to the government that a company is operating professionally and ethically for the benefit of its stakeholders, its employees and the community it serves. Three key takeaways: Written compliance policies and procedures, together the Code of Conduct, with form the backbone of your compliance program. The DOJ and SEC expect a well-thought out and articulated set of compliance policies and procedures and that they be adequately communicated throughout your organization. Institutional fairness for the application of policies and procedures demands consistent application across the globe. Learn more about your ad choices. Visit megaphone.fm/adchoices There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as part of its risk assessment process.” This statement made clear that the regulators will take a strong view against a company that does not have well thought out and articulated policies and procedures against bribery and corruption; all of which are systematically reviewed and updated. Moreover, having policies written out and signed by employees provides what some consider the most vital layer of communication and acts as an internal control. Together with a signed acknowledgement, these documents can serve as evidentiary support if a future issue arises. In other words, the “Document, Document, and Document” mantra applies just as strongly to policies and procedures in anti-corruption compliance.

The specific written policies and procedures required for a best practices compliance program are well known and long established. According to the 2012 FCPA Guidance, some of the risks companies should keep in mind include the nature and extent of transactions with foreign governments (including payments to foreign officials); use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments. Policies help form the basis of expectations for standards of conduct in your company. Procedures are the documents that implement these standards of conduct.

Compliance policies do not guarantee employees will always make the right decision. However, the effective implementation and enforcement of compliance policies demonstrate to the government that a company is operating professionally and ethically for the benefit of its stakeholders, its employees and the community it serves.

Three key takeaways:

  1. Written compliance policies and procedures, together the Code of Conduct, with form the backbone of your compliance program.
  2. The DOJ and SEC expect a well-thought out and articulated set of compliance policies and procedures and that they be adequately communicated throughout your organization.
  3. Institutional fairness for the application of policies and procedures demands consistent application across the globe.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 543 no Day 6 | The Code of Conduct What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in regulator’s face during an enforcement action as proof of ethical overall behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal in the creation of your company’s Code of Conduct? How important is the Code of Conduct? Consider the 2016 SEC enforcement action involving United Airlines, Inc., which turned on violation of the company’s Code of Conduct. The breach of the Code of Conduct was determined to be a FCPA internal controls violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity which has authority over, among other things, United’s operations at the company’s huge east coast hub at Newark, NJ. The actions of United’s former CEO, Jeff Smisek, in personally approving the benefit granted to favor Samson violated the company’s internal controls around gifts to government officials by failing to not only follow the United Code of Conduct but also violating it. The $2.4 million civil penalty levied on United was in addition to its 2016 Non-Prosecution Agreement (NPA) settlement with the DOJ, which resulted in a penalty of $2.25 million. The scandal also cost the resignation of Smisek and two high-level executives from United. In the 2012 FCPA Guidance, the DOJ and SEC states: A company’s Code of Conduct is often the foundation upon which an effective compliance program is built. As DOJ has repeatedly noted the most effective codes are clear, concise, and accessible to all employees and to those conducting business on the company’s behalf. The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) further specified “As a threshold matter, prosecutors should examine whether the company has a code of conduct that sets forth, among other things, the company’s commitment to full compliance with relevant Federal laws that is accessible and applicable to all company employees.” The Department of Justice (DOJ) Antitrust Division, Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations (Antitrust Guidance) also specified “If the company has a Code of Conduct, are antitrust policies and principles included in the document?” Three key takeaways: Every formulation of a best practices compliance program starts with a written Code of Conduct. The substance of your Code of Conduct should be tailored to the company’s culture, and to its industry and corporate identity. “Document, Document, and Document” your training and communication efforts. Learn more about your ad choices. Visit megaphone.fm/adchoices Tue, 07 Jan 2020 22:15:17 -0000 Day 6 | The Code of Conduct full 6 Thomas Fox Why is the Code of Conduct a foundational compliance document? What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in regulator’s face during an enforcement action as proof of ethical overall behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal in the creation of your company’s Code of Conduct? How important is the Code of Conduct? Consider the 2016 SEC enforcement action involving United Airlines, Inc., which turned on violation of the company’s Code of Conduct. The breach of the Code of Conduct was determined to be a FCPA internal controls violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity which has authority over, among other things, United’s operations at the company’s huge east coast hub at Newark, NJ. The actions of United’s former CEO, Jeff Smisek, in personally approving the benefit granted to favor Samson violated the company’s internal controls around gifts to government officials by failing to not only follow the United Code of Conduct but also violating it. The $2.4 million civil penalty levied on United was in addition to its 2016 Non-Prosecution Agreement (NPA) settlement with the DOJ, which resulted in a penalty of $2.25 million. The scandal also cost the resignation of Smisek and two high-level executives from United. In the 2012 FCPA Guidance, the DOJ and SEC states: A company’s Code of Conduct is often the foundation upon which an effective compliance program is built. As DOJ has repeatedly noted the most effective codes are clear, concise, and accessible to all employees and to those conducting business on the company’s behalf. The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) further specified “As a threshold matter, prosecutors should examine whether the company has a code of conduct that sets forth, among other things, the company’s commitment to full compliance with relevant Federal laws that is accessible and applicable to all company employees.” The Department of Justice (DOJ) Antitrust Division, Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations (Antitrust Guidance) also specified “If the company has a Code of Conduct, are antitrust policies and principles included in the document?” Three key takeaways: Every formulation of a best practices compliance program starts with a written Code of Conduct. The substance of your Code of Conduct should be tailored to the company’s culture, and to its industry and corporate identity. “Document, Document, and Document” your training and communication efforts. Learn more about your ad choices. Visit megaphone.fm/adchoices What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in regulator’s face during an enforcement action as proof of ethical overall behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal in the creation of your company’s Code of Conduct?

How important is the Code of Conduct? Consider the 2016 SEC enforcement action involving United Airlines, Inc., which turned on violation of the company’s Code of Conduct. The breach of the Code of Conduct was determined to be a FCPA internal controls violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity which has authority over, among other things, United’s operations at the company’s huge east coast hub at Newark, NJ.

The actions of United’s former CEO, Jeff Smisek, in personally approving the benefit granted to favor Samson violated the company’s internal controls around gifts to government officials by failing to not only follow the United Code of Conduct but also violating it. The $2.4 million civil penalty levied on United was in addition to its 2016 Non-Prosecution Agreement (NPA) settlement with the DOJ, which resulted in a penalty of $2.25 million. The scandal also cost the resignation of Smisek and two high-level executives from United.

In the 2012 FCPA Guidance, the DOJ and SEC states:

A company’s Code of Conduct is often the foundation upon which an effective compliance program is built. As DOJ has repeatedly noted the most effective codes are clear, concise, and accessible to all employees and to those conducting business on the company’s behalf.

The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) further specified “As a threshold matter, prosecutors should examine whether the company has a code of conduct that sets forth, among other things, the company’s commitment to full compliance with relevant Federal laws that is accessible and applicable to all company employees.” The Department of Justice (DOJ) Antitrust Division, Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations (Antitrust Guidance) also specified “If the company has a Code of Conduct, are antitrust policies and principles included in the document?”

Three key takeaways:

  1. Every formulation of a best practices compliance program starts with a written Code of Conduct.
  2. The substance of your Code of Conduct should be tailored to the company’s culture, and to its industry and corporate identity.
  3. “Document, Document, and Document” your training and communication efforts.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 552 Day 5 | The Board and operationalizing compliance In addition to a company’s senior management, there is a Board of Directors at the top. Yet the role of the Board is different than that of senior management. For the Board of Director, the Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) stated: Oversight – What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions? What types of information have the board of directors and senior management examined in their exercise of oversight in the area in which the misconduct occurred?  The DOJ Antitrust Division’s Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations (Antitrust Compliance Program Guidance) was even more explicit in announcing  their expectation for robust Board oversight of a corporate compliance function. The Antitrust Compliance Program Guidance stated “For the antitrust compliance program to be effective, those with operational responsibility for the program must have sufficient autonomy, authority, and seniority within the company’s governance structure, as well as adequate resources for training, monitoring, auditing and periodic evaluation of the program. The Antitrust Compliance Program Guidance then went on to ask the following questions: Who has overall responsibility for the antitrust compliance program? Is there a chief compliance officer or executive within the company responsible for antitrust compliance? If so, to whom does the individual report, e.g., the Board of Directors, audit committee, or other governing body? How often does the compliance officer or executive meet with the Board, audit committee, or other governing body? How does the company ensure the independence of its compliance personnel?   Three key takeaways: The DOJ Evaluation requires active Board of Director engagement and oversight around compliance. Board communication on compliance is a two-way street; both inbound and outbound. Does the Board of Directors have a Compliance Expert? Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 03 Jan 2020 20:33:54 -0000 Day 5 | The Board and operationalizing compliance full Thomas Fox What is the Board's role in operationalizing compliance? In addition to a company’s senior management, there is a Board of Directors at the top. Yet the role of the Board is different than that of senior management. For the Board of Director, the Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) stated: Oversight – What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions? What types of information have the board of directors and senior management examined in their exercise of oversight in the area in which the misconduct occurred?  The DOJ Antitrust Division’s Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations (Antitrust Compliance Program Guidance) was even more explicit in announcing  their expectation for robust Board oversight of a corporate compliance function. The Antitrust Compliance Program Guidance stated “For the antitrust compliance program to be effective, those with operational responsibility for the program must have sufficient autonomy, authority, and seniority within the company’s governance structure, as well as adequate resources for training, monitoring, auditing and periodic evaluation of the program. The Antitrust Compliance Program Guidance then went on to ask the following questions: Who has overall responsibility for the antitrust compliance program? Is there a chief compliance officer or executive within the company responsible for antitrust compliance? If so, to whom does the individual report, e.g., the Board of Directors, audit committee, or other governing body? How often does the compliance officer or executive meet with the Board, audit committee, or other governing body? How does the company ensure the independence of its compliance personnel?   Three key takeaways: The DOJ Evaluation requires active Board of Director engagement and oversight around compliance. Board communication on compliance is a two-way street; both inbound and outbound. Does the Board of Directors have a Compliance Expert? Learn more about your ad choices. Visit megaphone.fm/adchoices In addition to a company’s senior management, there is a Board of Directors at the top. Yet the role of the Board is different than that of senior management. For the Board of Director, the Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) stated:

Oversight – What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions? What types of information have the board of directors and senior management examined in their exercise of oversight in the area in which the misconduct occurred?

 The DOJ Antitrust Division’s Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations (Antitrust Compliance Program Guidance) was even more explicit in announcing  their expectation for robust Board oversight of a corporate compliance function. The Antitrust Compliance Program Guidance stated “For the antitrust compliance program to be effective, those with operational responsibility for the program must have sufficient autonomy, authority, and seniority within the company’s governance structure, as well as adequate resources for training, monitoring, auditing and periodic evaluation of the program. The Antitrust Compliance Program Guidance then went on to ask the following questions: Who has overall responsibility for the antitrust compliance program? Is there a chief compliance officer or executive within the company responsible for antitrust compliance? If so, to whom does the individual report, e.g., the Board of Directors, audit committee, or other governing body? How often does the compliance officer or executive meet with the Board, audit committee, or other governing body? How does the company ensure the independence of its compliance personnel? 

 Three key takeaways:

  1. The DOJ Evaluation requires active Board of Director engagement and oversight around compliance.
  2. Board communication on compliance is a two-way street; both inbound and outbound.
  3. Does the Board of Directors have a Compliance Expert?


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 563 no Day 4 | Moving compliance tone down through an organization Mike Volkov, in a blog post entitled “Mood in the Middle Versus Tone at the Top”, said, “Even when a company does all the right things at the senior management level, the real issue is whether or not that culture has embedded itself in middle and lower management. A company’s culture is reflected in the values and beliefs that exist throughout the company.” To fully operationalize your compliance program, you must articulate the message of ethical values and doing business in compliance and then drive that message from the top down, throughout your organization. The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) made clear a company must have more than simply good ‘Tone-at-the-Top’; it must move down through the organization from senior management to middle management and into its lower ranks. This means that one task is to get middle management to respect the stated ethics and values of a company, because if they do so, this will be communicated down through the organization. The 2019 Guidance stated: Shared Commitment – What actions have senior leaders and middle-management stakeholders (e.g., business and operational managers, finance, procurement, legal, human resources) taken to demonstrate their commitment to compliance or compliance personnel, including their remediation efforts? Have they persisted in that commitment in the face of competing interests or business objectives? This requirement speaks to the greater role of non-compliance functions in fully operationalized compliance program. Indeed, one sign of a mature compliance and ethics program is the extent to which a company’s other corporate disciplines are involved in implementing and then taking forward a compliance solution. This approach can act as a lynch pin in spreading a company’s commitment to compliance throughout the employee base. It can also be used to ‘connect the dots’ in many divergent elements of a corporate compliance and ethics program. Three key takeaways: Tone at the top - direct supervisors become the most important influence on people in the company. Give your middle managers a Tool Kit around compliance so they can fully operationalize compliance. Organizational justice is an additional way to help operationalize compliance. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 03 Jan 2020 20:32:31 -0000 Day 4 | Moving compliance tone down through an organization full Thomas Fox How do you move tone down through an organization? Find out in Day 4 of 31 Days to a More Effective Compliance Program. Mike Volkov, in a blog post entitled “Mood in the Middle Versus Tone at the Top”, said, “Even when a company does all the right things at the senior management level, the real issue is whether or not that culture has embedded itself in middle and lower management. A company’s culture is reflected in the values and beliefs that exist throughout the company.” To fully operationalize your compliance program, you must articulate the message of ethical values and doing business in compliance and then drive that message from the top down, throughout your organization. The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) made clear a company must have more than simply good ‘Tone-at-the-Top’; it must move down through the organization from senior management to middle management and into its lower ranks. This means that one task is to get middle management to respect the stated ethics and values of a company, because if they do so, this will be communicated down through the organization. The 2019 Guidance stated: Shared Commitment – What actions have senior leaders and middle-management stakeholders (e.g., business and operational managers, finance, procurement, legal, human resources) taken to demonstrate their commitment to compliance or compliance personnel, including their remediation efforts? Have they persisted in that commitment in the face of competing interests or business objectives? This requirement speaks to the greater role of non-compliance functions in fully operationalized compliance program. Indeed, one sign of a mature compliance and ethics program is the extent to which a company’s other corporate disciplines are involved in implementing and then taking forward a compliance solution. This approach can act as a lynch pin in spreading a company’s commitment to compliance throughout the employee base. It can also be used to ‘connect the dots’ in many divergent elements of a corporate compliance and ethics program. Three key takeaways: Tone at the top - direct supervisors become the most important influence on people in the company. Give your middle managers a Tool Kit around compliance so they can fully operationalize compliance. Organizational justice is an additional way to help operationalize compliance. Learn more about your ad choices. Visit megaphone.fm/adchoices Mike Volkov, in a blog post entitled “Mood in the Middle Versus Tone at the Top”, said, “Even when a company does all the right things at the senior management level, the real issue is whether or not that culture has embedded itself in middle and lower management. A company’s culture is reflected in the values and beliefs that exist throughout the company.” To fully operationalize your compliance program, you must articulate the message of ethical values and doing business in compliance and then drive that message from the top down, throughout your organization.

The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) made clear a company must have more than simply good ‘Tone-at-the-Top’; it must move down through the organization from senior management to middle management and into its lower ranks. This means that one task is to get middle management to respect the stated ethics and values of a company, because if they do so, this will be communicated down through the organization. The 2019 Guidance stated:

Shared Commitment – What actions have senior leaders and middle-management stakeholders (e.g., business and operational managers, finance, procurement, legal, human resources) taken to demonstrate their commitment to compliance or compliance personnel, including their remediation efforts? Have they persisted in that commitment in the face of competing interests or business objectives?

This requirement speaks to the greater role of non-compliance functions in fully operationalized compliance program. Indeed, one sign of a mature compliance and ethics program is the extent to which a company’s other corporate disciplines are involved in implementing and then taking forward a compliance solution. This approach can act as a lynch pin in spreading a company’s commitment to compliance throughout the employee base. It can also be used to ‘connect the dots’ in many divergent elements of a corporate compliance and ethics program.

Three key takeaways:

  1. Tone at the top - direct supervisors become the most important influence on people in the company.
  2. Give your middle managers a Tool Kit around compliance so they can fully operationalize compliance.
  3. Organizational justice is an additional way to help operationalize compliance.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 543 no Day 3 | Leadership’s conduct at the top Obviously, in every compliance program, the ethical tone of a company and accountability all starts at the top and most specifically senior management. The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) stated, “The company’s top leaders – the board of directors and executives – set the tone for the rest of the company. Prosecutors should examine the extent to which senior management have clearly articulated the company’s ethical standards, conveyed and disseminated them in clear and unambiguous terms, and demonstrated rigorous adherence by example. Prosecutors should also examine how middle management, in turn, have reinforced those standards and encouraged employees to abide by them.” To assist companies in understanding this requirement the 2019 Guidance sets out the following inquiries. Conduct at the Top – How have senior leaders, through their words and actions, encouraged or discouraged compliance, including the type of misconduct involved in the investigation? What concrete actions have they taken to demonstrate leadership in the company’s compliance and remediation efforts? How have they modelled proper behavior to subordinates? Have managers tolerated greater compliance risks in pursuit of new business or greater revenues? Have managers encouraged employees to act unethically to achieve a business objective, or impeded compliance personnel from effectively implementing their duties? This requirement is more than simply the ubiquitous “tone-at-the-top,” as it focuses on the conduct of senior management. The DOJ wants to see a company’s senior leadership actually doing compliance. The DOJ asks if company leadership has, through their words and concrete actions, brought the right message of doing business ethically and in compliance to the organization. How does senior management model its behavior on a company’s values and finally, how is such conduct monitored in an organization? Three key takeaways: Senior management must actually do compliance; walk-the-walk, not simply talk-the-talk. Use your CEO to talk about current events and how those ethical failures are lessons to be learned for your organization. CEO as Compliance Ambassador. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 03 Jan 2020 20:31:17 -0000 Day 3 | Leadership’s conduct at the top full Thomas Fox Obviously, in every compliance program, the ethical tone of a company and accountability all starts at the top and most specifically senior management. The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) stated, “The company’s top leaders – the board of directors and executives – set the tone for the rest of the company. Prosecutors should examine the extent to which senior management have clearly articulated the company’s ethical standards, conveyed and disseminated them in clear and unambiguous terms, and demonstrated rigorous adherence by example. Prosecutors should also examine how middle management, in turn, have reinforced those standards and encouraged employees to abide by them.” To assist companies in understanding this requirement the 2019 Guidance sets out the following inquiries. Conduct at the Top – How have senior leaders, through their words and actions, encouraged or discouraged compliance, including the type of misconduct involved in the investigation? What concrete actions have they taken to demonstrate leadership in the company’s compliance and remediation efforts? How have they modelled proper behavior to subordinates? Have managers tolerated greater compliance risks in pursuit of new business or greater revenues? Have managers encouraged employees to act unethically to achieve a business objective, or impeded compliance personnel from effectively implementing their duties? This requirement is more than simply the ubiquitous “tone-at-the-top,” as it focuses on the conduct of senior management. The DOJ wants to see a company’s senior leadership actually doing compliance. The DOJ asks if company leadership has, through their words and concrete actions, brought the right message of doing business ethically and in compliance to the organization. How does senior management model its behavior on a company’s values and finally, how is such conduct monitored in an organization? Three key takeaways: Senior management must actually do compliance; walk-the-walk, not simply talk-the-talk. Use your CEO to talk about current events and how those ethical failures are lessons to be learned for your organization. CEO as Compliance Ambassador. Learn more about your ad choices. Visit megaphone.fm/adchoices Obviously, in every compliance program, the ethical tone of a company and accountability all starts at the top and most specifically senior management. The Evaluation of Corporate Compliance Programs - Guidance Document (2019 Guidance) stated, “The company’s top leaders – the board of directors and executives – set the tone for the rest of the company. Prosecutors should examine the extent to which senior management have clearly articulated the company’s ethical standards, conveyed and disseminated them in clear and unambiguous terms, and demonstrated rigorous adherence by example. Prosecutors should also examine how middle management, in turn, have reinforced those standards and encouraged employees to abide by them.” To assist companies in understanding this requirement the 2019 Guidance sets out the following inquiries.

Conduct at the Top – How have senior leaders, through their words and actions, encouraged or discouraged compliance, including the type of misconduct involved in the investigation? What concrete actions have they taken to demonstrate leadership in the company’s compliance and remediation efforts? How have they modelled proper behavior to subordinates? Have managers tolerated greater compliance risks in pursuit of new business or greater revenues? Have managers encouraged employees to act unethically to achieve a business objective, or impeded compliance personnel from effectively implementing their duties?

This requirement is more than simply the ubiquitous “tone-at-the-top,” as it focuses on the conduct of senior management. The DOJ wants to see a company’s senior leadership actually doing compliance. The DOJ asks if company leadership has, through their words and concrete actions, brought the right message of doing business ethically and in compliance to the organization. How does senior management model its behavior on a company’s values and finally, how is such conduct monitored in an organization?

Three key takeaways:

  1. Senior management must actually do compliance; walk-the-walk, not simply talk-the-talk.
  2. Use your CEO to talk about current events and how those ethical failures are lessons to be learned for your organization.
  3. CEO as Compliance Ambassador.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 513 no Day 2 | Measuring your risk Operationalizing your compliance program can take many shapes and forms. Using the entire risk management process to embed your compliance program within the contours of your organization is an important key step that will allow you to have full visibility of your compliance risks through a longer life cycle. Forecasting allows you to consider your business strategy and wed the risks you can foresee. Risk assessments allow you to evaluate and measure known risks. Risk-based monitoring allows you to monitor both the compliance risks you know about and detect those you do not know, on an ongoing basis. Three key takeaways: The risk management process is an important backbone of operationalizing compliance. You should be able monitor and measure both known and unknown risks. All of these steps help a business to run more efficiently and more profitably. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 03 Jan 2020 20:24:03 -0000 Day 2 | Measuring your risk full Thomas Fox In Day of 31 days to a more effective compliance program, we consider measuring your risk and then what to do with the information after you have obtained it. Operationalizing your compliance program can take many shapes and forms. Using the entire risk management process to embed your compliance program within the contours of your organization is an important key step that will allow you to have full visibility of your compliance risks through a longer life cycle. Forecasting allows you to consider your business strategy and wed the risks you can foresee. Risk assessments allow you to evaluate and measure known risks. Risk-based monitoring allows you to monitor both the compliance risks you know about and detect those you do not know, on an ongoing basis. Three key takeaways: The risk management process is an important backbone of operationalizing compliance. You should be able monitor and measure both known and unknown risks. All of these steps help a business to run more efficiently and more profitably. Learn more about your ad choices. Visit megaphone.fm/adchoices Operationalizing your compliance program can take many shapes and forms. Using the entire risk management process to embed your compliance program within the contours of your organization is an important key step that will allow you to have full visibility of your compliance risks through a longer life cycle. Forecasting allows you to consider your business strategy and wed the risks you can foresee. Risk assessments allow you to evaluate and measure known risks. Risk-based monitoring allows you to monitor both the compliance risks you know about and detect those you do not know, on an ongoing basis.

Three key takeaways:

  1. The risk management process is an important backbone of operationalizing compliance.
  2. You should be able monitor and measure both known and unknown risks.
  3. All of these steps help a business to run more efficiently and more profitably.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 492 no Day 1 | What 2019 Brought to Compliance Programs 2019 was a very significant year for every compliance practitioner and compliance program. Not only was it the year with the single highest amount of FCPA enforcement actions, fines and penalties assessed against corporations but it also saw the greatest number of individual prosecutions. Yet perhaps most significantly there were three noteworthy releases of information by the federal government which directly impacted compliance professionals in 2019. Two came from the Department of Justice (DOJ) and one came from the Department of Treasury, Office of Foreign Asset Control (OFAC). These three guidances contributed to the continued evolution of what constitutes a best practices compliance program. Three key takeaways: The 2019 Compliance Guidance asks three key questions of every corporate compliance program and adds a mandate for culture assessment, management and improvement. The OFAC Framework mandates due diligence on not only third parties in the sales cycle but also vendors in the Supply Chain and customers as well. The Antitrust Division Compliance Evaluation adds a requirement for data analytics and statistical analysis in monitoring and continuous improvement. Learn more about your ad choices. Visit megaphone.fm/adchoices Fri, 03 Jan 2020 20:20:38 -0000 Day 1 | What 2019 Brought to Compliance Programs full Thomas Fox In Day 1 of my podcast series on 31 Days to a More Effective Compliance Program, I discuss the key information from the regulators for the compliance practitioner. 2019 was a very significant year for every compliance practitioner and compliance program. Not only was it the year with the single highest amount of FCPA enforcement actions, fines and penalties assessed against corporations but it also saw the greatest number of individual prosecutions. Yet perhaps most significantly there were three noteworthy releases of information by the federal government which directly impacted compliance professionals in 2019. Two came from the Department of Justice (DOJ) and one came from the Department of Treasury, Office of Foreign Asset Control (OFAC). These three guidances contributed to the continued evolution of what constitutes a best practices compliance program. Three key takeaways: The 2019 Compliance Guidance asks three key questions of every corporate compliance program and adds a mandate for culture assessment, management and improvement. The OFAC Framework mandates due diligence on not only third parties in the sales cycle but also vendors in the Supply Chain and customers as well. The Antitrust Division Compliance Evaluation adds a requirement for data analytics and statistical analysis in monitoring and continuous improvement. Learn more about your ad choices. Visit megaphone.fm/adchoices 2019 was a very significant year for every compliance practitioner and compliance program. Not only was it the year with the single highest amount of FCPA enforcement actions, fines and penalties assessed against corporations but it also saw the greatest number of individual prosecutions. Yet perhaps most significantly there were three noteworthy releases of information by the federal government which directly impacted compliance professionals in 2019. Two came from the Department of Justice (DOJ) and one came from the Department of Treasury, Office of Foreign Asset Control (OFAC). These three guidances contributed to the continued evolution of what constitutes a best practices compliance program.

Three key takeaways:

  1. The 2019 Compliance Guidance asks three key questions of every corporate compliance program and adds a mandate for culture assessment, management and improvement.
  2. The OFAC Framework mandates due diligence on not only third parties in the sales cycle but also vendors in the Supply Chain and customers as well.
  3. The Antitrust Division Compliance Evaluation adds a requirement for data analytics and statistical analysis in monitoring and continuous improvement.


Learn more about your ad choices. Visit megaphone.fm/adchoices

]]> 578 no