One of the areas articulated in the 2019 Guidance was around payments and payroll. For the both the compliance professional and the corporate payroll function, there is a significant role to play in the operationalization of a corporate compliance program. The Evaluation of Corporate Compliance Programs – Guidance Document (2019 Guidance) was replete with references to payment and its critical nature to any best practices compliance program. This includes references to payments to foreign officials, payments to third parties and hiding bribes in payments to distributors.
The 2019 Guidance begins with an admonition to stop wasting time on low hanging fruit when there are much higher risks in your business operations. It stated:
Risk-Tailored Resource Allocation – Does the company devote a disproportionate amount of time to policing low-risk areas instead of high-risk areas, such as questionable payments to third-party consultants, suspicious trading activity, or excessive discounts to resellers and distributors? Does the company give greater scrutiny, as warranted, to high-risk transactions (for instance, a large-dollar contract with a government agency in a high-risk country) than more modest and routine hospitality and entertainment?
The 2019 Guidance then drilled down into the payment and payroll system, stating:
Appropriate Controls – How does the company ensure there is an appropriate business rationale for the use of third parties? If third parties were involved in the underlying misconduct, what was the business rationale for using those third parties? What mechanisms exist to ensure that the contract terms specifically describe the services to be performed, that the payment terms are appropriate, that the described contractual work is performed, and that compensation is commensurate with the services rendered?
Taken together, these questions may not seem particularly new, innovative, or even something different from what payroll currently does for an organization. However, the 2019 Guidance , clearly demonstrates the role of payroll in compliance. The 2019 Guidance requires that payroll not only form a part of any best practices compliance program, but when it comes to the specific subject matter expertise, payroll is on the front lines of any attempts to prevent, detect, and then remediate anti-corruption compliance violations.
The Foreign Corrupt Practices Act (FCPA) prohibits “anything of value” to be provided to foreign government officials or employees of state-owned enterprises to obtain or retain business. This “anything of value” is almost always money, and that money must come from somewhere inside the company. While the Watergate intonation to “follow the money” certainly continues to be valid in any compliance issue, the 2019 Guidance speaks in much more depth around payroll’s responsibility in a corporate compliance program. There must be demonstrable controls in place which not only detect fraudulent payments but work to prevent any such payments as well.
Yet when the inquiries are read together, they paint a broader picture than one of simply tasking payroll with the responsibility to prevent fraudulent leakage of money which could be used to fund bribes. The questions around the approval/certification process should be a standard part of any payroll system. This has the effect of operationalizing the responsibility up and down the management chain from the individual employee, up through their manager(s) and eventually to the highest level of management involved in the process. This level of operationalization is designed to not only put a set of brakes in place but also work to put a second set of eyes on the entire payroll process.
Finally, the payment systems has a role in the remediation prong of any best practices compliance program. If there was a payroll control failure which led to or even allowed a compliance violation, what was done to fix the control issue? Here payroll should work to perform a root cause analysis of what led to the control failure and then enhance or upgrade the control to provide a solution going forward. Of course, there should be a fully documented audit trail for this work to provide to the government should they ever come knocking or even to your own corporate auditors.
This means that not only can payroll be one of the compliance function’s strongest corporate allies; but that the role of payroll, by its nature, works to operationalize compliance. This is because to implement the appropriate internal controls around compliance, payroll must know the specific requirements of the FCPA, know what kinds of issues are likely to come up that might create a risk of bribery and corruption, all leading to an understanding of the appropriate compliance internal controls to implement around payroll and payments.
This is most particularly true around offshore payments, which are generally defined as payments made to a location other than the home domicile of the payee or the location where the services where delivered. If a Tunisian agent who performs services in Dubai asks for payment in a location other than Dubai or Tunisia, that would qualify as an offshore payment. If you train people who are in payroll on this issue, they may well pick up the phone, and notify compliance when they see a request for payment in a geographic location separate and apart from one of the two standard payment venues. Those are the types of communications, when properly documented, that demonstrate your compliance program is operationalized into the fabric of the organization.
Another way to view it is if there is a payroll control for such a scenario which notes the exception and requires the clearance of a red flag through additional investigation, elevation for approval and documentation of the entire process; it operates as both a financial control and as a compliance control as well. It strengthens the company’s internal controls to both prevent and detect compliance risks going forward.
There are several specific internal payroll controls that will facilitate a company operationalizing its compliance program, as required under the 2019 Guidance. These controls help keep an eye on the money trail as the money to pay a bribe is usually hidden in some company expenditure. The four general areas of payroll control should include: 1) segregation of duties; 2) accountability, authorization, and approval; 3) security of assets; and 4) review and reconciliation.
To meet these four general goals, consider using a selection of the following controls for payroll systems, irrespective of how timekeeping information is accumulated or how employees are paid:
- Have either internal or external auditors conducted an annual audit of the payroll accuracy?
- Change authorizations. Only allow a change to an employee’s marital status, withholding allowances, or deductions if the employee has submitted a written and signed request for the company to do so. Any change request should be reviewed and approved by a senior manager.
- Change tracking log. If you are processing payroll in-house with a computerized payroll module, have secure change tracking which will provide an audit trail.
- Expense trend lines.This is your data and it is within your company somewhere. Look for changes in payroll-related expenses in the financial statements and then investigate if warranted.
- Issue payment report to supervisors.Request supervisors review payroll summaries for correct payment amounts and unfamiliar names.
- Restrict access to records.Prevent unauthorized access to payroll records.
- Segregation of duties.You should never allow one person to prepare the payroll, authorize it and create payments.
The role of payroll in compliance is not often considered in operationalizing your compliance program, yet the monies to fund bribes must come from somewhere. Unfortunately, one of those places is out of payroll. All CCOs need to sit down with his or her head of payroll, have them explain the role of payroll, then review the internal controls in place to see how they facilitate the goals of compliance. From that review, you can then determine how to use payroll to help to operationalize your compliance program.
The DOJ has now provided its clearest statement on how it expects a company to actually do compliance going forward. Long gone are the days where the DOJ simply considered the inputs of a written program as sufficient to protect companies from compliance violations. Yet the mandate to operationalize a corporate compliance program drives home the concept that compliance is a business process, which should be administered by the appropriate business unit with the requisite SME. When it comes to following the money, payroll is the most well-suited corporate discipline to provide this first level of oversight and controls.
Three key takeaways:
- Payroll can be a key prevent and detect control.
- The 2019 Guidance specified the tying of the corporate compliance function to the corporate payroll function.
- Offshore payments remain a key indicator for a red flag.