In the midst of this true madness in the NCAA tournament this year, Jay Rosen and myself take a look at some of the top compliance stories over the past week.

  1. Cambridge Analytica is in a world of trouble after stealing data from Facebook and advising clients to engage in bribery and corruption. See stories in FCPA Blog, good summary of stories by Sam Rubenfeld at WSJ Risk and Compliance Journal, The Guardian reports on what we know so far and Recode summarizes the interplay between Cambridge Analytica and Facebook.
  2. Facebook is not far behind for its tepid response. Zuckerberg responds, reported in the Wall Street Journal, a Whistleblower weighs in, the Washington Post reports that the FTC has opened an investigations, Mark Zuckerberg talks to the New York Times.
  3. In largest whistleblower awards ever, the SEC doles out $83MM to 3 anonymous persons for fraudulent conduct at Merrill-Lynch. Dick Cassin reports in the FCPA Blog, Matt Kelly advises to read the fine print on Radical Compliance and Kevin LaCroix details some interesting points from the award. The award lands the whistleblowers’ attorney, Jordan Thomas on the front page of the NYT.
  4. Catching up on news from the UK: in NYU Compliance and Enforcement Blog considers the first test of Bribery Act’s Adequate Procedures defense, from the WSJ Risk and Compliance Report-(1) Sam Rubenfeld says UK may end Scottish shell companies, (2) Rubenfeld reports that the SFO claws back bribe payment to Chad government official, (3) Mara Lemos Stein reports the Financial Conduct Authority seeks more transparency.
  5. In an unsurprising yet disturbing development, whistleblower retaliation is up. Ben DiPietro reports in the WSJ Risk and Compliance Journal.
  6. Uber Brings in Holder Report Co-Author as Deputy GC, Angela Padilla Out. Stephanie Forshee reports in Corporate Counsel (Sub req’d)
  7. Check out the top new podcast in the compliance field Innovation in Compliance. It is available on the FCPA Compliance Report, iTunes, Libsyn, YouTube and JDSupra.
  8. Tom announces presales of his next book, the Complete Compliance Handbook, which will be published by Compliance Week in April 2018. It is available for PreSale here.
  9. Jonathan Armstrong will be in Houston on April 10 to put on a half-day GDPR workshop. You can find out more and register at the Greater Houston Business and Ethics Roundtable website, org.
  10. Tom will be leading Convercent Roundtables on using data to drive ethics to the center of business in Miami (April 4), Houston (April 17) and Dallas (April 18).
  11. Tom and Everything Compliance panelist Mike Volkov and Matt Kelly named as top contributors in compliance in annual JDSupra Readers 2017-8 Poll. Will Jay take his game up?
  12. Jay details the upcoming presentations by his Affiliated Monitors’ colleagues at the SCCE European Ethics and Compliance Institute and with Convercent.

For more information on how an independent monitor can help improve your company’s ethics and compliance program, visit our sponsor Affiliated Monitors at

7K0A0223Last Friday, the FCPA Professor reported:

“According to this Global Investigations Review article:

“According to two people familiar with the matter, the US Department of Justice (DoJ) has hired Hui Chen, Standard Chartered’s former head of anti-bribery and corruption compliance, as its new compliance counsel. […] Before joining Standard Chartered, Chen served as an assistant general counsel at US pharmaceutical company Pfizer between June 2010 and September 2013. In this position, she oversaw the drug-maker’s internal investigations in the Asia-Pacific region, and also led compliance reviews in Latin America, Europe and the Middle East. Chen previously worked for Microsoft for 13 years, serving first in the intellectual property litigation team and later as a compliance officer in China. During the 1990s, Chen worked as a DoJ trial lawyer in Washington, DC, and as an assistant US attorney in Brooklyn.”

I recognize it is better to cite to the original source but as Global Investigations Review is a subscription only service, I could not view the full article, so you will have to make do with a secondary cite. Of course, if you cannot trust the FCPA Professor to report something correctly, whom can you trust?

There was much ink spilled earlier this summer about the efficacy of such a position; with a spectrum ranging from substantive, that the Department of Justice (DOJ) attorneys who do not need someone to instruct them on what a best practices compliance program is to the procedural that the compliance counsel position is not a government employee but only a contractor. However, I think those criticisms and the others leveled miss the point of the effect of the creation of this position on the compliance discipline in the corporate environment.

The creation of this position portends that the DOJ will be looking more closely at Foreign Corrupt Practices Act (FCPA) anti-corruption compliance programs to see if they meet the minimum standards or are closer to best practices. This requires companies to actually do compliance and not simply put a paper program in place and say they have an effective compliance program.

I asked Stephen Martin, the Managing Director and founder of Baker & McKenzie’s compliance consulting practice and someone who helps companies proactively enhance corporate compliance programs what he thinks the creation of this new DOJ compliance consultant position. Martin is one of the few experts out there that has a similar background to Hui Chen, having been a former federal prosecutor in Washington and in-house counsel/compliance officer helping WorldCom, Qwest and Adelphia wade through and recover from significant compliance failures and major government investigations.

“Historically, it has been difficult for compliance professionals to explain the “return on investment” in compliance programs to senior management and Board of Directors. Companies questioned whether DOJ and SEC really credited a pre-existing compliance program or enhancements done during an investigation and/or resolution. The DOJ and SEC listened to the compliance community and publicly released the rationale in the Morgan Stanley declination as resulting from the effectiveness of Morgan Stanley’s compliance program.

Now, the DOJ is furthering its focus on the importance of compliance by clearly signaling how intently DOJ will be evaluating compliance programs in charging decisions, resolutions and monitorships. By retaining a compliance consultant with previous DOJ and in-house compliance experience, DOJ is sending a strong message to senior management and Boards of Directors that it is now critical that companies have a robust, effective and sophisticated compliance program covering both FCPA and non-FCPA risk areas.

For DOJ, this is a great step forward in being able to actually understand compliance programs and how they operate in the real world, in difficult environments when investigating and resolving matters. For companies, the “return on investment” is clear…the benefits of an effective compliance program far outweigh the costs of the program and help mitigate government enforcement and compliance related risks. For compliance professionals, the DOJ’s increasing focus provides the rationale for helping companies truly move to instituting and maintaining a practical, best practices compliance program that meets the rising expectations of the DOJ.”

As Martin makes clear, having a robust demonstrable program in place is now even more critical. The foundational elements of a best practices compliance program are well known and available to anyone looking. Of course, I would say one of the best place to start is my book Doing Compliance: Design, Create, and Implement an Effective Anti-Corruption Compliance Program which is based on the 10 Hallmarks of an Effective Compliance Program, as laid out in the FCPA Guidance. But you can use other formulations such as Martin’s Five Elements of an Effective Compliance Program, the OECD 13 Good Practices or even the UK Six Principles of Adequate Procedures as the basis for your compliance program.

Whichever formulation you use, the steps are straightforward. Top management must commit to having an effective compliance program and that commitment must be transmitted down throughout the organization. You need to assess the risks to your organization around anti-corruption and to manage those risks accordingly. The specifics of the compliance expectations must be set out in a policy and sufficient procedures must be implemented to all the policies to be followed. There must be a compliance function, with sufficient resources, authority and visibility within your company to lead this area, with appropriate board oversight. You must provide training on not only the company’s expectations around compliance, but also how to do compliance. There must be sufficient incentives in place, around hiring and promotion. There must be a mechanism for reporting of violations and then an appropriate response, through investigations and reporting of any violations of your compliance program. Additionally resources need to be placed around the management of compliance risks involving third parties and mergers and acquisitions (M&A). A company must have a mechanism to keep abreast of and then implement appropriate technological and business improvements as well as any legal or business related changes in anti-corruption compliance. Finally, all of the above must be thoroughly documented.

This new compliance counsel position at the DOJ makes implementing and documenting the above steps all the more important. But it also gives companies a greater chance to avoid potential FCPA liability through a DOJ Declination to Prosecute if they can demonstrate they have an effective compliance program. With the announcement last week of the Yates Memo and the increased focus on corporate internal investigations to identify senior executives for prosecution, it is now even more important that companies have a robust compliance program in place. As Mike Volkov often says, the DOJ clearly communicates the direction they are heading. The message could not be clearer.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at

© Thomas R. Fox, 2015

Can you synthesize and reconcile the world’s leading laws, regulations and commentaries on the best practices an anti-bribery and anti-corruption compliance program. I recently saw one such approach by Paul McNulty and Stephen Martin of the law firm, Baker and McKenzie. They have developed what they term the five essential elements of a corporate compliance program. These five elements are based upon the best practices as set out in the seven elements of a corporate compliance program under the US Sentencing Guidelines; the 13 Good Practices by the OECD on Internal Controls, Ethics, and Compliance; the FCPA Guidance’s Ten Hallmarks of Effective Compliance Program and the UK Bribery Act’s Six Principles of an Adequate Procedures compliance program. The five elements are:

  • Leadership
  • Risk Assessment
  • Standards and Controls
  • Training and Communication
  • Oversight

I.                   Leadership

The point means more than simply “Tone-at-the-top”; a successful compliance program must be built on a solid foundation of ethics that are fully and openly endorsed by senior management. There should be an unambiguous, visible and active commitment to compliance. But even more than support or the right tone, compliance standards require that companies must have high-ranking compliance officers with the authority and resources to manage the program on a day-to-day basis. And compliance officers must have the ear of those ultimately responsible for corporate conduct, including the board of directors.

Some of the questions you might think about in connection with the leadership of your compliance program are the following: How is board oversight implemented? Is there an ethics or audit committee reporting to the full board? What is the role of the Chief Compliance Officer? What is the role of the General Counsel? How do the legal and compliance departments interact? Does the CCO have “real power”? Is she or he treated as a second-class citizen?

Equally the Board of Directors has a key role to fulfill. The Board must ensure compliance policies, systems and procedures are in place and it should monitor implementation and effectiveness of the compliance program:

  • Be actively involved
  • Attend Board meetings
  • Review, consider and evaluate information provided
  • Inquire further when presented with questionable circumstances or potential issues
  • Once Board knows of a potential compliance issue it must act.
  • Regularly receive compliance briefings and training.

II.                Risk Assessment

The implementation of an effective compliance program is more than simply following a set of accounting rules or providing effective training. Compliance issues can touch many areas of your business and you need to know not only what your highest risks are but where to marshal your efforts in moving forward. A risk assessment is designed to provide a big picture of your overall compliance obligations and then identify areas of high risk so that you can prioritize your resources to tackle these high risk areas first.

What are some of the areas where you need to assess your risks?

  1. Country Risk – What is the correlation between growth markets and corruption risk and what is the perceived level of corruption? In other words, the Transparency International Corruption Perceptions Index or similar list.
  2. Sector Risk – Has government publicly stated industry is under scrutiny or already conducted investigations in sector? Are there corruption risks particular to the industry?
  3. Business Opportunity Risk – Is the business opportunity a high value project for your company? Are there multiple contractors or intermediaries involved in the bidding or contract execution phase?
  4. Business Partnership Risk – Does this business opportunity require a foreign government relationship? Does a foreign government require you to rely upon any third parties?
  5. Transaction Risk – Will your company be required to make any “compelled giving” through any requirements for political or charitable contributions? Are you required to use any intermediaries to obtain licenses and permits?

In addition to an initial risk assessment to either (1) inform your compliance program or (2) help you to identify high risks and prioritize their remediation, risk assessments should be a regular, systemic part of compliance efforts rather than an occasional, ad hoc exercise cobbled together when convenient or after a crisis. They should be conducted at the same time every year and performed by a consistent group, such as your internal audit department or enterprise risk management team. Such annual risk assessments act as a strong preventive measure if they are performed before something goes wrong as it avoids a “wait and see” approach.

III.             Standards and Controls

Generally, every company has three levels of standards and controls. (1) Code of Conduct. Every company should have a Code of Conduct which should express its ethical principles. However, a Code of Conduct is not enough. (2) Standards and Policies. Every company should have standards and policies in place that build upon the foundation of the Code of Conduct and articulate Code-based policies, which should cover such issues as bribery, corruption and accounting practices. (3) Procedures. Every Company should then ensure that enabling procedures are implemented to confirm those policies are implemented, followed and enforced.

FCPA compliance best practices now require companies to have additional standards and controls, including, for example, detailed due diligence protocols for screening third-party business partners for criminal backgrounds, financial stability and improper associations with government agencies. Ultimately, the purpose of establishing effective standards and controls is to demonstrate that your compliance program is more than just words on a piece of paper.

IV.              Training

Another pillar of a strong compliance program is properly training company officers, employees and third parties on relevant laws, regulations, corporate policies and prohibited conduct. Simply conducting training usually is not enough. Enforcement officials want to be certain the messages in the training actually get through to employees. The Department of Justice’s (DOJ) expectations of effectiveness are measured by who a company trains, how the training is conducted and how often training occurs.

There are several key elements to training. First is that you need to train the right people. You must prioritize which audience to educate by starting your training program in higher risk markets and focus on directors, officers and sales employees who may have direct contact with government officials or deal with state-owned entities. Again, focus initially on training country managers in your company’s high-risk markets, then expand geographically and through the ranks of employees.

Second, in high risk markets and for high risk employees or third parties you should conduct live, annual training. Enforcement officials have made it clear that live, in-person training is the preferred method in high-risk markets and also that it should be regular and frequent. Another benefit of live training is the immediate feedback from employees that would be much less likely to occur during a webinar or other remote training. Lastly, during live training, employees are more likely to make casual mention of a potentially risky practice, giving you the opportunity to address it before it becomes a larger problem.

It is important that you pay attention to what employees say during training. This is because training can alert you to potential problems based on the type of questions employees ask and their level of receptiveness to certain concepts. For example, during training employees might ask specific questions about important compliance considerations such as their interactions with government officials or gift-giving practices. Such questions can raise red flags and uncover issues that should be reviewed and addressed quickly.

V.                 Oversight – including monitoring, auditing and responses

The issue your company should focus on here is whether employees are staying with the compliance program. Even after all the important ethical messages from management have been communicated to the appropriate audiences and key standards and controls are in place, there should still be a question of whether the company’s employees are adhering to the compliance program. These ongoing efforts demonstrate your company is serious about compliance.

Monitoring is a commitment to reviewing and detecting compliance programs in real time and then reacting quickly to remediate them. A primary goal of monitoring is to identify and address gaps in your program on a regular and consistent basis. Auditing is a more limited review that targets a specific business component, region or market sector during a particular timeframe in order to uncover and/or evaluate certain risks, particularly as seen in financial records. However, you should not assume that because your company conducts audits that it is effectively monitoring. A robust program should include separate functions for auditing and monitoring. While unique in protocol, however, the two functions are related and can operate in tandem.

Finally, what are your remediation efforts? Your company should remediate problems quickly. A key concept behind the oversight element of compliance is that if a company is policing itself on compliance-related issues, the government will not have to do it for them. Remediation, then, is an important component of oversight. It is not enough to just gather information and identify compliance problems through monitoring and auditing. To fulfill this essential element of compliance, you also have to respond and fix the problems.

I have found that the Baker ‘Five Essentials’ approach is an excellent way to think through your obligations under a wide variety of anti-corruption and anti-bribery requirements. It allows you to put in place a program which should meet virtually any legal requirements you may come up against by doing business anywhere in the world. Lastly, the five-step approach is an excellent way for you to benchmark your current compliance program.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at

© Thomas R. Fox, 2013

Product DetailsThis past week, my second book, “Best Practices Under the FCPA and Bribery Act” was released. Over the past few years I have tried to provide the compliance practitioner with solid information that can be used to implement, review and enhance a US Foreign Corrupt Practices Act (FCPA) or UK Bribery Act based compliance program. I am often asked to collect my blog posting regarding what are the current best practices for an anti-corruption/anti-bribery compliance program. In other words, what are the specifics of a compliance program. This volume will provide the compliance practitioner with information that can be used for the ‘nuts and bolts’ of compliance.

Using the format of the most recent US Department of Justice (DOJ) and Securities and Exchange Commission (SEC) “A Resource Guide to the U.S. Foreign Corrupt Practices Act. The Foreign Corrupt Practices Act (FCPA)” [the “FCPA Guidance”]; I have included some of my thoughts on what you can do to create and maintain a best practices compliance program. I have also included some thoughts on how to create and maintain such a compliance program using the Six Principles of an Adequate Procedures compliance regime under the UK Bribery Act.

I was honored to have the FCPA Professor, Mike Koehler, pen the forward and he said, in part, “In the current global marketplace, Foreign Corrupt Practices Act (“FCPA”) risk needs to be on the radar screen of most companies – large and small, public and private, and across industry sectors. Given the current enforcement theories of the Department of Justice and Securities and Exchange Commission, FCPA risk is not always apparent from reading the statute. There is no way for business organizations to truly eliminate FCPA risk, but such risk can be effectively managed and minimized through pro-active policies and procedures and other means of risk assessment.”

I hope that you can use this volume, in conjunction with the FCPA Guidance and the Ministry of Justice’s Six Principles of an Adequate Procedures compliance program, to implement or enhance your compliance regime. Both the FCPA Guidance and Six Principles make clear that there is no ‘one size fits all’ compliance program. The key is to assess your company’s risks and to manage those risks appropriately. This volume will help you to determine the type and scope of program that is appropriate for your company and will assist your compliance efforts going forward.

Best Practices Under the FCPA and Bribery Act is available exclusively on For a copy, click here.

Last weekend in the Financial Times (FT) was a report by Tim Burgis of an interview he held over a lunch meeting with the Angolan Isabel dos Santos, who Forbes magazine recently declared “the continent’s first female billionaire.” Ms. dos Santos is the daughter of José Eduardo dos Santos, who has been Angola’s president for the past 33 years. The interview was a fascinating insight into how doing business in some countries under US or UK anti-corruption and anti-bribery laws can be so challenging.

Burgis quoted an un-named expert who described Angola as a place of “corny capitalism” where those with connections to “the Futungo, as the presidential coterie is known (after Futungo de Belas, the old presidential palace) have made fortunes.” Ms. dos Santos denied that she is involved in politics, claiming that she is only interested in business. Interestingly, Burgis quoted her as stating “I’m not involved in politics and I’ve never had any political role. I’ve never been in office. I’ve never taken any public administrative jobs. So, like I said, I don’t work with the government.”

Some of her business interests “include stakes in two Portuguese banks, BIC and BPI, and a communications group called ZON Multimédia and an indirect holding in Galp, a Portuguese energy group with assets from Mozambique to Venezuela.” While admitting that the “oil industry is politically driven” she insisted that in the business sectors in which she is involved “politics don’t come into it”, she says, even if her own big moment came when she was part of a consortium that won a public tender for Angola’s second mobile telephony licence in the late 1990s.”

Burgis noted that there are believed to be many ways for the well connected to make lots of money in Angola. He wrote, “There are, however, easy ways to make money if you’re connected in Angola, particularly in the resources industries, where top officials and generals have been known to take hidden stakes in ventures led by oil majors and to enjoy titles to diamond-bearing land.” He also went on to note that these systems may be perpetuating the overall poverty in African countries such as Angola when he said that “There are those who would say that corrupt models lie at the heart of the power structures that keep most Africans poor and unable to call their rulers to account.”

He noted that Ms. dos Santos has recently become involved in the energy sector through her partnership with the Portuguese businessman, Américo Amorim and his company Amorim Enereria. Burgis wrote “I ask her to clarify how those energy interests tie in with Sonangol, the Angolan state-owned oil company with assets from Iraq to Brazil that some critics perceive as a Futungo fiefdom. She fends off my questions before fixing me with the look one might give a particularly vexing eight-year-old. “The business is relatively complex because, when you structure a business, you have to look at different aspects from legislation to taxation, to governance, issues like that.”

Near the end of their lunch Burgis asks the following question do you “call up the governor of the central bank and tell him what to do? “In which country?” she quips. We laugh merrily.” She went on to explain how she did have the reputation for extraordinary power. Burgis quoted her as saying, “Well, it’s very difficult, I would imagine, to distinguish father and daughter. And maybe some of it comes as I’m doing my thing and my father being a very strong political African figure for so many years. Whatever he does is almost like some kind of cloud on top,” she says, reaching for the right metaphor and waving a hand over her head, as though her father were some celestial phenomenon. “So maybe some of these ideas come from this cloud-over effect from his position. But, no, I don’t call the central bank and I most certainly don’t give them instructions.”

Even from the head feigns, non-responsive and jocular tone of many of these answers, one can see just how challenging doing business in Angola can be for any company subject to the Foreign Corrupt Practices Act (FCPA) or UK Bribery Act. The first issue that would seem to pop up is just who are you doing business with and are they a Politically Exposed Person (PEP). Burgis specifically states “top officials and generals have been known to take hidden stakes in ventures led by oil majors”. Whether such interests are hidden or not, it is the responsibility of any US or UK company to perform the appropriate level of due diligence to ascertain whether they are doing business with such governmental officials. I have heard more than one Chief Compliance Officer (CCO) say that they had to pull the plug on a business proposition because they could not determine the beneficial owners of an entity with which they were considering doing business.

What about a country such as Angola, where people move freely between government and business. Once again if it is later determined that your company is in a joint venture or other business relationship, and your local partner obtains a government appointment during the pendency of the business relationship, it is up to your company to find out that information. This requires ongoing monitoring through company or software which alerts you when someone moves to becoming a PEP.

This is where it is critical that compliance terms and conditions be put into a contract for any such business relationship. Initially, you should have contract protections in place which require any business partner who obtains a government appointment to notify you. This should also be included with a clause that allows the contract to be terminated if the appropriate anti-corruption/anti-bribery protections cannot be put in place if such an eventuality occurs.

Clearly there are no easy answers to the quandary of doing business in a country such as Angola. With many of the top government officials, energy company higher-ups and extractive mineral elite not only closely related to each other but moving seamlessly between all three groups; a company under the FCPA or Bribery Act must tread very carefully. Or to quote the signature line from Hill Street Blues, “Let’s be careful out there.”

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at

© Thomas R. Fox, 2013