2.0If there was one theme from Compliance Week 2016 it was the continued evolution of the Chief Compliance Officer (CCO) role and the compliance profession. Long gone are the days when someone is sent over from a legal department into the compliance department or worse, some lawyer who is just given the title of CCO and this is considered to be a best practice or even sufficient. In the opening keynote presentation, representatives from the Department of Justice (DOJ) and Securities and Exchange Commission (SEC) made clear they expect a CCO to know more than simply the laws of anti-corruption, they must actually work to do compliance in an organization. A key metric of doing compliance is the independence of the CCO and compliance function.

The conference was bookended by the keynote session “The Maturing of a Profession: The Rise of Compliance 2.0” which laid out the structural changes that have occurred for the CCO and compliance profession as a whole over the past 10 years or so. The starting point for the compliance profession was when the Sentencing Guidelines were made effective in the early 1990s. Because this function was borne out of essentially a criminal law enactment, in the form of the Sentencing Guidelines, it seemed to make sense at the time to respond with a legalistic approach such as having a General Counsel (GC) also be the CCO or having the compliance function in the legal department. The response to the accounting scandals of the early 2000s led to the passage of the Sarbanes-Oxley Act (SOX), which mandated more robust compliance programs, thereby enhancing the role of the CCO. There were later updates to the Sentencing Guidelines, which also helped to change the structure of compliance.

As with most legalistic approaches, such as those to the Sentencing Guidelines, it began by corporations setting out their internal rules and regulations; first in the form of a Code of Conduct and certainly after Opinion Release 04-02 in 2004 with the implementation of a written compliance program in the form of policies and procedures. Then training, incentives and punishments were put in place. Of course such an approach did not take into account third parties and perhaps that is why the majority of Foreign Corrupt Practices Act (FCPA) cases over the past 12 years have involved third parties.

Yet now the above structure is no longer sufficient. That is reason for the nomenclature of Compliance 2.0 as a true structural change has occurred moving the compliance function out from under the legal department and separating the CCO from the GC. What are the changes in this structural component? The final keynote of Compliance Week 2016 presented five key transformations.

  1. Empowerment

Here the CCO is empowered by charter or Board direction to carry out their duties. A CCO does not have to ask the GC for permission as they are more generally reporting directly to the Board or the Audit Committee of the Board. Further, the CCO position is now a senior corporate level role, often in the C-Suite. In the corporate world titles and position matter and if your position is seen as being on the level of the corporate brass it will give you more weight to carry the day.

  1. Independence

The key change here is the independence of the mandate of compliance from that of the legal department. The legal department has and always will exist to defend the company. It is asked to opine on whether a particular act is legal; in other words can we do it, not should we do it? The compliance function exists to prevent, detect and remediate problems, in other words fix things. The compliance function also differs from the legal function in that it has a non-discretionary escalation of issues through its unfiltered access to a company’s Board of Directors, through a direct reporting line.

  1. Seat at the table

Here the key is that compliance is seen as collaborative with legal and not subordinate. Yet this takes work and agreement by both legal and compliance to carve out their respective roles so that toes are not stepped on or even worse in the corporate world, feelings are not bruised. It also entails both the CCO and the compliance function being involved in the company’s strategic planning meetings so that compliance can be proactive and not simply reactive. Of course this means involvement in risk management meetings, operational reviews and budget reviews, as that is where the corporation sets its priorities.

  1. Line of sight

This is probably the biggest change in the structure of compliance. The CCO and compliance function should be able see into the business functions directly, not through the eyes or even the lens of the legal department. Yet it also means compliance should work towards an understanding through the integration of compliance risk areas for review, with unfettered access to information. It also means the business functions need to report up to compliance through regular reporting channels. Finally, all of this, by necessity requires the tearing down of silos so that compliance has visibility up and down the chain in this line of sight.

  1. Resources

As was made clear by both Andrew Weissmann from the DOJ and Stephen Cohen from the SEC in the opening keynote, the resources made available to the CCO and compliance function are becoming a more key metric for regulatory review. Fortunately this is also a key structural change moving to Compliance 2.0. Resources most generally mean two things: budget and head count.

For budgeting the change in Compliance 2.0 is that the compliance function has its own standalone budget, which should be sufficient to fulfill the compliance mandate. I think that it is beyond obvious to state that a strong compliance budget is always less expensive than a FCPA fine and penalty so the investment is sound. Head count is the corporate term for staffing but here it is more than simply bodies. It requires true subject matter experts (SMEs) either through professional experience or internal training. It also means compliance personnel reporting up to the CCO. If a company uses non-compliance department compliance champions, these folks should at least have dotted line reporting to the CCO.

I have laid out these structural changes in some detail so that you can benchmark your compliance program to see if there are gaps, which you might wish to remediate from a structural perspective. For those of you who did not feel there has not been enough evolution of the compliance function; not to worry as there is a lot more to talk about in Compliance 3.0. Stay tuned…

 

 

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2016

Chief-Compliance-OfficerAt the Opening Session of Compliance Week 2016, Stephen L. Cohen, Associate Director of Enforcement, Securities and Exchange Commission (SEC) and Andrew Weissmann, Chief of the Department of Justice (DOJ) Criminal Division’s Fraud Section, spoke about their views of what constitutes an effective compliance program under the Foreign Corrupt Practices Act (FCPA). Compliance Week’s Editor-in-Chief Bill Coffin moderated the panel. The majority of the discussion was around the Chief Compliance Officer (CCO) position; specifically the independence of the position, the authority the CCO has in an organization and the resources made available to the CCO.

Weissmann related that many presentations are made to the DOJ in the context of Filip Factors presentations, where a company generally presents evidence of the effectiveness of its compliance program at the time of the incident that led to the criminal investigation. He said that one of the things he thinks is important is how a CCO talks about the company’s compliance program.

He began by noting the initial straw poll showed that 65% of those responding to the first poll said their compliance program could probably pass DOJ muster or needs work. Weissmann viewed this as a positive sign because it demonstrated to him the ongoing evolution a company’s compliance program. He said he would often specifically delve into how a risk assessment had been done and then use that information as a springboard to inquire into whether it actually predicted the FCPA violation(s). It was not surprising to hear Weissmann basically say McNulty Maxim No. 3 (what did you do when you found out about it?) when he said that he would inquire into the company’s response and whether the response was then integrated that into the compliance function.

Cohen also said that he encourages CCOs to come and meet with him early in the SEC investigatory process. He did acknowledge that outside counsel usually hated the idea, obviously because they lose complete control, which they seek to maintain. Yet Cohen thinks that it helps him because it gives him a window into whom he is dealing with in the process. Additionally, as the CCO is generally more attuned to remediating problems, rather than simply protecting the company like outside counsel, a different view can often be obtained through such meetings. I would note from the CCO perspective, this is very valuable as it gives you the ability to begin to win an ally for your remediation program early on in the process.

One of the specific areas that Cohen wants to know about is what are the resources that have been made available to the CCO and what is the level of CCO independence? He is concerned about whether the CCO is appropriately valued and supported in the organization. He specifically asks if the CCO is on the Executive Leadership Team (ELT) or other top group of C-Suite executives. He would also inquire into whether the CCO had visibility into the transaction(s) that may have become the problem issue(s). Not necessarily whether there was a bribe authorized but if the transaction warranted someone violating the FCPA to get the deal done, did the compliance function have visibility into the matter? It is all Cohen’s way of trying to ascertain whether the CCO and compliance function have standing in company to get things done.

Weissmann was asked about individual liability for CCOs under the FCPA. I found this question propitious given my blog posts earlier this week. He said that the DOJ not going after CCOs for criminal liability unless they are a part of bribery scheme or some cover-up. He reiterated that the DOJ is trying to reduce the risk of criminality for violations under the FCPA and indeed that was one of their goals in hiring its new Compliance Counsel, Hui Chen. Chen enables the DOJ to be more robust in evaluating compliance programs of companies that come before the DOJ. He also noted that this new position works to heighten the power of CCO within companies as it gives them a specific advocate at the DOJ during enforcement actions.

Cohen took another approach to responding to the inquiry about CCO liability. He said that he believed there had been approximately 8000 SEC enforcement actions over past 10 years in regulated space involving CCOs. Of all of those cases, only five had involved individual liability actions brought against CCOs. These were along the lines of the FINRA action against Linda Busby I detailed yesterday, where the CCO had a clear regulatory responsibility to implement or enhance a compliance program and failed to do so. Cohen also made the point again that these five SEC enforcement actions were all in regulated industries only, not FCPA cases.

On the question of CCO independence, Weissmann believes this is one indicia of an effective compliance program. He reiterated yet again the DOJ’s stated position that it does not concern itself with whether the CCO reports to the General Counsel (GC) or reports independently, but he is more concerned about whether the CCO has the voice to go to the Chief Executive Officer (CEO) or Board of Directors directly, without going through the GC first. Even if the answer were yes, Weissmann would want to know if the CCO has ever exercised that right.

Finally, Weissmann turned to the operationalization of compliance. Echoing the remarks of the DOJ Compliance Counsel last fall, he wants to know if the if business unit of a company is responsible for at least a part of compliance. Put in the manner of Chen, is compliance operationalized within your organization? Weissmann had an interesting angle on the real problem for a CCO if compliance is not embedded into the business; that problem is that the CCO simply becomes a policeman, telling the business unit what it cannot do. Or as I would say, being Dr. No from the Land of No.

Cohen had several questions he would ask to determine the level of CCO independence within an organization. First and foremost, is the CCO a part of the senior management or the C-Suite? Is the CCO part of regular meetings of this group? He also wanted to know who could terminate the CCO so he might inquire to see if it was the CEO, the Audit Committee of the Board or did the CCO termination require approval of the entire Board? Most importantly, could a person under investigation or even scrutiny by the CCO fire the CCO? If the answer is yes, the CCO clearly does not have requisite independence.

In addition to the foregoing, Cohen had some additional questions he would consider. The first was who could over-rule the decision by a CCO within an organization? He would also inquire into who is making the decisions around salary and compensation for the CCO? Is it the CEO, the GC, the Audit Committee of the Board or some other person or group?

The remarks of Weissmann and Cohen demonstrated the continued evolution in the thinking of the DOJ and SEC around the CCO position and the compliance function. Their articulated inquiries can only strengthen the CCO position specifically and the compliance profession more generally. The more the DOJ and SEC talk about the independence of, coupled with resources being made available and authority concomitant with the CCO position, the more corporations will see it is directly in their interest to provide the position in their organizations.

 

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2016

7K0A0116Yesterday I began an exploration of the potential individual liability of a Chief Compliance Officer (CCO) based upon the Financial Industry Regulatory Authority (FINRA) enforcement action against Raymond James Inc. and its former CCO, Linda Busby. Today, I will consider the specific deficiencies laid out in the Letter of Acceptance, Waiver and Consent (Letter of Acceptance) and what lessons might be drawn going forward.

It is incumbent to note the basis of liability is FINRA Rule 3310, which requires the company to “develop and implement a written anti-money laundering program reasonably designed to achieve and monitor the member’s compliance with the requirements of the Bank Secrecy Act…” The required policies and procedures needed are to detect and report suspicious activity and monitor transactions for specified red flags. If such red flags were detected, additional investigation was required and any clearance of such a red flag required documentation. Some of the specifics of 3310 included appropriate due diligence on both customers and corresponding accounts for foreign financial institutions, a risk-based assessment of new clients and a review of red flags that might be raised in the above. Busby, as CCO, was required to implement the foregoing.

As noted yesterday, Busby was sorely understaffed, underfunded and probably could never have overseen a functioning and effective compliance program, had the company deigned to put one in place. However, the company obviously thought it did not have to do so. As noted in the Letter of Acceptance, the company “did not have a single written procedures manual describing AML procedures; rather to the extent written procedures existed addressing supervision related to AML, they were scattered through various departments.” Moreover, Busby did not have control or even oversight into individuals in other departments handing anti-money laundering (AML) issues. Finally, the company did not have any oversight for monitoring suspicious activity. The Letter of Acceptance noted these shortcomings were failures of both the company and Busby.

FINRA dived deeper into the weeds when it faulted both the company and Busby for not monitoring known high-risk transactions or individuals. The Letter of Acceptance listed high-risk activity as:

  • Transfers of funds to unrelated accounts without any apparent business purpose;
  • Journaling securities and cash between unrelated accounts for no apparent business purpose, particularly internal transfers of cash from customer accounts to employee or employee-related accounts; and
  • Movement of funds, by wire transfer or otherwise, from multiple accounts to the same third party account.
  • The company did not have any procedures “in place to reasonably monitor for high-risk incoming wire activity, such as third-party wires and wires received from known money laundering or high-risk jurisdictions.”

All of this meant that neither the company nor Busby were able to monitor or later investigate suspicious activity. FINRA turned up 513 accounts that engaged in high-risk activity that were never even spotted let alone investigated. There was no overall risk assessment performed which might have allowed Busby to marshal her limited resources and focus on the highest risk transactions. As you would expect there was no technological solution in place that allowed Busby to “conduct any trend or pattern analysis or otherwise combine information generated by the multiple reports to look for patterns”. All of Busby’s analysis had to be done the old fashioned way, through manual review.

While there were some reports generated by the company that might have been of use in an AML analysis, they were either deficient or not tied to similar reports. Even when the information was available there was no overall risk ranking for the company’s customers that would have allowed transaction monitoring on a more proactive basis. Finally, and this one is perhaps the most unbelievable, there was no linking of customer accounts so no pattern of single customer activity could be reviewed.

In addition to these overall AML program deficiencies, the Letter of Acceptance listed failures by Busby when sufficient information was available to her. There were thousands of alerts generated regarding suspicious activities each month that were closed out with no documentation as to the rationale for closing the suspicious activity alert. There was no documented clearance of red flags raised, even in the process the company did have in place.

The customer due diligence report was not even provided to Busby or the AML team but to the company’s credit department, one of those departments that Busby had no visibility into. When there was sufficient information to investigate customers, Busby and her team failed to do so and the Letter of Acceptance listed several instances where Busby failed to document that customers had been sanctioned by the US Department of the Treasury. The Letter of Acceptance laid out some useful indicia of suspicious transactions including (1) rounded dollar amounts; (2) purpose of payment inconsistent with the customer’s prior activities; (3) the domicile of the individual receiving the funds was not the location where the funds were transferred; (4) the Letter of Authorization provided to the company was dated at or near the date of transfer.

Finally, and to no doubt warm the heart of every process analysis and professional out there, FINRA criticized the lack of oversight. Busby was criticized for failing to engage in appropriate oversight of the company’s AML risk. But the company also failed in its oversight role of providing oversight to the CCO and the compliance function. If it had done so perhaps the company would have realized the impossible position Busby was in and the utterly impossible role she had to accomplish.

Fortunately for the Foreign Corrupt Practices Act (FCPA) compliance CCO, the financial services industry has specific rules that require compliance programs. Such regulations do not exist around the FCPA. However the analysis that FINRA used to bring charges against Busby could well bleed over to CCOs and compliance professionals in the future. With the new Department of Justice (DOJ) compliance counsel, the role of the CCO may be given more scrutiny going forward. It is painful to picture an anti-corruption CCO assessed with liability for a corporation which views compliance as poorly as did Raymond James but they are out there.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2016

IMG_1259Today, I continue my exploration with Joe Howell about the Public Accounting Oversight Board (PCAOB), its scrutiny of public company auditors and how its work impacts the corporate compliance function. Yesterday, I ended with a discussion about goodwill, how hard it may be to calculate, its impairment and what that might mean for a Chief Compliance Officer (CCO) and how difficult it is to test for both goodwill and a proper impairment calculation. Today I want to continue to explore why any write-downs are significant for the compliance function as it might be a mechanism to hide money to fund bribes and engage in corruption.

I asked Howell about write-downs and how they might be used to hide monies generated to fund a bribe, in the context of an acquisition. Howell noted, “anytime you have to calculate what that original value is, if you have a spin-off, if you have some sort of massive write-down, then they’re going to want to take a look at that to see, How did you do that write-down? Did you do it to dress up your balance sheet, to make it a little prettier because you got rid of some intangibles because you didn’t want to have them anymore for other purposes? Or there was some sort of thing that was out of the ordinary that you did? Then they really want to look at that to make sure that there’s support for it.”

I then inquired about joint ventures (JVs) and asked if the same or similar rules would apply. Howell began by noting that an audit is focused on the external financial statements for the company taken as a whole as presented to financial statements. While that statement is in the context of what the final opinion focuses upon, it is important to recall that an audit builds up from its parts.

That means an auditor must build up from any JVs a company has and these areas that have the opportunity to create misstatements, mistakes, or completely fraudulent statements. The issues can go so far as to include Enron type of concerns where the company used fraudulent accounting to get “bad stuff” off of their balance sheet. I asked Howell if you have a JV that has engaged in transactions that were based on fraud and the profits from that JV roll up into the parents, i.e. the US Corporation’s balance sheet, that would be an appropriate inquiry for an external auditor? He said “Absolutely. If an auditor finds fraud that’s not material to the financial statements taken as a whole, their job is not over. They don’t pass on stuff because it’s immaterial. If they find fraud, they’re obligated to report it. Also, that they find fraud, then they’re obligated to explore to see if the weaknesses and the controls that permitted that fraud are found elsewhere.”

One of the key inquiries from a Securities and Exchange Commission (SEC) Foreign Corrupt Practices Act (FCPA) investigation or enforcement action is around the issue of systemic failures of internal controls. Such failure is a sure remedy for the finding by the SEC for violation of the FCPA, even absent an affirmative finding of bribery. Howell said that a systemic inquiry from the auditing perspective is critical as well.

Howell said that if management is somehow involved in the colluding, then the auditors must “step back and take a hard look at what they’re going to be able to believe, if anything, that management has told them. If management is not involved and they have reason to believe that this is a bad actor somewhere in the organization, they’re not permitted to stop because it’s not material. They have to “move forward” with the inquiry.”

Interestingly, Howell not only draws a line from the FCPA to the Sarbanes-Oxley Act of 2002 (SOX) to the Dodd-Frank Act of 2010; but also draws a line from the PCAOB to corruption risk because of the pronouncements from the PCAOB about what the auditors have to look for in terms of risk. This is because he believes “every PCAOB inspection report to date has mentioned fraud. That the purpose of mentioning fraud is that the failures in the accounting control environment that permitted a transaction to go unreported or misreported are the kinds of things that undermine the entire credibility of the financial statements and mean that you’re not going to be able to rely on that control environment. Fraud is central to all of this.”

Howell went on to explain that fraud usually occurs because there are weaknesses in controls which are exploited by bad actors to get the money or the resources, if not money, to actually then pay a bribe that is the focus of the FCPA. The PCAOB’s focus on fraud is because the controls need to be in place and they focus on internal controls over financial reporting. Howell noted he has not seen any FCPA settlement that did not have a material impact on the company in one way or another. He concluded by stating, “how can you say that you’’re not dealing with material misstatements of the financial statements if you fail to report something that clearly is going to result in tens or hundreds of millions of dollars of penalties, disgorgement of profits, investigations, and tearing the company inside out in order to do the final remediation?”

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2016