Episode 205 -- How to Audit a Compliance Program

LRN continues to set the standard for ethics and compliance program research. Volkov Law is  a supporter of, and advocate for, LRN’s research because it has consistently confirmed what we all know and believe - ethical companies perform better in the marketplace over the long run. It is an intuitive fact that employees respond better to values-based leadership than a rules-based environment and culture. Volkov Law is committed to that mission with our clients, colleagues, partners, and thought leadership. In this Episode Michael Volkov discusses LRN's latest PEI Report, a copy of which can be obtained at https://lrn.com/resources/ethics-compliance-program-effectiveness-reportLRN's 2024 Program Effectiveness Report highlights the importance of corporate values, culture, and accountability in mitigating risks and maximizing financial performance.The report is based on a survey of over 1,400 ethics and compliance professionals from 19 countries and 26 industries.60% of organizations now incorporate ethical behavior into performance management, hiring decisions, promotions, and bonuses to elevate ethical conduct incentives.Top priorities for 2024 include training content, measuring ethical culture, improving web-based compliance resources, internal controls, and audit and compliance monitoring plans.Companies are adapting compliance programs to include remote and hybrid employees post-COVID-19, reflecting changing workplace needs.Senior management engagement in risk mitigation controls and company values is crucial, with 52% of respondents confirming actions over words in fulfilling ethics and compliance responsibilities.Nearly two-thirds of respondents stated their boards actively address misconduct by senior executives or excellent performers, relying on values to ensure ethical behavior.ResourcesMichael Volkov on LinkedIn | TwitterThe Volkov Law Group

On the heels of the Gunvor FCPA settlement for $661 million, DOJ announced its settlement with Trafigura, the latest commodities trading company to fall under DOJ's FCPA Sweep against the industry. Trafigura joined the list of international commodity trading companies to suffer FCPA enforcement actions like Vitol, Sargeant Marine, Glencore, Freepoint, and Gunvor.DOJ's corporate resolutions are connected to individual prosecutions and guilty pleas of 19 individuals, including six government officials, eight corrupt intermediaries, and five trading companies.Trafigura Beheer B.V. ("Trafigura"), based in Switzerland, plead guilty and agreed to pay $126 million as part of a plea agreement to resolve FCPA violations in Brazil. Trafigura pleaded guilty to conspiracy to violate the anti-bribery provisions of the FCPA and agreed to pay a fine of over $80 million and forfeiture of $46 million. DOJ agreed to credit up to $26 million of the fine against the amounts Trafigura pays to resolve an ongoing Brazil investigation.Trafigura, a global commodity trading company, pled guilty and agreed to pay $126 million to resolve FCPA violations in Brazil, involving a corrupt scheme to pay bribes to Brazilian officials to secure business with Petrobras.DOJ cited Trafigura's cooperation and acceptance of responsibility, including providing timely updates, facilitating employee interviews, and producing relevant documents, but criticized their failure to preserve and produce certain evidence in a timely manner.Trafigura's bribery scheme involved paying bribes to Petrobras officials from 2003 to 2014 to obtain and retain business, with payments ranging from 5 to 20 cents per barrel for oil transactions.The bribery payments were facilitated through offshore bank accounts, U.S. banks, and coded language in emails, with Trafigura entities earning approximately $51 million in profits from the scheme.DOJ's successful sweep of the commodities trading industry resulted in six corporate resolutions and 20 individual convictions, totaling over $1.7 billion in penalties, emphasizing the importance of robust compliance and surveillance strategies.Trafigura's lack of compliance oversight and failure to maintain proper third-party due diligence or risk management programs allowed the bribery scheme to operate with impunity, highlighting the need for enhanced controls and monitoring in high-risk industries.Despite the challenges faced during the investigation, Trafigura's guilty plea and cooperation with DOJ demonstrate a commitment to addressing corruption and compliance issues in the global commodity trading sector.ResourcesMichael Volkov on LinkedIn | TwitterThe Volkov Law Group

In a recent speech on March 7, 2024, Deputy Attorney General Monaco announced that, in the next 90 days, DOJ would implement a new whistleblower program to reward reporting of criminal misconduct at public and private companies. In particular, DOJ will encourage reporting of potential violations of the Foreign Corrupt Practices Act ("FCPA") and the recently enacted Foreign Extortion Prevention Act ("FEPA"). AAG Monaco noted that DOJ will be particularly interested in "foreign corruption cases" involving "non-issuers and violations of the recently enacted FEPA," along with criminal abuses of the United States financial system and domestic corruption cases.DAG Monaco also reiterated the importance of voluntary self-disclosures. DOJ employs a "mix of carrots and sticks" to incentivize companies to build stronger compliance programs that proactively mitigate risks and disclose misconduct to DOJ when appropriate. DAG Monaco underscored the fact that a corporate resolution "will always be more favorable with voluntary self-disclosure."In this episode, Michael Volkov discusses DOJ's new initiatives on whistleblowing and encouraging voluntary self-disclosures.DOJ's planned whistleblower program will significantly impact individual incentives to report financial misconduct and corporate decisions regarding voluntary self-disclosures.The program's focus extends beyond FCPA violations, encompassing other significant financial abuse schemes and potential reporting against non-issuer companies.Global companies are facing unprecedented risks and challenges in today's economy, leading them to prioritize robust ethics and compliance programs to promote positive corporate citizenship.The SEC whistleblower program has been successful, resulting in serious prosecutions and the derailment of fraudulent schemes. However, only around 10% of reports involve FCPA anti-bribery allegations.The Department of Justice recently announced its plan to create a whistleblower bounty program, which would fill gaps in existing programs and coordinate with voluntary self-disclosure policies.DOJ's whistleblower program will reward reporting of criminal misconduct at both public and private companies, encouraging reporting of potential violations of the FCPA and the Foreign Extortion Prevention Act.Companies are urged to disclose misconduct to earn valuable benefits, and the DOJ emphasizes the benefits of voluntary self-disclosure and cooperation to mitigate risks and maximize financial performance.ResourcesMichael Volkov on LinkedIn | TwitterThe Volkov Law Group

Boeing continues to struggle with its core business activities. As troubles mount for Boeing, it is clear that it continues to suffer from real and pervasive culture issues that have been reflected in serious safety failures, financial difficulties, regulatory violations, and serious reputational damage. Boeing's troubles permeate every part of its organization -- from the board to senior executives to its operations and overall ethics and compliance commitment. As a result, Boeing stands at an important crossroads -- will it make a real commitment to change, reform, and ethics and compliance, or will it continue to limp along, suffering repeated incidents of harm?In its latest (mis)adventure, Boeing fell victim to a State Department fine for $51 million for violations of a number of export controls, including basic licensing requirements for exports to China and Russia. Boeing voluntarily disclosed the violations to the Directorate of Defense Trade Controls ("DDTC") in the State Department.The violations of the International Traffic in Arms Regulations ("ITAR") included illegal exports to foreign employees and contractors who work in more than 15 countries, a trade compliance specialist fabricating an export license to illegally ship defense items abroad, and violations of the terms and conditions of other export licenses, among other things.The DDTC's $51 million penalty is the largest administrative penalty imposed for ITAR violations since it imposed a $79 million penalty against BAE Systems in 2011. Under the terms of the settlement, Boeing must pay $27 million to the DDTC within two years and use the remaining $24 million to improve its compliance program and procedures. In addition, Boeing is required to hire a DDTC-approved special compliance officer to oversee its compliance with ITAR for the next three years. That officer will regularly report to the DDTC on Boeing’s progress.Boeing faced a $51 million settlement for ITAR violations, including unauthorized exports and re-transfers to foreign employees and contractors, notably in China.Violations involved illegal downloads of ITAR-controlled technical data from Boeing's digital repository, which affected Pentagon platforms like the F-18, F-15, and F-22 aircraft and the AH-64 Apache helicopter.Boeing voluntarily disclosed violations to the Directorate of Defense Trade Controls (DDTC) and the State Department, leading to the $51 million penalty, the largest for ITAR violations since 2011.The settlement requires Boeing to pay the DDTC $27 million, improve its compliance program with the remaining $24 million, and hire a DDTC-approved special compliance officer for three years.Boeing must introduce a new automated export compliance system, update the State Department on its progress every six months, and undergo two export control audits by State Department-approved consultants.Despite the violations occurring mostly before 2020, Boeing made significant improvements to its trade compliance program, investigated issues, cooperated with authorities, and expressed regret.The case highlights the State Department and DDTC's aggressive enforcement of administrative controls over military items, signaling a broader crackdown on export control and sanctions violations.Resources:Michael Volkov on LinkedIn | TwitterThe Volkov Law Group

You have to give the Justice Department credit - after two slow enforcement years, DOJ is starting off 2024 with a relative "bang;" first, DOJ reached a large settlement with SAP in January, and now, DOJ has reached a blockbuster settlement with Gunvor S.A. for $661 million. Gunvor is one of the world's largest commodities trading companies. DOJ's settlement represents a "return" to its long-standing aggressive approach to FCPA enforcement. DOJ did not permit Gunvor to enter into a deferred or non-prosecution agreement. Instead, DOJ required Gunvor to plead guilty to one count of FCPA conspiracy. Following the plea agreement, the court sentenced Gunvor to pay a criminal monetary penalty of $374,560,071 and to forfeit $287,138,444 in ill-gotten gains. The sentence includes credits of up to one-quarter of the criminal fine each for amounts Gunvor pays to resolve investigations by Swiss and Ecuadorean authorities into the same misconduct so long as the payments are made within one year. The Office of the Attorney General of Switzerland simultaneously announced a parallel resolution of its investigation into Gunvor’s misconduct that involved the payment of approximately $98 million by Gunvor to Swiss authorities. Gunvor's conduct stretched over nearly a decade and involved systemic bribery payments to officials of the Ecuadorian Ministry of Hydrocarbons and Petroecuador, the Ecuadorian state-owned oil company, in exchange for valuable contracts to acquire oil products. In total, Gunvor earned more than $384 million in profits from the business it corruptly obtained related to Petroecuador. In this episode, Michael Volkov reviews the Gunvor FCPA settlement.Gunvor's recent $661 million FCPA settlement with DOJ for bribery in Ecuador signifies a return to aggressive enforcement. The plea agreement and forfeiture highlight the consequences of anti-corruption violations for global companies.Prior individual enforcement actions preceded Gunvor's corporate resolution, showcasing a pattern in FCPA cases. The company's cooperation, including document production and internal investigation, played a crucial role in the resolution.Gunvor's implementation of remedial measures post-bribery scheme reflects a commitment to compliance. Enhancements to ethics programs and controls demonstrate a proactive approach to mitigating risks and ensuring regulatory compliance.The bribery scheme involving corrupt third parties and shell companies underscores the importance of robust monitoring and due diligence. Gunvor's delayed response to red flags highlights the need for swift action in high-risk activities.Gunvor's cooperation with the investigation, including sharing facts and facilitating interviews, showcases a commitment to transparency and accountability. Collaboration with authorities is essential in resolving compliance issues and maintaining credibility.ResourcesMichael Volkov on LinkedIn | TwitterThe Volkov Law Group

Whatever the cause, criminal sanctions enforcement will be an interesting area in 2024. The DOJ's planned aggressive push against companies and individuals for sanctions violations is about to be unleashed. There is no question that DOJ's enforcement initiative is coming—it is just a question of when.We have already seen several examples of what aggressive sanctions enforcement will look like -- as the new "FCPA," we can expect several standard elements:Large Penalties -- multi hundreds of millions, even reaching billions in more egregious cases.Reward for Voluntary DisclosuresCriminal Indictments, Deferred or Non-Prosecution AgreementsIndependent Compliance MonitorsParallel Regulatory Resolutions with OFAC, BIS, and or DDTCEnhanced Compliance Remediation RequirementsIndividual Criminal EnforcementIn this episode, Michael Volkov reviews the soon-to-arrive sanctions enforcement regime, and steps companies should take to protect against enforcement actions. Hear him discuss:The Department of Justice (DOJ) is signaling a shift towards aggressive corporate sanctions and export control enforcement, particularly focusing on national security issues like sanctions and export controls. Recent cases, such as the British-American Tobacco and SAP cases, serve as examples of how the DOJ's sanctions-focused enforcement strategy is likely to unfold, including potential penalties and consequences that companies may face.Companies are facing risks from various sources in the realm of sanctions and export control enforcement, including regulatory referrals from agencies like OFAC, BIS, and DDTC, as well as international intelligence relationships and whistleblowers.Seagate's blatant violation of Huawei export controls could be a significant indicator of the DOJ's enforcement initiative in the sanctions arena. This case demonstrates the potential consequences of willful violations and the importance of compliance with export control regulations.Common deficiencies in sanctions compliance programs, including corporate boards' lack of understanding, failure to address third-party risks, inadequate supply chain audits, weak internal controls, and insufficient training, highlight areas where companies need to improve to ensure compliance with sanctions regulations.ResourcesMichael Volkov on LinkedIn | TwitterThe Volkov Law Group

Companies have a vested interest in preserving internal communications for a variety of reasons -- to hold actors accountable and to protect the organization from potential private and government claims or investigations that may have serious direct or collateral consequences. Companies that want to use ephemeral messaging systems can do so, but they have to understand the risks involved and tailor appropriate controls and procedures to avoid potential damage.DOJ's  Evaluation of Corporate Compliance Programs ("ECCP") released in March 2023 authorized companies to use ephemeral messaging but emphasized several important risk considerations and controls needed to preserve robust record-keeping requirements. DOJ's ECCP identifies three significant areas for consideration: employee use of personal devices, availability of communications platforms (e.g., Jabber, Slack, Teams, Google, Zoom), and messaging applications, including ephemeral messaging. DOJ's ECCP noted that a company's policies governing messaging applications "should be tailored to the corporation's risk profile and specific business needs and ensure that, as appropriate and to the greatest extent possible, business-related electronic data and communications are accessible and amenable to preservation by the company.")In this podcast, Michael Volkov and Eddie Green, CEO of SnippetSentry, discuss current communications preservation requirements and technical solutions to meet them.You’ll hear them discuss:Companies are rapidly embracing and elevating the importance of robust ethics and compliance programs to promote positive corporate citizenship. This shift reflects a growing awareness of the significance of ethical practices in today's business landscape.Eddie discusses the significance of preserving communications data in today's business landscape, given the evolving nature of communication technologies and the need for proactive data preservation strategies.SnippetSentry's service allows users to seamlessly connect their phones to ensure all texts are archived without altering their day-to-day operations, allowing integration of compliance measures seamlessly into existing workflows.The evolution of email preservation serves as a blueprint for understanding the importance of preserving text messages in modern business communication. Reflecting on past practices can provide valuable lessons for adapting to the changing landscape of communication data preservation.Compliance mandates, such as those set by the SEC, emphasize the necessity of preserving text records to ensure regulatory adherence and mitigate risks, underscoring the critical role of data preservation in maintaining transparency and accountability in business operations.The collaboration between compliance, IT, and information security professionals is crucial in developing policies and procedures to safeguard data and mitigate communication risks.Financial institutions and other industries are increasingly adopting sophisticated data preservation strategies to protect intellectual property and ensure regulatory compliance. This proactive stance reflects a growing recognition of the importance of data security and compliance in safeguarding business interests.ResourcesMichael Volkov on LinkedIn | TwitterThe Volkov Law GroupEddie Green on LinkedIn | SnippetSentry

In this special episode of Corruption, Crime, and Compliance, Michael Volkov joins colleague and long-time friend Tom Fox as they delve into the intricacies of recent FCPA enforcement actions, shedding light on the evolving landscape of corporate compliance. From the ABB case to the SAP settlement, Michael and Tom dissect the nuances of voluntary disclosure, extensive remediation, and the shifting priorities of the Department of Justice. Join them as they navigate the complexities of recidivism, cooperation, and the pivotal role of self-disclosure in today's compliance environment.You’ll hear them discuss:The Department of Justice (DOJ) faced a challenging situation with ABB, a three-time FCPA recidivist, raising questions about their enforcement actions and policies.ABB's case highlighted the importance of voluntary disclosure, extensive cooperation, and remediation in mitigating penalties and demonstrating commitment to compliance.The shift in DOJ's approach towards recidivism and self-disclosure signaled a new emphasis on data-driven compliance and the use of evidence to support remediation efforts.Albemarle and SAP cases showcased the significance of data-driven compliance programs and proactive measures to address compliance deficiencies.DOJ's focus on self-disclosure as a key factor in enforcement actions underscores the importance of transparency, cooperation, and timely reporting in compliance efforts.The evolution of DOJ's policies and enforcement strategies in 2023 reflected a balance between tough enforcement on recidivism and incentivizing self-disclosure through reduced penalties.The role of voluntary disclosure, remediation, and cooperation is critical in navigating FCPA enforcement actions and achieving favorable outcomes with the DOJ.ResourcesMichael Volkov on LinkedIn | TwitterThe Volkov Law GroupTom Fox on LinkedInCompliance Podcast Network

Christian Focacci is a leader in the artificial intelligence world and harnesses the capabilities for risk management. He is the founder and CEO of Threat.Digital, which has launched a new product DiligenAI.  Threat.Digital is leveraging large language models and real-time data feeds to empower organizations to identify risk information confidently and efficiently, setting a new standard in risk intelligence. Mike and Christian discuss AI and its use in compliance third-party risk management.You'll hear them discuss:AI should be viewed as a tool to enhance decision-making processes rather than a replacement for human judgment. It highlights the importance of leveraging AI to process vast amounts of data efficiently.Organizations must strike a balance between recognizing the risks associated with AI, such as generative AI, and harnessing its potential benefits to improve productivity and decision-making within organizations.Advancements in language models, particularly large language models like Chat GPT, have revolutionized the processing and understanding of unstructured text data, enabling more accurate and context-aware analysis.Companies can use AI to significantly enhance due diligence processes, risk assessment, and compliance efforts by efficiently summarizing and analyzing vast amounts of information to support decision-making.The use of AI in due diligence and compliance is a tool meant to empower human decision-makers by providing them with comprehensive and distilled information, allowing them to focus on critical analysis and decision-making rather than mundane tasks.One major strength of AI, particularly large language models, is to improve monitoring processes by reducing false positives and providing real-time alerts based on predefined criteria, enabling more efficient risk identification and management.AI has a bright future, including the expansion of context windows in language models, the rise of open-source models, and the potential for running AI models on personal devices, indicating a shift towards decentralized and accessible AI technology.ResourcesMichael Volkov on LinkedIn | TwitterThe Volkov Law GroupChristian Focacci on LinkedIn | Threat.Digital

On December 31, 2021, President Joseph R. Biden, Jr. signed the the Uyghur Forced Labor Prevention Act (“UFLPA”) into law to address the ongoing exploitation of the ethnic minority Uyghur population by the government of the People’s Republic of China (“PRC”). Among other things, the UFLPA creates a rebuttable presumption that all goods, wares, articles, and merchandise mined, produced, or manufactured wholly or in part in Xinjiang, or by entities designated for inclusion on the UFLPA Entity List, are prohibited from entry into the United States. To overcome the presumption, entities are required to demonstrate, by “clear and convincing evidence,” that such imports were not mined, produced, or manufactured in whole or in part by forced labor.In this episode, Mike and Alex discuss practical steps to comply with the UFLPA.The Uyghur Forced Labor Prevention Act, enacted by Congress, establishes a presumption that goods from Xinjiang are tied to forced labor. Importers must prove otherwise by providing extensive documentation, such as invoices, packing slips, and billing information, to demonstrate the origin of the goods and ensure compliance with the law.The UFLPA has led to a significant increase in enforcement by CBP, resulting in the detention of billions of dollars worth of commodities. This heightened scrutiny has prompted global companies to prioritize robust ethics and compliance programs to mitigate legal and economic risks associated with forced labor.Compliance with the UFLPA requires importers of record to furnish CBP with clear and convincing evidence that their goods were not produced using forced labor. This evidence includes supply chain tracing information, wage and payment records, credible audits, and attestations from every entity involved in the production process.Chinese entities have been known to employ deceptive practices to avoid detection and documentation requirements. This includes creating separate companies outside the Uyghur area and providing misleading information to purchasers. Due diligence and thorough investigation of beneficial ownership are crucial to ensure compliance.CBP's operational guidance for importers, published in 2022, provides essential information on navigating the complexities of the UFLPA. Importers should familiarize themselves with this guidance and engage in one-on-one discussions with their suppliers to communicate expectations and ensure compliance.The UFLPA places a significant burden on organizations relying on imports from China, as they must provide extensive documentation and meet the clear and convincing evidence standard. Failure to meet these requirements can result in the detention of goods, leading to supply chain disruptions and potential financial losses.Clear Channel, the former Chinese subsidiary of Clear Media, faced charges related to bribery violations. The bribes included expensive gifts, entertainment, and travel given to influence contract renewal negotiations with Chinese government officials. Clear Media engaged in deceptive practices, including falsifying payments and creating false invoices, to fund these illegal payments.ResourcesAlex Cotoia on LinkedIn | EmailMichael Volkov on LinkedIn | TwitterThe Volkov Law Group