Fighting Corruption: What Should Internal Auditors Do? Hans Nieuwlands CIA CGAP CCSA RA

International initiatives to combat bribery Agenda Laws and regulations What with is corruption/bribery? a global impact International initiatives to combat bribery Essentials of an Anti-bribery program Laws and regulations with a global impact Auditing an anti bribery Essentials program of an Anti-bribery program Auditing an Anti bribery program 2

What is corruption? Corruption is an insidious plague that has a wide range of corrosive effects on societies. It undermines democracy and the rule of law, leads to violations of human rights, distorts markets, erodes the quality of life and allows organized crime, terrorism and other threats to human security to flourish. [Kofi Annan, former UN Secretary General] 3

Definition of corruption Corruption is a form of dishonesty undertaken by a person entrusted with a position of authority, often to acquire personal benefit. [Source: Wikipedia] 4

Definition of bribery Bribery is the offering, promising, giving, accepting or soliciting of an advantage as an inducement for an action which is illegal or a breach of trust [Source: Transparency International] 5

Definition of bribery Bribery is the offering, promising, giving, accepting or soliciting of an advantage as an inducement for an action which is illegal or a breach of trust. [Source: Transparency International] 6

What is the difference? Corruption is often linked to bribing Public Officials Bribery includes corruption but also illegal transactions with other parties 7

International initiatives to combat bribery Laws and regulations with a global impact Essentials of an Anti-bribery program Auditing an anti bribery program International initiatives to combat bribery 8

International initiatives combating bribery 9

Organization for Economic Co-operation and Development (OECD) 1997: Adapted; 2009: Further recommendations 10

OECD Foreign Bribery Report 2014: Analysis of the crime of bribery of foreign public officials 1999-2014 427 foreign bribery cases 11

Whistleblower Media OECD Foreign Bribery Report How bribes were reported 3% 10% 7% Mutual legal assistance 18% Other 18% Law enforcement Self-report 44% 12

OECD Foreign Bribery Report How bribes were discovered Whistle blower 20% Other 10% Internal audit 37% M&A due diligence 33% 13

Proportion of bribes paid, per category STATE OWNED ENTERPRICE 80% HEAD OF STATE 7% MINISTER 4% DEFENSE OFFICIAL 3% CUSTOMS OFFICIAL 1% OTHER CATEGORIES 5% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 14

Payments of bribes by staff level MANAGEMENT 41% NON MANAGEMENT 22% CEO/PRESIDENT 12% THIRD PARTY AGENT 9% UNKNOWN 16% 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 15

Foreign Bribery Report Which sector was convicted the most for paying bribes? Construction Extractive Information/communication Transportation/storage 16

Foreign Bribery Report: Bribery per sector EXTRACTIVE 19% CONSTRUCTION TRANSPORATION AND STORAGE 15% 15% INFORMATION AND COMMUNICATION 10% MANUFACTORING HUMAN HEALTH 8% 8% OTHER 25% 0% 5% 10% 15% 20% 25% 30% 17

United Nations 2003: Convention against corruption Principle 10 of the UN Global Compact says that businesses should work gainst corruption in all its forms, including extortion and bribery Participants are not only to avoid bribery, extortion and other forms of corruption, but also to proactively develop policies and concrete programs to address corruption internally and within their supply chains. 18

Corruption Perception Index 20

Which country scores better on the CPI? A. Hong Kong B. United Arab Emirates C. United States of America 21

Which country scores better on the CPI? A. Hong Kong (12/180) B. United Arab Emirates (27/180) C. United States of America (15/180) 22

US Poll 2017 Corruption of US Institutions and groups PRESIDENT AND OFFICERS IN HIS OFFICE MEMBERS OF CONGRES GOVERNMENT OFFICIALS BUSINESS EXECUTIVES LOCAL GOVENMENTS RELIGIOUS LEADERS TAX OFFICIALS POLICE JUDGES AND MAGISTRATES 16% 23% 22% 21% 20% 33% 32% 38% 44% 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50% 23

Which country scores worse on the CPI? A. North Korea B. Venezuela C. Yemen 24

Which country scores worse on the CPI? A. North Korea (171/180) B. Venezuela (169/180) C. Yemen (175/180) 25

https://www.antibriberyguidance.org 26

ISO 37001 Anti-bribery management systems 27

ISO 37001 Anti-bribery management systems 28

International initiatives to combat bribery Laws and regulations with a global impact Essentials of an Anti-bribery program Auditing an anti bribery program Laws and regulations with a global impact 29

Foreign Corrupt Practices Act (1977) Prohibits individuals and businesses from bribing foreign government officials in order to obtain or retain business (antibribery provisions) Prohibits individuals and companies from knowingly falsifying the books and records or circumventing or failing to implement an issuer s system of internal controls (accounting provisions) 31

Jurisdiction The U.S. Foreign Corrupt Practices Act (FCPA): Applies to all companies that are required to file reports with SEC Applies also to any person acting on behalf of such companies Also applies to any individual who is a citizen, national, or resident of the U.S., or any corporation, partnership, association, joint-stock company, business trust, unincorporated organization, or sole proprietorship that is organized under the laws of the U.S. or that has its principal place of business in the United States 32

Sanctions Anti-bribery provisions: Companies: A fine of max. US$2 million for each violation Individuals, including officers, directors, stockholders, and agents of companies: A fine max. up to US$250,000 and imprisonment for up to five years Accounting provisions Companies: A fine of max. to US$25 million for each violation Individuals: A fine of max. to US$5 million and imprisonment for up to 20 years 33

Highest fines 1. Telia Company AB (Sweden): US$ 965 million in 2017. 2. Siemens (Germany): US$ 800 million in 2008. 3. VimpelCom (Netherlands) US$ 795 million in 2016. 4. Alstom (France): US$772 million in 2014. 5. KBR / Halliburton (U.S.): US$ 579 million in 2009. http://www.fcpablog.com/ 34

Longest sentences 1. Joel Esquenazi 180 months 2. William Jefferson 156 months 3. Charles Paul Edward Jumet 87 months 4. Carlos Rodriguez 84 months 5. Herbert Steindler 84 months http://www.fcpablog.com/ 36

An organization commits the offence if an associated person performing services on its behalf bribes another person in order to obtain or retain either business or a business advantage for the organization. 38

Jurisdiction A commercial organization will be liable to prosecution if a person associated with it bribes another person intending to obtain or retain business or an advantage in the conduct of business for that organization. A commercial organization can be liable for conduct amounting to an offence on the part of a person who is neither a U.K. national or resident in the U.K., nor a body incorporated or formed in the U.K. In addition it does not matter whether the acts or omissions which form part of the offence take part in the U.K. or elsewhere. 39

Offences and sanctions The Act introduces four categories of offences: Bribing another person Being bribed (as the recipient of the bribe) Bribing a foreign public official Failure to prevent bribery Individuals found guilty could face penalties up to imprisonment for max. 10 years, or to a fine, or to both. 40

Full defense The commercial organization will have a full defense if it can show that despite a particular case of bribery it nevertheless had adequate procedures in place to prevent persons associated with it from bribing. 41

Legislation in the Peoples Republic of China Anti-Unfair Competition Law of the PRC A business operator shall, in his market transactions, follow the principles of voluntariness, equality, fairness, honesty and credibility and observe the generally recognized business ethics. A business operator shall not resort to bribery, by offering money or goods or by any other means, in selling or purchasing commodities. A business operator refers to a legal person or any other economic organization or individual engaged in commodities marketing or profit-making services. 44

Legislation in the Peoples Republic of China Criminal Law of the PRC Applicable to foreigners, who outside PRC territory, commit crimes against the PRC state or against its citizens State personnel who take advantage of their office to demand money and things from other people or if they illegally accept money and things from other people and give favors to the latter are guilty of the crime of bribery 45

Legislation in the Peoples Republic of China Sanctions The highest penalty applies to individuals who have engaged in bribery with an amount of more than 100,000 yuan (US$ 16,000). Individuals are to be sentenced to more than 10 years of fixedterm imprisonment or life imprisonment and may, in addition, have their properties confiscated. In especially serious cases, those offenders are to be sentenced to death and, in addition, have their properties confiscated. 46

Legislation Which country has the highest penalties for bribery? Peoples Republic of China United Kingdom United States of America 47

International initiatives to combat bribery Laws and regulations with a global impact Essentials of an Anti-bribery program Auditing an anti bribery program Essential elements of an Anti-bribery program 48

Corporate values and tone at the top Living the Code Those at Manager level and above must lead by example, setting a strong tone from the top, showing they are familiar with the Principles and Code Policies and taking steps to embed a culture of integrity across all operations. [From: Unilever s Code of Business Principles and Code Policies] 49

Zero tolerance Our zero tolerance approach means we are committed to the mitigation, deterrence and detection of bribery and corruption. We do not and will not pay bribes or offer improper inducements to anyone for any purpose, nor do we or will we accept bribes or improper inducements or anything that could be perceived as such and expect the same from our clients. The ING zero tolerance principles to bribery and corruption also apply to third parties with whom ING does business or who are retained by ING to perform services or deliver business for and on behalf of ING. [From: ING s Orange Code] 50

We must: Ensure that our business partners and intermediaries are informed of our standards and are committed to respecting them specifically when they are representing us in a country where the risk of corruption is high Immediately inform our manager and our Country Manager if we become aware of any action that might be contrary to our corruption prevention policy 52

We must not: Offer, promise or give money, including a facilitation payment or anything of value (gifts, entertainment, etc.) to a representative of the public authority, political party or politician, trade union or person involved in trade unions Accept or solicit money or anything of value (gifts, entertainment, etc.) that might lead us to breach our duty of loyalty to L ORÉAL or be perceived as influencing a business relationship 53

Risk management Five main categories: Country risk Sectoral risk Transaction risk Business opportunity risk Business partnership risk 54

Example of high inherent bribery risks 55

Scoping of the Anti-bribery program Based on the Corporate values and the Code of Ethics Taking into account the outcome of the risk assessment Policies and Procedures Training Monitor compliance Define sanctions Speak up procedure Internal Controls and record keeping Monitoring and revision 56

Interactions with Public Officials Every organization has to deal with public officials In principle these interactions are considered to be normal unless they are prohibited by law or internal regulations Policies should state clearly that employees may not offer or provide any payment or other thing of value to a public official to secure an improper advantage Policies should clearly describe which payments are bona fide and which not 60

Interactions with Public Officials Some safeguards: Pay all costs directly to travel and lodging vendors and/or reimburse costs only upon presentation of a receipt Do not advance funds or pay for reimbursements in cash Ensure that expenses are limited to those that are necessary and reasonable Provide no additional compensation, allowances, or spending money beyond what is necessary to pay for actual expenses incurred [Source: FCPA Resource Guide] 61

Charitable donations/community investments Donations and community investments often linked to specific contracts, providing support to project-affected communities, resulting in a heightened bribery risk. They may be used to bribe of a public official or as a way to hide the trail to the ultimate beneficiary of the bribe. They also present opportunities for employees to make inflated donations or sponsorship fees and receive money back from the recipients as kickbacks. 62

http://thefightagainstcorruption.org/ http://thefightagainstcorruption.org/ 63

Business relationships Business relationships include partners, suppliers, contractors, agents, consultants, lobbyists and other intermediaries. The organization could be exposed to legal penalties and reputational damage for misconduct by third parties acting on behalf of operators that have a license agreement with the organization. Therefore, a business relationship with a potential third party should only be established or amended if the resulting relationship satisfies internal integrity due diligence. Sometimes third parties are being used to pay bribes which are not reflected in the organization s accounts. 64

From Pirelli s: Premium Integrity Program Pirelli s relationships with intermediaries and outsourcers are based on the following principles (selection): Pirelli examines and verifies the experience and technical expertise of these intermediaries, and asks that they declare that they have not been subject to investigations or court judgements related to corrupt practices The contracts are made in writing, in accordance with existing Pirelli standards, and contain specific clauses that are designed, inter alia, to enforce compliance by the counterparty with the anti-corruption commitments made by Pirelli. During their collaboration, the intermediaries and outsourcers are required to engage in business conduct consistent with Pirelli ethical principles. Violation of those principles may result in immediate termination of the contract. 65

Joint ventures and consortia The organization could be held liable for the corrupt behavior of a joint venture or other business partners. To reduce the risk a due diligence investigation should be done, including: The reputation of the operator of the joint venture The design of the operators management system/compliance program and its effectiveness The group s level of influence in the joint venture The audits/verifications performed on the joint venture, and The corruption risks faced by the joint venture 66

Agents, lobbyists and other intermediaries Agents, lobbyists and other intermediaries act as links between the organizations and a third party Lobbyists are intermediaries that represent the organization s interests by seeking to inform or influence decisions made by individuals in the public and private sectors Appointment only after a due diligence investigation Compensation for an intermediary must be justifiable and proportional to the (legitimate) service rendered Payments for services rendered may only be made against satisfactory documentation and must be accounted for 67

Agents, lobbyists and other intermediaries Agreement in writing and sufficiently describing the relationship between the parties Agreements to comply with the organization s anti-bribery program Requirement to keep proper books and records available for inspection by the organization, auditors or investigating authorities All agreements with agents, lobbyists or other intermediaries require prior approval of senior management and legal affairs Policies and procedures should ensure that no improper payments are channeled through agents, lobbyists or other intermediaries 68

Third Party Corruption Red Flags The third party has been subject to criminal enforcement actions or civil actions for acts suggesting illegal, improper or unethical conduct has a family relationship with a foreign official or government agency has an undisclosed beneficial owner insists on dealing with government officials without the participation of the company lacks experience or a track record with the product, service, field, or industry is not expected to perform substantial work requests an unusual advance or cash payments Says it needs payments to take care of things or finalize the deal [Source: FCPAméricas] 69

Suppliers and contractors Purchasing and contracting may have high bribery related risks Employees responsible may receive bribes and kickbacks from suppliers and in particular contractors Favoring some at the expense of others, e.g. by: - excluding the competition, or - providing sensitive information during a bidding process Bribes may be in the form of cash or other benefits, such as goods or a vacation trip paid by the supplier/contractor 70

From ABB s: Supplier Code of Conduct Business ethics You shall conduct your business in an ethical manner. In particular, you will Refrain from any and all forms of corruption, extortion and bribery, and specifically ensure that payments, gifts or other commitments to customers (including ABB employees), government officials and any other party are in compliance with applicable anti-bribery laws; Adhere to anti-trust and other competition laws Disclose to ABB information regarding potential conflicts of interest relating to your activities as an ABB supplier, including disclosure of any financial interest an ABB employee may hold in your business 71

Mergers and acquisitions 72

Mergers and Acquisitions M&A lead to an increased bribery risks arising out of contracts, misconduct, regulations, and statutes The successor company assumes the predecessor company s liabilities Inadequate due diligence may miss existing bribery practices, thus exposing the organization to civil and criminal liability When the due diligence reveals bribery it should be reported to the local authorities. New employees should be trained and (new) third parties being evaluated under the organization s anti-bribery program 73

Gifts and hospitality Gifts are a way to build and strengthen relationships that are essential to establish and maintain operations The organization should prohibit the offer, giving or receipt of gifts, hospitality or reimbursement of other expenses whenever they could influence or reasonably be perceived to influence improperly the outcome of business transactions Bona fide hospitality to improve the image of a commercial organization, better to present products and services, or establish cordial relations, is generally acceptable Disproportional gifts, such as fully paid travel to exotic locations without any obvious business purpose, are prohibited 74

From BT s: Gifts and hospitality policy You must not: Give or receive a gift or hospitality if it is intended to influence you or the person receiving it Give or receive lavish or extravagant gifts or hospitality which is, or may be seen to be, inappropriate in the circumstances. Think about whether a competitor or the press would consider it appropriate, reasonable and proportionate Give or receive gifts or hospitality if either you or the other person are involved in on-going commercial negotiations or could influence the decision Offer any gifts or hospitality where you know it would be wrong for the person to accept 75

Human Resources Maintaining a culture of integrity, including combating bribery, requires motivated and honest employees. HR play an important role by: helping to design the anti-bribery program recruiting integer employees discuss adherence to the Code of Conduct during the interview checking the background of all applicants providing training encourage the use of the a speak up (whistleblowing) program 76

Training Purpose is to learn how to identify and deal with ethics and bribery issues that employees may encounter Mandatory training should be developed for: - all new employees - management at all level - procurement, contracting and marketing - personnel interacting with Public Officials (e.g. licenses, permits and customs clearance) - personnel working in geographic areas with a high risk of corruption. HR monitors attendance to the training 77

Speaking up and seeking guidance The purpose of is to enable employees to report bribery incents and raise concerns about potential bribery and ask for guidance. Normally employees talk to their manager first Alternatively they can talk the compliance officer or use the 24/7 speak up channel (hotline) Anonymous reporting should be possible No sanctions for employees for making a good-faith report All reports of suspected violations should be taken seriously and followed up. Outcome of investigations should be communicated internally 78

From: BHP Billiton s Business Conduct Quick Test Feeling discomfort or difficulty when answering any of the questions indicates that you should speak to someone about your concern. 79

International initiatives to combat bribery Laws and regulations with a global impact Essentials of an Anti-bribery program Auditing an anti bribery program How to audit an Anti-bribery program 80

Scoping the audit Based on the identified bribery risks Decide to: Audit the anti-bribery program as a whole, Split it up, Included in the scope of every audit 81

Elements to be audited Values and tone at the top Code of Conduct Structure/completeness of the Anti-bribery program Bribery risk assessment Policies and procedures Internal Controls and record keeping Monitoring and revision Cooperation with authorities Independent assurance 82

Policies and procedures to be audited Conflicts of interest Interaction with Public Officials Small bribes Political contributions Charitable donations, community investments and sponsorships Associated business entities, joint ventures and consortia Mergers and acquisitions 83

Policies and procedures to be audited Agents, lobbyists and other intermediaries Suppliers Human Resources Training Whistleblowing and seeking guidance Communication 84

Audit techniques Desk research Review of (internal) documentation Interviews Surveys Transaction testing Analytical Testing Data analytics Observation 85

What else can Internal Audit do? Help to (re)design the Anti-bribery program Get involved in the training program Participate in the investigation of reported cases Include bribery aspects in every audit Use news items on corruption scandals to enhance risk awareness 86

Thank you for your attention! 87

First edition: Now in the bookstore! 88