THE INTERNATIONAL IMPACT OF FRAUD THE UK BRIBERY ACT RAISING THE BAR ABOVE THE FOREIGN CORRUPT PRACTICES ACT The UK Bribery Act has an effective date of April 2011. Prior to this act, the U.S. Foreign Corrupt Practices Act was the boldest in compliance standards. The UK Bribery Act brings stronger initiatives into the anti-corruption arena, which will need to be addressed by companies and their officers. KENNETH YORMARK, CFE, CPA, CFF Director Navigant Consulting New York, New York Kenneth Yormark is a Director in the New York office of Navigant Consulting. Mr. Yormark brings over 25 years of experience in forensic accounting, anti-fraud assessments, financial investigations, and commercial litigation consulting. He has testified in deposition and at trial in Federal court. Mr. Yormark has worked with in-house and outside counsel in connection with internal investigations, complex litigation matters, and Foreign Corrupt Practices Act violations in both reactive and proactive environments. He specializes in validating and reconstructing fraudulent conveyances and assessing the vulnerability of management and accounting systems. Ken has led teams in matters related to accounting improprieties, FCPA investigations and compliance reviews, investigative due diligence, and crisis counseling. Prior to joining Navigant, Mr. Yormark served as practice leader of the forensic accounting practice for an international consulting firm. Mr. Yormark recently published Ponzi Schemes The Basics and Beyond in Financial Fraud Law. He has been quoted in publications including CFO Magazine, Baseline, Business Finance, Fraud Magazine, SMB Finance, and OpRisk & Compliance, and authored articles published in Metropolitan Corporate Counsel, The Journal of Investment Compliance, and Executive Counsel. He has appeared on BBC International s World Business Report, The McNeil Lehrer Business Hour, Fox Business News, and local Eyewitness News stations commenting on fraud matters. Ken was also seen worldwide discussing Ponzi schemes in a BBC documentary about Bernard Madoff. Mr. Yormark speaks nationally to corporate and industry groups on issues relating to forensic accounting, internal investigations, and anti-corruption matters. Association of Certified Fraud Examiners, Certified Fraud Examiner, CFE, ACFE, and the ACFE Logo are trademarks owned by the Association of Certified Fraud Examiners, Inc. 2011
Introduction On April 8, 2010, the UK Bribery Act received Royal Ascent. On March 30, 2011, guidance was presented for clarification on how it should be interpreted. On July 1, 2011, the Act will go into effect, leaving the United Kingdom with what many people believe is the strongest, most far reaching anti-corruption policy in the world. This document will review the Act and the guidance that has been provided to date. The Act establishes a statutory defense that organizations that have adequate procedures in place to prevent bribery are in a stronger position if isolated incidents have occurred in spite of their efforts. Adequate procedures for each individual company as determined through risk assessment is a major theme throughout the guidance. How Does the Act Define Bribery? Giving someone a financial or other advantage to encourage that person to perform their functions or activities improperly or to reward that person for having already done so. Seeking to influence a decision-maker by giving them some kind of extra benefit. The Act expressly prohibits the requesting, agreeing to receive, or accepting of a financial or other type of advantage. Requires that the bribe be paid to obtain or retain business, or an advantage in the conduct of business. 2011 1
When Could My Organization Be Liable? An associated person performs services for it like an employee or agent pays a bribe specifically to get business, keep business, or gain a business advantage for your organization. A very senior person in the organization commits a bribery offense. What Do I Need To Do To Rely on the Defense? Show that your organization had adequate procedures in place to prevent bribery. What counts as adequate will depend on the bribery risks you face and the nature, size, and complexity of your business. The Guidance Sets Out Six Principles by Which Adequate Procedures Will Be Evaluated 1. Proportionality 2. Top Level Commitment 3. Risk Assessment 4. Due Diligence 5. Communication 6. Monitoring and Review You might need to do more to prevent bribery if your organization is large, or if you are operating in an overseas market where bribery is known to be commonplace, compared to what you might do if your organization is small, or is operating in markets where bribery is not prevalent. Think about the bribery risks you might face. For example, you might want to do some research into the markets you operate in and the people you deal with. Knowing exactly who you are dealing with is essential. 2011 2
Communicating your policies and procedures to staff and to others who will perform services for you is important. The risk you face and the effectiveness of your procedures may change over time. Principle 1 Proportionate Procedures Procedures should be clear, practical, accessible, and effectively implemented and enforced. Bribery prevention policies, while proportionate to the organization s risks, should include certain common elements. The action you take should be proportionate to the risks you face and to the size of your business. Adequate bribery prevention procedures ought to be proportionate to the bribery risks that the organization faces. An initial assessment of risk across the organization is therefore a necessary first step. To a certain extent the level of risk will be linked to the size of the organization and the nature and complexity of its business, but size will not be the only determining factor. Some small organizations can face quite significant risks, and will need more extensive procedures than their counterparts facing limited risks. However, small organizations are unlikely to need procedures that are as extensive as those of a large multi-national organization. For example, a very small business may be able to rely heavily on periodic oral briefings to communicate its policies while a large one may need to rely on extensive written communication. The level of risk that organizations face will also vary with the type and nature of the persons associated with it. For example, a commercial organization that properly assesses that there is no risk of bribery on the part of one of its associated persons will accordingly require nothing in the way of procedures to prevent bribery in the context of that relationship. By the same 2011 3
token the bribery risks associated with reliance on a third-party agent representing a commercial organization in negotiations with foreign public officials may be assessed as significant and accordingly require much more in the way of procedures to mitigate those risks. Organizations are likely to need to select procedures to cover a broad range of risks but any consideration by a court in an individual case of the adequacy of procedures is likely necessarily to focus on those procedures designed to prevent bribery on the part of the associated person committing the offence in question. Bribery prevention procedures may be standalone or form part of wider guidance, for example on recruitment or on managing a tender process in public procurement. Whatever the chosen model, the procedures should seek to ensure there is a practical and realistic means of achieving the organization s stated anti-bribery policy objectives across all of the organization s functions. The Government recognizes that applying these procedures retrospectively to existing associated persons is more difficult, but this should be done over time, adopting a risk-based approach and with due allowance for what is practicable and the level of control over existing arrangements. Policies should be designed to mitigate identified risks as well as to prevent deliberate unethical conduct. Topics that bribery prevention procedures might embrace depending on the particular risks faced include: 2011 4
The provision of gifts, hospitality, and promotional expenditure; charitable and political donations; or demands for facilitation payments. Whistle blowing procedures. The detail of the process by which the organization plans to implement its bribery prevention procedures. The communication of the organization s policies and procedures, and training in their application. The monitoring, review, and evaluation of bribery prevention procedures. Direct and indirect employment procedures including recruitment, terms and conditions, disciplinary action, and remuneration. Governance of business relationships with all other associated persons, including pre- and postcontractual agreements. Financial and commercial controls, such as adequate bookkeeping, auditing, and approval of expenditure. Decision making, such as delegation of authority procedures, separation of functions, and the avoidance of conflicts of interest. Enforcement detailing discipline processes and sanctions for breaches of the organization s antibribery rules. The detail of the process by which the organization plans to implement its bribery prevention procedures, for example, how its policy will be applied to individual projects and to different parts of the organization. Principle 2 Top-Level Commitment Top-level management fosters a culture within the organization in which bribery is never acceptable. The 2011 5
message delivered should be that you do not tolerate bribery. Company should deliver statements reflecting: A commitment to carry out business fairly, honestly, and openly A commitment to zero tolerance towards bribery The consequences of breaching the policy for employees and managers In a large multi-national organization the board should be responsible for setting bribery prevention policies Tasking management to design, operate, and monitor bribery prevention procedures Keeping these policies and procedures under regular review Some of the elements that top-level management might consider are the following: Selection and training of senior managers to lead anti-bribery work where appropriate. Leadership on key measures such as a code of conduct. Endorsement of all bribery prevention related publications. Leadership in awareness raising and encouraging transparent dialogue throughout the organization so as to seek to ensure effective dissemination of antibribery policies and procedures to employees, subsidiaries, and associated persons, etc. Engagement with relevant associated persons and external bodies, such as sectoral organizations and the media, to help articulate the organization s policies. Specific involvement in high profile and critical decision making where appropriate. 2011 6
Assurance of risk assessment. General oversight of breaches of procedures and the owners, board of directors, or any other equivalent body or person foster a culture within the organization in which the bribery is never acceptable. A demonstrated commitment should include company delivered statements reflecting: For other associated persons the consequences of breaching contractual provisions relating to bribery prevention (this could include a reference to avoiding doing business with others who do not commit to doing business without bribery as a best practice objective) Articulation of the business benefits of rejecting bribery (reputational, customer, and business partner confidence) Reference to bribery prevention procedures the organization has or is putting in place (whistleblower hotline) Key individuals and departments involved in the development and implementation of the organization s bribery prevention procedures. Principle 3 Risk Assessment The organization assesses the nature and extent of its exposure to potential external and internal risks of bribery. The assessment is periodic, informed, and documented. Oversight of the risk assessment should be done by top level management. 2011 7
Appropriate resourcing This should reflect the scale of the organization s business and the need to identify and prioritize all relevant risks. Identification of the internal and external information sources that will enable risk to be assessed and reviewed is critical. Accurate and appropriate documentation of the risk assessment and its conclusions is necessary to have the adequate procedures for a defense. Commonly encountered risks that should be considered are as follows: External risks Geography/country Business sector Transaction risk Business opportunity risk Business partnership risk Internal factors Deficiencies in employee training, skills, and knowledge Bonus culture that rewards excessive risk taking Lack of clarity in the organization s policies on, and procedures for, hospitality and promotional expenditure, and political or charitable contributions Lack of clear financial controls Lack of a clear anti-bribery message from the toplevel management OTHER RISK FACTORS The value and duration of your project The kind of business you want to do The people you engage to do your business 2011 8
Steps you can take to assess and mitigate risks: Use Internet searches to find out about the levels of corruption or bribery in the particular country you propose to do business in. Consult UK diplomatic posts or UK Trade and Investment. Consult business representative bodies here and in the relevant country. Principle 4 Due Diligence The organization should take a proportionate and riskbased approach, in respect of persons who perform or will perform services for or on behalf of the organization. Principle 5 Communication Communication will vary enormously between organizations in accordance with the different bribery risks faced, size of the organization, and the scale and nature of its activities. Training should be proportionate to risk but some training is likely to be effective in firmly establishing an anti-bribery culture whatever the level of risk. Principle 6 Monitoring and Review Systems should be set up to deter, detect, and investigate bribery, and monitor the ethical quality of transactions, such as internal financial control mechanisms. Do I Need Complex Procedures in Place Even if There is No Risk? No, if there is very little risk of bribery being committed. 2011 9
Do I Need to do Due Diligence on All My Suppliers? Think about doing due diligence on persons who will actually perform services for you, on your behalf. How much due diligence you need to do will depend on your risk assessment. Controversial Areas You can continue to provide bona fide hospitality, promotional, or other business expenditure in your company. Likely to be acceptable if as under the FCPA: It is reasonable and bona fide; It is transparent; It is proportionate; and The organization has adequate procedures and policies in place to monitor and regulate the expenses. What About Facilitation Payments? The Act says that payments to induce officials to perform routine functions they are otherwise obligated to perform, are bribes. You can continue to pay for legally required administrative fees or fast-track services. The Guidance draws a distinction between large, repeated payments that are standard corporate practice versus small, one-off payments detected by the company s internal procedures. Prosecution is also said to be more likely where individuals faced with a request for such a payment fail to follow clear corporate procedures for the handling of such requests. 2011 10
Does the Bribery Act Apply to my Company? A company risks strict criminal liability for failing to prevent bribes if it carries on a business or part of a business in the UK, regardless of its place of incorporation or primary location. A company incorporated in the UK may be liable for improper payments made or authorized by its senior officials. There will be broader jurisdiction over a company that fails to prevent bribes being offered or paid on its behalf. UK authorities have indicated their intention to prosecute such offenses even where the improper payment has no connection of any kind to the UK. By contrast, the FCPA only applies to conduct by U.S. companies, citizens, or permanent residents, or where at least some of the alleged misconduct takes place in the U.S. Simply having a UK subsidiary would not, in itself, be sufficient to subject a parent company or its affiliates to the Bribery Act s jurisdiction, since a subsidiary may act independently of its parent or other group companies. How Does the Bribery Act Differ from the FCPA? The Bribery Act contains essentially all of the anti-bribery provisions of the FCPA. Differences include: Facilitation payments. The FCPA permits facilitation payments; the Bribery Act does not. The more lavish the hospitality or expenditure, the greater the inference that it is intended to encourage or reward performance or influence an official in violation of the Bribery Act. Lavishness is just one factor that may be taken into account in determining whether an offence has been committed, and prosecutors will 2011 11
evaluate each situation according to all the circumstances. The UK authorities remain anxious to give the impression that they will prosecute companies that make or fail to prevent facilitation payments, notwithstanding a few statements that appear to recognize the difficulties of doing business under certain circumstances without making such payments. Guidance indicates no flexibility with regard to such payments where commercial damage will result from a refusal to accede to a bribery demand. In remarks made at a conference in February 2011, Chris Walker, the head of policy for the Serious Fraud Office (SFO), posited a situation where two companies one U.S. company and one UK company build factories in a remote area of a developing country, and local officials demand facilitation payments to activate telephone service. In Mr. Walker s example, the U.S. company avails itself of the FCPA s exception for facilitation payments and pays a bribe to obtain telephone service, while the UK company, in accordance with the Bribery Act, refuses to do so, and its factory remains shut. Mr. Walker said that the SFO would carefully consider whether to prosecute the U.S. company in this situation, because the UK company had been disadvantaged. Mr. Walker explained that It is our intention to go after those individuals and corporations that have absolutely no intention whatsoever of living up to an anti-corruption culture, and want to use corruption to undercut good, clean companies. SFO authorities have reportedly made public statements to the effect that companies with policies that allow facilitation payments to be made under certain circumstances will not be seen as adequate for 2011 12
purposes of the Bribery Act, since the Act demands a zero tolerance approach. UK authorities have made plain their intention to prosecute those who make or permit such payments. Commercial bribery. The FCPA only prohibits improper payments to foreign government officials; the Bribery Act extends to bribery between private parties. Books and records. The FCPA contains accounting provisions; the Bribery Act does not. How Can My Company Avoid the Bribery Act s Provisions for Strict Criminal Liability? A company should establish that it has in place adequate procedures to prevent persons associated with it from paying bribes. The adequate procedures defense is to encourage companies to put procedures in place to prevent violations of the Bribery Act. Guidance states a single small payment may weigh against bringing charges or result in only a nominal penalty, significant consequences will result where there have been large or repeated payments Some Key Points This Act deals only with bribery not other forms of white collar crime. Your organization may be liable for failing to prevent a person from bribing on your behalf but only if that person performs services for you in business. There is a full defense if you can show you had adequate procedures in place to prevent bribery. 2011 13
Hospitality is not prohibited by the Act. Facilitation payments are prohibited by the Act. 2011 14