How to Perform a Corruption Risk Assessment

Special from :

How to Perform a Corruption Risk Assessment

Virtually every authoritative source of guidance on effective anti-corruption compliance emphasizes the importance of conducting a companywide “risk assessment.” For example, U.S. authorities have stressed with regard to the Foreign Corrupt Practices Act that “the assessment of risk is fundamental to developing a strong compliance program.”¹ U.K. authorities have similarly emphasized the importance of risk assessments as an essential component of developing “adequate procedures” under the Bribery Act, noting that “the fuller the understanding of bribery risks an organization faces, the more effective its efforts to prevent bribery are likely to be.”² The reasons for this are straightforward: To prevent a company’s involvement in bribery and corruption, compliance measures need to be positioned in a way that addresses the forms such conduct is likely to take.

Nevertheless, companies may be tempted to gloss over this step. Although a risk assessment can provide key information to those responsible for anti-corruption compliance, such an exercise is unlikely to have much visibility outside the company, and the failure to perform one may well go unnoticed. Yet without a clear vision of its particular corruption risks, a company’s compliance efforts may turn out to be needlessly costly and inefficient and, even more importantly, fail to provide the protection that the company hopes to obtain. Yogi Berra may have said it best: If you don’t know where you’re going, you might not get there.

Identifying Risks

Simply “having” a policy against bribery provides little or no protection from corruption-related problems. U.S. authorities say they have frequently encountered companies “with compliance programs that are strong on paper but that nevertheless have significant FCPA violations because management has failed to effectively implement the program.”³ The purpose of an anti-corruption compliance program is to “mitigate” or reduce the company’s risk of liability for improper conduct. A well-considered assessment of a company’s risks in this regard provides a solid foundation for these efforts. By identifying and evaluating its full range of corruption risks, a company is able to assure that it addresses key risks appropriately. Where risks are not identified, however, there may be gaps that leave certain exposures unmitigated.

Once a company’s risks relating to corrupt payments are identified, attention can focus on developing and implementing measures specifically aimed at addressing them. As the U.K. Ministry of Justice has noted, “the fuller the understanding of bribery risks an organization faces, the more effective its efforts to prevent bribery are likely to be.”

Prioritizing Risks

No company can devote unlimited resources to assuring that it complies with the law— (How to Perform A Corruption Risk Assessment - Law360 Page 1 of 5 http://www.law360.com/articles/432587/print?section=corporate 4/23/2013) and thus no compliance program can be perfect. Every company must make choices about where to apply its compliance efforts. As U.K. authorities have recognized: “No policies or procedures are capable of detecting and preventing all bribery. A risk-based approach will, however, serve to focus the effort where it is needed and will have most impact. ”⁴ By conducting a risk assessment, a company can calibrate its compliance efforts in a sensible manner, according to the levels of risk identified. These decisions require an understanding of both the likelihood that an improper payment may be made and what the consequences may be if a payment is made. By balancing these considerations, companies can allocate their compliance resources in a sensible and effective way and, through the exercise of examining risks and making such allocations, be in a better position to explain their actions should questions arise from regulators in the future. U.S. authorities have also sought to encourage this approach. The U.S. Department of Justice/U.S. Securities and Exchange Commission FCPA resource guide is particularly instructive on this point: One-size-fits-all compliance programs are generally ill-conceived and ineffectivebecause resources inevitably are spread too thin, with too much focus on low-risk markets and transactions to the detriment of high-risk areas. Devoting a disproportionate amount of time policing modest entertainment and gift-giving instead of focusing on large government bids, questionable payments to third-party consultants, or excessive discounts to resellers and distributors may indicate that a company’s compliance program is ineffective. A $50 million contract with a government agency in a high-risk country warrants greater scrutiny than modest and routine gifts and entertainment.⁵

Considering Sources of Corruption Risk

Corruption risks vary according to a number of different parameters, and these variations should inform and refine any risk assessment. The DOJ/SEC resource guide notes, in the context of due diligence, that: The degree of appropriate due diligence is fact-specific and should vary based on industry, country, size, and nature of the transaction, and the method and amount of third-party compensation. Factors to consider, for instance, include risks presented by: the country and industry sector, the business opportunity, potential business partners, level of involvement with governments, amount of government regulation and oversight, and exposure to customs and immigration in conducting business affairs.⁶

Similarly, U.K. authorities have identified several broad categories of common corruption risks.

• Country risk: As suggested by Transparency International’s corruption perception Index⁷, the likelihood of a bribe being requested or paid is greater in some jurisdictions than in others.

• Sectoral risk: Perhaps because of their relatively high exposure to obstruction by corrupt governmental authorities, some industries appear to face particularly significant corruption risks.

• Transaction risk: Some types of business transactions, such as obtaining public procurement projects, seeking necessary product approvals or licenses, and making charitable or political contributions, may expose a company to relatively greater risks that a corrupt payment will be requested or made. In addition, certain kinds of projects, such as high-value matters, or those that involve a large number of contractors and intermediaries, may present enhanced opportunities for corruption, as may projects that include elements not subject to meaningful market pricing.

• Relationship risk: Business relationships involving, for example, third-party intermediaries, sales agents, distributors or joint venture partners often carry relatively high corruption risks.⁸

Mapping the Company’s Risk Exposure

Much has been written about the need to identify, analyze and address the company’s specific corruption risks. This need not be particularly difficult, but it does require methodical consideration of at least several fundamental questions:

• Where might someone have an incentive to make an improper payment to accomplish a business objective? How likely is this to happen?

• Might some company personnel have more of an incentive than others to consider making an improper payment to achieve their business objectives, whether because of the nature of their responsibilities or the business environments in which they operate?

• If an employee or agent wanted to make an improper payment, what are the various ways they might seek to accomplish it? What obstacles would they currently face in trying to do that? How likely is it that they could do so without being detected? A variety of perspectives on these issues may prove particularly instructive, and a risk assessment may benefit from the participation by managers at various levels, as well as employees in sales, accounting, legal and compliance roles. Although every company’s operations are different, many companies are likely to consider the following issues.

Points of Contact with Government Officials

Improper payments to government officials are a primary focus of anti-corruption law enforcement and any violation of the FCPA will invariably involve a “government official” in some way. Thus, an important starting place would be to consider the various points of contact between company personnel (and those acting on behalf of the company) and government officials. Typically, these points of contact may involve the need to obtain various governmental approvals, the payment of taxes, or the import or export of various items. Similar risks may arise in doing business with government-owned or government- controlled entities.

Gifts, Entertainment and Similar Expenditures

Gifts and entertainment expenses are a common way either to convey an improper (How To Perform A Corruption Risk Assessment - Law360 Page 3 of 5 http://www.law360.com/articles/432587/print?section=corporate 4/23/2013) payment or to amass a “slush fund” that can be used for off-the-books payments. An evaluation of these risks would consider, among other things, the types of gifts and entertainment that are provided and to whom; the amount and frequency of such items; and whether management approval is required for certain of these expenses. Similar issues may arise with regard to promotional and marketing expenses, as well as in connection with charitable contributions or sponsorships by the company.

Internal Controls

A risk assessment would consider existing accounting controls over the use of cash and cash equivalents, as well as those in place to assure that assets are used according to management’s authorization and that transactions are recorded accurately.

Retention of Agents, Consultants and Other Third-Party Intermediaries

For many companies, the single greatest source of corruption risk relates to third parties retained to act on the company’s behalf, such as agents and other intermediaries. Among the things to be considered here are: What types of activities do these persons conduct on the company’s behalf? How are they selected? How are they compensated? Are background checks performed on them? Are appropriate anti-corruption provisions included in their retainer agreements?

Merger, Acquisition and Joint Venture Partners

The actions of these parties are generally not subject to the company’s control, but can nevertheless create substantial anti-corruption liabilities. A risk assessment would consider both the nature of the anti-corruption due diligence performed on these parties and the process for assuring that corruption risks are properly identified and evaluated.

Awareness of Company Personnel

How aware are company personnel of the company’s anti-corruption policies and procedures? What kind of training do they receive? How is that training and their attendance documented? Are some personnel selected for more intensive training? How likely are employees to recognize a corruption issue? How likely are they to raise any concerns they might have in this regard? Does the company have a means for employees to make anonymous reports if they so choose?

Compliance History

Consideration should be given to the company’s previous experiences with potentially improper payments, offers and requests for payment and any lessons that can be learned from these events, whether or not any wrongdoing proved to be involved.

Additional steps might be taken where companies face particularly high corruption risks,including more in-depth inquiries to understand and assess those risks, such as transaction testing of particular kinds of expenditures or transactions, or particular business locations, involving a review of supporting documentation and evaluation of compliance with anticorruption requirements.

Once a company has identified and evaluated its corruption risks, it can proceed to make informed and considered judgments about which risks to mitigate and how to do so.

A Dynamic Process: Periodic Review

While it is essential to undertake a corruption risk assessment when first designing and implementing an anti-corruption program, the value of such an exercise is not limited to that time period. Indeed, given the dynamic business and legal environments in which companies operate (including the growth of a business into new business lines and geographic regions), the nature of the corruption risks they face is likely to change over time, and periodic risk assessments will enable a company to identify any new key risks, and to better assure the ongoing effectiveness of its compliance efforts. Both U.S. and U.K. authorities have said that, in evaluating a company’s anti-corruption compliance efforts,they will consider the extent to which the programs are regularly reviewed and improved in light of these factors.

—By Matt T. Morley, Soren Lindstrom and Amy L Sommers; K&L Gates LLP

Matt Morley is a partner in K&L Gates’s Washington, D.C., office. Soren Lindstrom is a partner in the firm's Dallas office. Amy Sommers is a partner in the firm’s Shanghai office.The opinions expressed are those of the author and do not necessarily reflect the views of the firm, its clients, or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice.

¹A Resource Guide to the Foreign Corrupt Practices Act, published by the Criminal Division of the U.S. Department of Justice (DOJ) and the Enforcement Division of the U.S. Securities and Exchange Commission (SEC) (2012)(“DOJ/SEC Resource Guide”) at 58.

²The Bribery Act 2010 Guidance, issued by the U.K. Ministry of Justice (2011) at 25.

³DOJ/SEC Resource Guide at 57.

⁴Bribery Act Guidance at 7.

⁵DOJ/SEC Resource Guide at 58.

⁶DOJ/SEC Resource Guide at 59.

⁷ http://www.transparency.org/cpi2012/results

⁸Bribery Act Guidance at 26.

All Content © 2003 – 2013, Portfolio Media, Inc. Reprinted with permission.