European Compliance Ethics Institute · business allow compliance and finance departments to have more oversight across different business units Raising the Standard of Anti‐Bribery

3/13/2015

1©2014 TRACE International, Inc.

©2015 TRACE International, Inc.Raising the Standard of Anti‐Bribery Compliance Worldwide

Anti‐bribery Compliance: What’s in Store for the Future

Severin Wirz

Director, TRACE Intn’l

European Compliance & Ethics Institute

March 31, 2015

Carolyn LindseySenior Intn’l Compliance Counsel, NBCUniversal

©2015 TRACE International, Inc.Raising the Standard of Anti‐Bribery Compliance Worldwide 23/13/2015

Overview

1. 2014‐2015: trends and predictions

2. Expectations and common pitfalls

3. The collective action model & standardizing best practices

4. Portable due diligence

3/13/2015


3©2014 TRACE International, Inc.Raising the Standard of Anti‐Bribery Compliance Worldwide

2014‐2015: trends and predictions

33/13/2015


2014 trends…

3/13/2015


©2015 TRACE International, Inc.Raising the Standard of Anti‐Bribery Compliance Worldwide 5

Anti‐Bribery Enforcement Trends

Over 100 companies are currently the subject of an ongoing and unresolved FCPA‐related investigation

Nearly 90 percent of FCPA cases involve conduct by 3rd parties All 2014 corporate resolutions involved allegations concerning third parties (such as distributors, channel partners, consultants, agents)

Travel, entertainment, and gifts remain perennial risks

Continued focus on individuals, including non‐US persons

Continued trend away from full‐blown compliance monitors

Evidence of new era of international cooperation


US Foreign Bribery Enforcement by Country of Headquarters: GER 2013

3/13/2015



Expectations and common pitfalls

73/13/2015


Anti‐Bribery Compliance: What’s Expected and Where Companies Commonly Go Wrong

Primary Expectations Clear tone from the top and effective communication to employees

A risk‐based approach, reasonably calculated to prevent wrongdoing

Third party due diligence

Internal controls

Internal disclosureprocedures

Periodic self‐evaluation

Common Pitfalls Failure to prioritize risk

Obsessing over small details

Failure to implement Gaps between policy and reality

Overly‐complicated procedures

Silos Between compliance/risk management/legal

Between compliance and business team

Poor documentation

Poor budgeting of resources

3/13/2015



Common Pitfalls: Alcatel‐Lucent Example

On December 27, 2010 Alcatel Lucent formally resolved investigations into FCPA violations in 13 different countries.

The company used third party consultants for the purpose of masking improper payments to government officials working at state‐owned companies.

The company paid combined monetary penalties of more than $137 million to the DOJ & SEC


Common Pitfalls: Alcatel‐Lucent

Altatel’s Internal Controls at the time

Alcatel conducted due diligence on 235 business consultants in more than 70 countries worldwide

However, in practice….

Employees responsible for reviewing DD reports did not speak language in which reports were written, and had little or no understanding of consultants’ background or work

Alcatel had a company‐wide FCPA training program

Alcatel had in place strict procedures for the drafting and amendment of consulting agreements

3rd parties began work for Alcatel before formal agreements were finalized (“gentlemen's agreements”) circumventing Alcatel Standard’s due diligence process.

Alcatel had a policy of “checks and balances” to authorize the retention of business consultants, which required several signatures to approve the retention of, and payment to, business consultants

Company policies were routinely ignored, with consultants often hired “off the books” and paid in cash

Company’s risk assessment committee failed to prioritize corruption risk and so issue was largely ignored

3/13/2015



Common Pitfalls (contn’d)

“Devoting a disproportionate amount of time policing modest entertainment and gift‐giving instead of focusing on large government bids, questionable payments to third‐party consultants, or excessive discounts to resellers and distributors may indicate that a company’s compliance program is ineffective.”

DOJ & SEC FCPA Resource Guide, 2012

Prioritizing Risks, 4 questions to ask:

1. What inherent risks exist at your company?

2. What mitigating controls are there to safeguard against these risks?

3. What residual risks remain?

4. Where should the company devote its resources?

©2014 TRACE International, Inc.Raising the Standard of Anti‐Bribery Compliance Worldwide ©2015 TRACE International, Inc.Raising the Standard of Anti‐Bribery Compliance Worldwide 12

Advantis PharmaAnti‐Corruption Heat Map

Controls against risk are immature

Controls against risk are mature and optimized

Inherent Likelihood of Non‐Compliance

LOWER HIGHER

HIG

HER

LOWER

HIG

H

MEDIUM

1

Consequence/Impact of Event

1. Direct official bribery by employees with company funds

2. Direct official bribery by company employees using charitable donations

3. Direct official bribery by company employees through political contributions

4. Indirect official bribery by third party agents

5. Successor liability for prior misconduct of acquired companies/JV partners

6. Excessive gifts/hospitality to government employees

7. Excessive/improper payment of travel expenses for government employees

8. Direct commercial bribery by company employees

9. Indirect commercial bribery by third party agents

10.Misleading books & records

MEDIU

M

Controls against risk are present but not optimized.

5

4

6

2

3

7

89

10

3/13/2015



A Working Compliance Program is More than the Sum of its Parts

Third party risk is NOT just about due diligence.

The consequences of compliance silos are unavoidable without an integrated, risk‐basedethics and compliance program.


A More Complex Solution is Sometimes Necessary

Previous NBCUniversal approach to third party due diligence for sales and distribution intermediaries: Commercial (non‐government facing intermediaries)

High risk

Low Risk

Government facing (highest risk)

Simple approach BUT too blunt for the businesses

Led to the creation of a more nuanced risk matrix that is operationalized by an online third party management system that allows different business units to share information on third parties.

3/13/2015



Sales and Distribution Risk Assessment


Sales and Distribution Risk Matrix

3/13/2015



The collective action model & standardizing best practices

173/13/2015


Collective Action in Compliance

Few things in the business world benefit from collaboration like compliance, particularly anti‐bribery compliance

Benefits of collective action in anti‐bribery compliance: Reduce silos

Set universal standards and establish best practices

Increase transparency of third parties and sharing of data

Decrease costs & duplication of efforts

Lower rate of extortion

3/13/2015



The global leader in anti‐bribery standard setting and shared‐cost compliance solutions

Hundreds of multinational members and thousands of intermediary members

Members representing all major industry sectors in over 150 countries

Local law guidance from over 135 partner law firms around the world

The primary organization that Fortune 500 companies rely on for anti‐bribery compliance guidance

193/13/2015

About TRACE

Raising the Standard of Anti-Bribery Compliance Worldwide


Collective Action in Practice: TRACE’s Online Training

Interactive, lively online training modules on anti‐bribery, avoiding trafficked labor and conflicts of interest for an unlimited number of your employees and third parties.

Available in 14 languages, with additional languages added upon request.

Administrative Dashboard to assign, and track training, including whether trainee received a passing score.

Customizable Platform with the ability to upload logos, policies and procedures.

3/13/2015



Silos: Gifts and Business Entertainment Example

Different business units working with the same customers, often government owned, and providing gifts and business entertainment

Individually amounts may be reasonable, but what about the cumulative value?

Online workflow tools and pre‐planning with the business allow compliance and finance departments to have more oversight across different business units


TRACE Gifts, Travel & Hospitality Tracking Software

User‐friendly tool for employees to enter details on any gifts, hospitality, and travel given or received.

Allows managers to track, analyze, and report on corporate gifts, travel, and hospitality.

Reveals trends in enterprise‐wide corporate hospitality practices with enhanced search functionality to identify compliance red flags.

Allows each company to tailor the site to its needs by customizing gift types, approval processes and other features.

3/13/2015



Portable Due Diligence

23

A New Approach to Due Diligence


Rising Costs of Third Party Due Diligence

Increasing number of international business partners

Third parties pose multitude of compliance risks, including anti‐bribery, privacy, trade sanctions, human trafficking, human rights, etc.

Third parties that want to embrace compliance are: Often confused about conflicting messages

Bombarded with multiple questionnaires‐ both within a single organization and between multiple organizations

Cumulative effect: expense & waste

3/13/2015



What is Portable Due Diligence?

“Portable” reporting represents an evolution in due diligence.

Third parties complete due diligence process – to a high standard – one time per year at the entity’s expense.

Portable due diligence helps companies realistically manage risk across thousands or tens of thousands of suppliers.


Portable Due Diligence Benefits

Shifts the burden of screening third parties away from companies.

Eliminates most of the expense and delay associated with the vetting process.

Enables third parties to share their verified due diligence information with all of their business partners.

Offers ongoing monitoring of third party relationships with daily screening of names against international sanctions and enforcement lists.

Provides certified intermediaries with a valuable business credential and companies with the confidence they are looking for in selecting business partners.

Simplifies third party recertification process for companies.

3/13/2015



Portable Due Diligence Solutions

Based on social media principles, this global online platform captures, assesses, and shares baseline due diligence information on organizations and individuals across complex supply chains and assigns a universal ID number (TRAC number) to all approved applicants.

A detailed review, analysis and approval process than enables candidates to own their verified due diligence reports. Candidates are required to complete a mandatory anti‐bribery online training course and update their due diligence information annually.

Together TRAC and TRACEcertification provide companies and their business partners with a practical and comprehensive

solution to supply chain compliance.


Who Uses TRAC?

• The TRAC holder company, entity, charity, or individual uses the TRAC system to demonstrate transparency and improve their efficiencymanaging compliance.

• Companies use the TRAC system to vet their supply chains and bring discipline to their procurement processby requiring partners and suppliers to obtain a TRAC.

• Banks use TRAC to meet their customer requirements.

• Companies and private equity firms for initial screen on acquisition targets.

• Other uses: identification program in aid programs, clinical trials, etc.

3/13/2015



What does a TRACEcertificationReport Include?

Red flags identified

Comprehensive anti‐bribery questionnaire

Company literature collected and reviewed

Business registrations

Names and CVs for owners, directors, and key employees

Contact information for three business references

Financial reference

A signed Anti‐Bribery Code of Conduct

Reputational screening


What does it mean to be TRACE Certified?

It means that you or your company have completed a comprehensive due diligence process administered by TRACE, the world’s leading anti‐bribery standard setting organization.

Certification by TRACE signifies that you have completed internationally accepted due diligence procedures and have been forthcoming and cooperative during the review process.

The successful completion of TRACEcertification demonstrates your commitment to commercial transparency, allowing you to serve as a valued business partner to multinational companies.

3/13/2015


Visit us online atwww.TRACEinternational.org

facebook.com/TRACEinternational

linkedin.com/company/TRACE‐international‐inc.

twitter.com/TRACE_inc

youtube.com/TRACEinternational


Annapolis • New York • Dubai • Manila

Questions?Contact: [email protected]

313/13/2015

Documents

European Compliance Ethics Institute · business allow compliance and finance departments to have more oversight across different business units Raising the Standard of Anti‐Bribery