Consequences for FCPA Compliance

Part Two of a Two-Part Article

Over the past year, most issuers have been preoccupied with the basics of Sarbanes-Oxley compliance, with the result that some of the subtler compliance implications have not yet been fully appreciated. However, as discussed last month, it is evident that the provisions of the Act will have implications for compliance in all substantive areas in which a company maintains a compliance program, but especially those having payment and financial dimensions, such as the FCPA Section 302, already mentioned in the disclosure discussion last month. Section 302 requires the periodic certifications to state that appropriate disclosures to the Board and auditors have been made with respect to significant deficiencies and material weaknesses in internal controls. Section 404 provides for each annual report of an issuer to contain an internal control report, and for attestation by the external auditors of management's internal control assessment. Section 406 requires a code of corporate ethics for senior financial officers, which is defined to include compliance with law obligations. Section 906 contains new criminal penalties for false certifications.

FCPA Compliance Implications

All of these provisions would appear to require issuers to devote increased attention to the development and maintenance of compliance programs, and internal accounting and other controls. They also will result in increased oversight of those programs.

Substantive auditing of FCPA compliance programs and procedures has always been an extremely difficult task. Because of the privilege implications and the legal complexities, leaving the task to auditors is not the ideal approach. However, auditors, internal and external, are well equipped to audit processes and spot deficiencies in them that can then be referred to legal personnel for substantive review. It is critical that companies review their audit cycles for foreign subsidiaries, develop, if they do not already have them, FCPA audit modules (and if they have them review them for best practices), and fine-tune their policies and procedures to comport with evolving FCPA compliance best practices.

Conclusion

The FCPA imposes compliance responsibilities on issuers with respect to the business practices, including potentially improper payments, of their foreign subsidiaries, as well as with respect to the accounting and internal controls of majority owned or controlled subsidiaries. In the wake of Sarbanes-Oxley, issuers need to redouble their efforts to maintain effective controls not only at the parent level but also in their foreign subsidiaries. Although prevention has its costs, the cost of an FCPA violation has always been much higher, and recent events have caused that cost to escalate even further. Now more than ever, Boards of Directors and audit committees will play a key role in internal corporate investigations involving potential improper payment issues abroad, and will exercise their business judgment in favor of making voluntary disclosure of FCPA violations.

Part Two of a Two-Part Article

Over the past year, most issuers have been preoccupied with the basics of Sarbanes-Oxley compliance, with the result that some of the subtler compliance implications have not yet been fully appreciated. However, as discussed last month, it is evident that the provisions of the Act will have implications for compliance in all substantive areas in which a company maintains a compliance program, but especially those having payment and financial dimensions, such as the FCPA Section 302, already mentioned in the disclosure discussion last month. Section 302 requires the periodic certifications to state that appropriate disclosures to the Board and auditors have been made with respect to significant deficiencies and material weaknesses in internal controls. Section 404 provides for each annual report of an issuer to contain an internal control report, and for attestation by the external auditors of management's internal control assessment. Section 406 requires a code of corporate ethics for senior financial officers, which is defined to include compliance with law obligations. Section 906 contains new criminal penalties for false certifications.

FCPA Compliance Implications

All of these provisions would appear to require issuers to devote increased attention to the development and maintenance of compliance programs, and internal accounting and other controls. They also will result in increased oversight of those programs.

Substantive auditing of FCPA compliance programs and procedures has always been an extremely difficult task. Because of the privilege implications and the legal complexities, leaving the task to auditors is not the ideal approach. However, auditors, internal and external, are well equipped to audit processes and spot deficiencies in them that can then be referred to legal personnel for substantive review. It is critical that companies review their audit cycles for foreign subsidiaries, develop, if they do not already have them, FCPA audit modules (and if they have them review them for best practices), and fine-tune their policies and procedures to comport with evolving FCPA compliance best practices.

Conclusion

The FCPA imposes compliance responsibilities on issuers with respect to the business practices, including potentially improper payments, of their foreign subsidiaries, as well as with respect to the accounting and internal controls of majority owned or controlled subsidiaries. In the wake of Sarbanes-Oxley, issuers need to redouble their efforts to maintain effective controls not only at the parent level but also in their foreign subsidiaries. Although prevention has its costs, the cost of an FCPA violation has always been much higher, and recent events have caused that cost to escalate even further. Now more than ever, Boards of Directors and audit committees will play a key role in internal corporate investigations involving potential improper payment issues abroad, and will exercise their business judgment in favor of making voluntary disclosure of FCPA violations.