Internal controls have had, and will increasingly have, a prominent role in global anti-bribery compliance. Under the Foreign Corrupt Practices Act (FCPA), the internal control provisions have been used as a “catch all” provision to address irregularities associated with issuers (foreign and domestic companies subject to the jurisdiction of the Securities and Exchange Commission (SEC)). Sarbanes-Oxley gave added impetus to the importance of the internal control provisions.
Unlike the anti-bribery provisions of the FCPA, the internal control provisions apply to foreign subsidiaries of issuers where the issuer has a majority interest or where the issuer may exercise effective control. Certainly, where the subsidiary’s financial statements are consolidated into an issuer’s financial statements, the SEC will have jurisdiction under the terms of the internal control provisions. Increasingly in recent years, the SEC has employed the internal control provisions as a vehicle to address improper payments to foreign officials.
In the United Kingdom, the Financial Services Authority (FSA) has employed a similar mechanism associated with internal controls to address improper payments to foreign officials. Under the FSA’s guiding principles, a firm subject to its jurisdiction are required to take “reasonable care to organize and control its affairs responsibly and effectively, with adequate risk management systems.” Under the FSA’s Senior Management Arrangements, Systems and Control – Rule 3.2.6: “A firm must take reasonable care to establish and maintain effective systems and controls for compliance with applicable requirements and standards under the regulatory system and for countering the risk that the firm might be used to further financial crime.” In a civil context, like the SEC’s enforcement of the internal control provisions of the FCPA, no proof of intent or an actual bribe is required. Only proof that systems and controls do not properly protect against such payments.
The settlements associated with Aon Corporation, a U.S. issuer, and its U.K. subsidiary, Aon Limited, are indicative of the overlap in these legal regimes. The U.K. subsidiary was assessed a fine of £5.25 million by the FSA for inadequate internal controls for a lack of due diligence and assessment of the risk of third parties, including a failure to monitor third parties in high risk areas, an absence of adequate training and guidance, and a failure to furnish adequate information to senior management with oversight responsibilities. The SEC fined the parent Aon Corporation $14.5 million for a number of FCPA violations, including internal controls for relying on generic terms as opposed to requiring specificity in records for payments to third parties and a lack of procedures taken to ensure that third-party payments were not made to foreign government officials.
Whether in the United States, or elsewhere, for attorneys, in-house counsel, accountants, and other providing advice on global anti-bribery issues, internal control issues always need to be kept in mind. Aside from exposing an entity to regulatory sanctions, they are essential to the success and viability of an effective compliance program.
