In terms of FCPA compliance, implementation represents one of the most overlooked and challenging aspects of a compliance program, including, as is required, when a compliance program forms a critical part of an entity’s internal controls. The enunciation of policies and the drafting of written procedures can be carried out by a relatively few members of an entity’s staff or advisers, whether they be attorneys or other types of consultants. But the implementation of a compliance program is much more demanding as it requires more than simply support from management, it means the commitment of adequate resources.
The new Resource Guide to the U.S. Foreign Corrupt Practices Act points out that, in assessing whether an entity has reasonable internal controls, both the U.S. Department of Justice and the U.S. Securities and Exchange Commission will “typically consider whether the company devoted adequate staffing and resources to the compliance program given the size, structure, and risk profile of the business.” Adequate staffing and resources cannot be limited to compliance officials. To implement a compliance program, much more is required.
Key members of various units of an entity need to be assigned to assist in implementation and whatever follow-up may be required. For example, members of IT units may be needed for a period of time to help design software to facilitate the implementation of the policies and procedures. Key members of accounts payable unit may be required to assist in develop efficient and effective mechanisms to adequately vet third-party payments. Key members of sales units, particularly those working with agents in foreign settings, may also need to be involved in developing effective mechanisms to deter and detect improper practices. Quite simply, endless ways exist in which an entity may or may not provide adequate resources.
The expenditure of funds is not be the only factor in assessing whether good faith efforts have been employed. Effective implementation includes ensuring that the devotion of sufficient resources of key units of an entity are given appropriate priority. In the absence of an adequate commitment of resources from the relevant units within an entity, a compliance program is apt to be no more than an ineffective shell.
