Minimizing the Prospect of Vicarious Liability for Actions of Third Parties

An entity must take steps to limit the prospect of being found vicariously liable for actions of an individual or entity acting on its behalf.  Ensuring that an individual or entity acting on its behalf complies with its policies and procedures is one of the greatest challenges for any entity. In particular, an entity should “consider the bribery and corruption risks posed by third parties used to win business.”¹  In addition to subjecting third-party relationships to “thorough due diligence,” the third-party relationships should be subject to “management oversight.”²

Behavior expected of employees and anyone acting on behalf of an entity should be clear as well the consequences of failing to meet those expectations.  An entity should set out “behaviour expected of those acting on its behalf.”³  In “contracts with third parties,” included should be “anti-bribery and corruption-specific clauses and appropriate protections.”⁴  Similarly, there should be “unambiguous consequences for breaches of the [entity]’s anti-corruption policy.”⁵  The consequences should be “commensurate with the violation” and “applied reliably and promptly.”⁶

An entity should assess the extent to which its agents comply with its anti-corruption policies and procedures.⁷  An entity’s compliance function should have “oversight of all third-party relationships and monitors [third-party relationships] to identify risk indicators.”⁸  A “risk-based approach” should “adopted to identify higher risk relationships in order to apply enhanced due diligence.”⁹  Compliance officials should be involved with “interviewing consultants and the provision of anti-bribery and corruption training to consultants.”¹⁰

Critically, adequate due diligence and ongoing monitoring should be conducted for individuals and entities acting on behalf of an entity.  “More robust due diligence on and monitoring of higher-risk third-party relationships” should be required.¹¹  “A ‘one size fits all’ approach to third-party due diligence” should be avoided.¹²  Indeed, there should be “higher, or extra, levels of due diligence and approval for high-risk third-party relationships.”¹³  “Enhanced due diligence procedures [should] include a review of the third-party’s own anti-bribery and corruption controls.”¹⁴   Moreover, “[t]hird-party relationships [should be] reviewed regularly and in sufficient detail to confirm that they are still necessary and appropriate to continue.”¹⁵

____________

¹Financial Conduct Authority, Financial Crime: A Guide for Firms (“FCA Guidance”), pt. 2, at 36 (Apr.  2015).

²Id., pt. 2, at 71.

³Id., pt. 1, at 60.

⁴Id., pt. 2, at 71.

⁵Id. (emphasis in original).

⁶U.S. Dept. of Justice & U.S. Sec. & Exch. Comm’n, A Resource Guide to the U.S. Foreign Corrupt Practices Act (“FCPA Guide”), at 59  (Nov. 2012 as updated 2016).

⁷FCA Guidance, supra note 1, pt. 1, at 60.

⁸Id.

⁹Id.

¹⁰Id.

¹¹Id., pt. 2, at 36.

¹²Id.

¹³Id., pt. 2, at 37.

¹⁴Id., pt. 2, at 71.

¹⁵Id.