Internal Controls: Stryker II – Failing to Adequately Implement and Enforce Policies and Procedures

The SEC’s resolution of a second enforcement action with Stryker corporation, a pharmaceutical device manufacturer, demonstrates the degree to which an entity’s failure to adequately implement and enforce its policies and procedure may in and of itself constitute a violation of the FCPA’s internal controls provisions.  It does not matter whether there may have actually been improper inducements to foreign officials under the FCPA’s anti-bribery provisions or any other anti-bribery legal regime.  Even after having been subject to a previous investigation and resolution in 2013 by the SEC for internal controls and record-keeping violations, Stryker failed sufficiently implement and enforce adequate internal controls¹

As outlined in the cease-and-desist order, Stryker policies

which applied to its global operations, prohibit bribery and other improper payments. As part of its internal accounting controls, the company had policies, which applied to its subsidiaries, requiring, among other things, proper documentation of transactions; written agreements with distributors and sub-distributors that included anti- corruption provisions and review rights to determine compliance; and due diligence and approval of, and anti-corruption training for, all distributors and sub-distributors.²

According to the cease-and-desist order, despite those policies, Stryker’s Indian subsidiary, Stryker India, failed to maintain adequate documentation with respect to 27 percent of “high risk” account.³  Even after Stryker became aware of overbilling associated its dealers of Stryker India, it failed to corrective action in detecting preventing the widespread practice of overbilling.⁴

“Stryker had in place certain internal accounting controls relating to third parties that limited transactions to those that complied with their contractual undertakings to adhere to Stryker’s anti-corruption policies and procedures.”⁵  However, Stryker’s China subsidiary, Stryker China, engaged in the use of “unauthorized sub-distributors” that had not been subject to these undertakings and thereby “increased the risk of improper payments in connection with the sale of Stryker products.”⁶  The cease-and-desist order found that “Stryker failed to sufficiently implement its policies to detect and prevent the use of these unauthorized sub-distributors in China in violation of the internal control provisions.⁷  The cease-and-desist order found that “Stryker’s failure to vet, approve, train, and monitor its distributors and sub-distributors in China in accordance with the company’s policies, increased the risk of bribery and other improper payments in connection with the sale of Stryker products.”⁸

In Kuwait, Stryker sold its products through a distributor.  As part of its distribution agreement with its Kuwaiti distributor, Stryker had audit rights to review records.⁹  Even after it received a complaint from a former employee of the distributor that bribes had been paid in connection with the sale of Stryker products, the audit rights were not exercised.¹⁰  Later, when Stryker learned that the distributor had made improper “per diem” payments to health care providers who had already been paid directly for their expenses to attend Stryker events, the distributor denied the audit rights of Stryker to access the records.¹¹  The cease-and-desist order found that “Stryker failed to implement its internal accounting controls to test or otherwise assess whether the Kuwait Distributor was complying with Stryker’s anti-corruption policies.”¹²

The cease-and-desist order suggests that issues associated with improper payments or inducements may have been a factor in prompting the investigation.¹³  Certainly, record-keeping violations were involved.¹⁴  But the overarching conclusion that may be drawn from the resolution is the importance of actually implementing and enforcing policies and procedures whether they be in the form of internal controls or as part of a compliance program.  Policies and procedures are insufficient if no one is actually engaged in ensuring that they are actually implemented and enforced.  Someone must always be actively “kicking the tires.”

_____________________

¹Order Instituting Cease-and-Desist Proceedings, at ¶ 10, In the Matter of Stryker Corporation, Administrative Proceeding File No. 3-18853 (Sept. 28, 2018).

²Id. at ¶ 2.

³Id. at ¶ 3.

⁴Id. at ¶ 5.

⁵Id. at ¶ 6.

⁶Id. at ¶ 22.

⁷Id. at ¶ 6.

⁸Id. at ¶ 22.

⁹Id.

¹⁰Id.

¹¹Id.

¹²Id.

¹³Id. at  ¶¶ 22-23.

¹⁴Id. at ¶ 27.