Compliance & Ethics. Professional. Meet Paul J. McNulty Partner and Chair of Global Compliance, Baker and McKenzie, LLP 12 / Top stories inside

Transcription

1 Compliance & Ethics Professional Vol. 7 / No / 2010 A publication of the Society of Corporate Compliance and Ethics Top stories inside 4 Integrity earns trust 6 Travelers be aware: Common threats and tips to keep you secure 10 Slow road to export reform 12 What you don t know about high performance 21 After the Misconduct: Restoring morale and a culture of compliance 28 Ten reasons your compliance program is outdated 30 The evolving role of the chief compliance and ethics officer: A survey by SCCE and HCCA 32 Compliance and the Dodd-Frank Era: The case for engaging employees 42 Best Practices in anticorruption: The UK Bribery Act guidance Meet Paul J. McNulty Partner and Chair of Global Compliance, Baker and McKenzie, LLP

2 Compliance in the Dodd-Frank Era: The case for engaging employees By Patricia J. Villareal; Henry Klehm, III; and Richard C. Rosalez When President Obama signed the Dodd-Frank Wall Street Reform and Consumer Protection Act into law in July 2010, he ushered in sweeping reforms of financial regulation unseen since the New Deal. Although the Act is focused largely on increasing transparency and oversight of the financial services industry, some of the reforms reach every business organization subject to the federal securities laws. Although compliance and ethics programs are a comparatively recent development, corporations have relied on them to conduct business ethically, to prevent and detect violation of company policies and applicable laws, to protect the company s reputation, and to minimize burdensome and costly implications of non-compliance, including disruption of business and litigation. This article reviews the well known components of effective compliance programs, the key provisions of the Dodd-Frank Act that reach every public company, and some recommendations to enhance the effectiveness of compliance programs in light of the Dodd-Frank reforms. Virtually every model for an effective corporate compliance program starts at the same place: the US Federal Sentencing Guidelines. 1 Federal courts use the Guidelines when evaluating the effectiveness of the design and implementation of corporate ethics and compliance programs as they determine sentences for corporate criminal conduct. Of course, an effective compliance program should detect and prevent a wide range of misconduct that may not always also constitute criminal violations of law. Compliance encompasses civil law liabilities, industry-specific regulations, and individual corporate policies. Both the SEC and DOJ have established policies regarding enforcement decisions and sanctions that incentivize the implementation of an effective ethics and compliance program, selfpolicing, self-reporting, remediation and cooperation. 2 Typically, the issue of whether the program was effective or not plays a major role in reaching a resolution with the authorities when problems arise. Building a culture of compliance The Sentencing Guidelines outline elements of effective compliance and ethics programs. In describing those elements, the Guidelines articulate broad goals for programs. The organization must diligently prevent and detect criminal conduct and promote a corporate culture of ethical conduct and legal compliance. The programs must be reasonably designed, implemented, and enforced. The Guidelines recognize that any program will be incapable of preventing all criminal activity. The most comprehensive compliance program cannot stop an employee bent on committing a crime or violating industry regulations. Thus, a failure to prevent or detect an offense does not necessarily mean that the program is not generally effective. 3 The seven basic elements The Guidelines set forth basic requirements of any compliance and ethics program that encourages ethical conduct and a commitment to compliance with the law. 4 The seven elements are: 1. Prevention and Detection Businesses must establish processes to prevent and detect misconduct. Companies must take steps such as monitoring, auditing, and testing to ensure that their employees do not engage in misdeeds as they carry out their responsibilities. 2. Oversight The board must know how the program operates and oversee its implementation and effectiveness. The Guidelines require a high-level employee or employees be assigned responsibility for the program, typically a chief compliance officer (CCO) or Compliance Committee, and that the CCO or committee report to the board or a board committee. The responsible party must have adequate resources, appropriate 32 Compliance & Ethics Professional December

3 authority, and direct access to the board. 3. Qualified compliance officers The compliance program must include measures to exclude individuals of questionable integrity from doing business for or sometimes with the company. This requirement is practically implemented through employee, agent, and business partner screening to avoid individuals and entities with prior problems. 4. Training The company must train employees, and periodically communicate the components of its compliance and ethics program to all levels of the company. A corporation can make a much stronger case for having an effective compliance program if employees, officers, agents, and partners are regularly trained on compliance standards. 5. Evaluation and reporting systems The Guidelines call upon companies to evaluate the effectiveness of their programs, and to maintain and publicize a reporting system for violations, a.k.a., a hotline for reporting issues and complaints. The compliance officer should periodically report on the program s effectiveness to senior management and the board, and at times, use independent professionals to audit and test compliance processes and identify opportunities for improvement. In this day and age, hotlines are the preferred method of reporting conduct or seeking compliance and ethics advice. The hotline should allow for anonymity so that employees can use the system without fear of retaliation, regardless of whether that fear is real or not. Corporations should feature hotline information prominently in company literature, websites, and the work place. Information about the hotline should emphasize the availability of anonymity and the prohibition of retaliation. 6. Enforcement The sixth basic requirement is that the program be promoted and enforced consistently throughout the corporation. This must include appropriate discipline for engaging in or failing to prevent or detect criminal conduct. It is essential to enforce disciplinary standards uniformly, regardless of the revenue generating contribution of the offending employee. Some programs also provide incentives for ethical and compliant behavior. 7. Remediation When problems are found, the organization must take reasonable steps to respond appropriately to the conduct and to prevent further similar conduct, including modifying the company s compliance and ethics program. Recent amendments to Guidelines application notes state that a reasonable response may include remediation of any harm resulting from the misconduct, as well as self-reporting and cooperation with authorities. Ongoing assessment and improvement The Guidelines also include final instructions that companies must periodically assess the risk of criminal conduct and take appropriate steps to design, implement, or modify each of the seven basic elements. 5 Companies should regularly examine how they can make their program more effetive and implement the necessary modifications. The whistleblower provisions The Dodd-Frank Act s most significant compliance-related reform is the adoption of new whistleblower provisions. 6 The provisions were expressly designed to motivate those with inside knowledge to come forward and assist the Government to identify and prosecute persons who have violated the securities laws and recover money for victims of financial fraud. 7 Under the new provisions, the SEC must now pay bounties to whistleblowers for original information relating to possible violations of the federal securities laws that lead to a successful federal injunctive action or administrative proceeding brought by the SEC. The awards can range from 10% to 30% of all fines and penalties over one million dollars recovered in the enforcement action. 8 The whistleblower s information must be original, meaning information that (a) is derived from the independent knowledge or analysis of a whistleblower, (b) is not known to the SEC from any other source, and (c) is not exclusively derived from an allegation made in a judicial or administrative hearing, in a governmental report, hearing, audit or investigation, or from the news media. Individuals convicted of a criminal violation resulting from the conduct underlying the report to the SEC cannot qualify as whistleblowers but nearly everyone else can. Individuals who are involved in the conduct can report it and continued on page 34 December 2010 Compliance & Ethics Professional 33

4 Compliance in the Dodd-Frank Era: The case for engaging employees continued from page 33 collect an award if their reprimand falls short of a criminal conviction, undoubtedly a very strong motivator to resolve matters short of pleading guilty. Whistleblowers can be any individual or group of individuals who provide information regarding a securities violation. Notably, this means whistleblowers could be employees or third parties, including agents, consultants, partners, clients, suppliers, or competitors. Auditors, individuals who work for regulators, and anyone who knowingly provides false information is ineligible to receive a whistleblower award. With staggering financial settlements extracted from companies for securities violations, and the Foreign Corrupt Practices Act violations topping the list in recent years, potential whistleblowers are likely to weigh reporting possible misconduct in accordance with the company s compliance program against the potential financial rewards that may result by taking the information to the SEC. Hmm, what s the better deal? Call the hotline and hope for action, or call the SEC and cut a get out of jail free card? Companies should worry that the new whistleblower bounties will create a race to the regulators. The law will drive employees to provide information to the SEC rather than the company because the bounty is only available for original information. If the company learns of the information via a hotline report, the SEC s policies for rewarding self-reporting will provide strong incentives to alert the SEC of the possible problem. But, self-reporting carries its own risk, particularly if the company has limited time to develop the facts, understand the full extent of any problems, and weigh the never easy decision to self-report. Many companies will face the dilemma of self-reporting with incomplete information versus losing the benefits of self-reporting if a whistleblower beats the company to the SEC s doorstep. At the same time, it seems likely that the SEC may face a flood of less-than-reliable complaints from whistleblowers who wish to cash in with incomplete or inaccurate facts, or where the reported conduct is in fact legal, proper, or simply a human resources management matter. Worse yet, the prospect of a bounty may encourage employees to persist in concealing misconduct in hopes of reporting it at just the right moment when faced with an adverse employment action. Finally, will it be long before an employee chooses to by-pass a company hotline while investigating the matter to build a record for a report to the SEC? The potential payoffs are strong and, not surprisingly, plaintiffs law firms are actively seeking whistleblowers. Although the SEC has yet to promulgate rules governing awards, some parts of the process are clear. Whistleblowers may identify themselves or report anonymously to the SEC. Named whistleblowers may have counsel, and anonymous whistleblowers must be represented by counsel. The Act also protects whistleblowers from retaliation. Employers may not retaliate against employees for whistleblowing or assisting in an SEC investigation or other related action. The anti-retaliation provisions of the Dodd-Frank Act apply without regard to the validity or reasonableness of the complaint. This is greater protection than offered under Sarbanes-Oxley, where protection was only afforded when there was a reasonable belief that a violation occurred. 9 The lack of the reasonable belief standard appears to protect anyone who submits a report to the SEC, no matter how baseless it may be. And, at least one more theoretical compliance dilemma is posed by the retaliation protections. Public companies are required to establish and publish codes of conduct and ethics. 10 Those codes typically require employees to follow company policies, and some impose the obligation of promptly reporting suspected misconduct to the CCO or the hotline. In other contexts, not following company policies may be grounds for termination. Under the whistleblower provisions, however, an employee who fails to report misconduct through the company s compliance program when obliged to do so, and instead reports to the SEC, cannot be disciplined. Any retaliation will cost the company dearly. The Dodd-Frank Act provides the aggrieved whistleblower with the right to reinstatement, double back pay, and litigation costs, including attorneys fees. 11 Companies will need to address the issue of failing to report misconduct in compliance training materials, employee codes, handbooks, and employment contracts. The case for engaging employees In light of these risks and changes, compliance officers and 34 Compliance & Ethics Professional December

5 management must consider how they can maximize the effectiveness of their programs. Like all good compliance programs, it starts at the top. As part of instilling an appropriate culture of compliance, senior management should visibly encourage employees to use the company s resources before turning to the government. At every turn, management must drive supervisors to create an open environment for raising problems whether it is quality on the production line, employee safety, or financial reporting. Only through constant reiteration of the message will management commitment be successfully communicated. But, it has to be more than just communication. Management will have to create carrots and sticks. Supervisors who do a first-rate job of engaging employees and getting concerns surfaced should be rewarded and acknowledged. Likewise, those who do not measure up and discourage candor will need to learn new skills or suffer the consequences. Management s actions in this regard will significantly impact employee perception about the company s commitment to doing the right thing. Employee perceptions are also impacted by management s actions on day-to-day matters. If management takes aggressive positions on accounting policies or the interpretation of laws or regulations, how can it expect its employees to credibly believe it will react appropriately to employee concerns on the same subjects? When a corporation deliberately moves into a gray compliance area, human nature tells us that some employees will go along with suspect conduct. Others will not, and will now have powerful incentives to go outside the company and report their concerns to the government. The company s response to reported wrongdoing is also crucial. With the increased likelihood that individuals will report externally rather than to internal hotlines as a result of the whistleblower bounties, companies must be well equipped to conduct thorough investigations at a quicker pace, given the threat of the race to the SEC. Internal controls and hotline reporting should be tested regularly. If misconduct is discovered, regulators are certain to ask about the remediation that followed, including whether offenders were disciplined or terminated. Corporations may also consider creative ways to gather information and reward employees for following codes of conduct and reporting concerns internally. If a tip reported internally has merit, perhaps the employee should be entitled to a bonus or a bounty similar to what he/she would have been entitled to if they had reported it to the SEC. This may seem perverse for companies as they spend substantial sums to investigate either legitimate or frivolous claims of misconduct, but these costs are likely to pale in comparison to potential fines, penalties, and litigation costs that result when allegations are well-founded and reported to the authorities. Doing all this takes time and effort. When evaluating whether compliance programs are effectively designed, implemented, reviewed, and revised, or simply, whether they work, prosecutors consider whether the program has sufficient staff and resources given the company s size and complexity. 12 Preparing messages, creating training, revising supervisor performance standards, and making sure it is all working are resource-intensive activities, and almost certainly will require more than just the effort and resources of the Compliance department. Perhaps then, the pitfalls of the whistleblower provisions of the Dodd-Frank Act are best avoided with a broad-based employee engagement effort that begins with the board and senior management. The effort will take the combined efforts of the Compliance, Legal, Human Resources, and Audit departments to succeed in the short term and be sustainable in the long term. Conclusion The Dodd-Frank Act s whistleblower provisions were designed to alter how individuals and corporations respond to potential misconduct. Through effective compliance programs, corporations can take steps to reduce the increased risk of regulatory scrutiny that follows from an increase in whistleblower reports. A broad based and sustained effort to engage employees and foster transparency and open communication is likely to be the best method to avoid having to run the race to the doorstep of the SEC. Even if that race is ultimately lost though, the company s real effort will enhance credibility when a problem arises. A more robust employee engagement effort will bring more credibility to a continued on page 36 December 2010 Compliance & Ethics Professional 35

6 Compliance in the Dodd-Frank Era: The case for engaging employees continued from page 35 company s claims that its compliance and ethics program is effective. Editor s note: Patricia J. Villareal is a Partner in the Dallas law office of Jones Day, where she is global co-chair of the Securities Litigation and SEC Enforcement practice. Her practice focuses on representing public companies and their directors facing securities and corporate governance litigation, as well as advising boards and board committees in internal investigation and corporate governance matters. She may be contacted by at pjvillareal@jonesday.com. Henry Klehm, III is a Partner in the New York office of Jones Day, where he chairs the firm s Corporate Compliance Initiative and is a member of the Securities Litigation and SEC Enforcement practice. His practice focuses on regulatory examinations, investigations, enforcement actions, and other proceedings with United States and foreign regulators and on corporate governance matters. He is a former global head of compliance for an international investment bank and a Senior Associate Regional Director for the SEC. He may be contacted by at hklehm@ jonesday.com. Richard C. Rosalez is an Associate in the Dallas office of Jones Day, where he is a member of the Securities Litigation and SEC Enforcement practice. His practice focuses on representing and counseling public companies and their boards, board committees, officers, and other executives in investigations, enforcement actions, and litigation concerning securities and corporate governance matters. He may be contacted by at rcrosalez@ jonesday.com. Notes: 1 United States Sentencing Commission, Guidelines Manual (Nov. 2010). 2 Securities and Exchange Commission, Division of Enforcement, Enforcement Manual, (2010); United States Attorney Manual, Principles of Federal Prosecution of Business Organizations, (2008). 3 United States Sentencing Commission, Guidelines Manual, 8B2.1(a) (Nov. 2010). 4 Id. at 8B2.1(b) through 8B2.1(b)(7) 5 Id. at 8B2.1(c). 6 H.R. 4173, 111th Cong. 922(b) and 929A (2010). 7 S. Rep. No , at 110 (2010). 8 H.R. 4173, 111th Cong. 922(a) (2010). 9 The Sarbanes-Oxley Act of C.F.R (2005); NYSE Listed Company Manual, 303A.10; NASDAQ Rule 4350(n). 11 H.R. 4173, 111th Cong. 922(a) (2010). 12 United States Attorney Manual, Principles of Federal Prosecution of Business Organizations, comment. (2008). Put Your Job Listing in front of thousands of compliance professionals 200 words 90 days only $400 When you have a compliance position to fill, turn to the society of Corporate Compliance and Ethics to reach experienced compliance officers. Just fill out our simple online form, and we ll post your listing to our website, add it to our Twitter feed, and include it in our Career Opportunities newsletter. over 2,000 professionals visit our career opportunities webpage every month over 5,000 people follow our twitter jobs to Post a Job: 36 Compliance & Ethics Professional December