Uncovering Improper Foreign Financial Practices, by Neal Hochberg, Senior Managing Director in FTI’s Forensic and Litigation Consulting segment and leader of the Investigations & Forensic Accounting practice, first appeared in Directors&Boards Boardroom Briefing, Summer 2007.
FCPA reporting rules require adequate board and auditor oversight of local entities and vigilant due diligence during acquisitions.
Johnson & Johnson, as part of its code of conduct/ corporate compliance responsibilities, recently issued a public mea culpa, disclosing to the public and federal oversight agencies that it discovered foreign subsidiaries "are believed to have made improper payments in connection with the sale of medical devices" in two countries. The executive in charge of its worldwide operations immediately retired. There was speculation of further staff changes and possibly large federal fines, and the company’s stock suffered a dip.
The situation for this New Jersey-based multinational company is not atypical. In fact, it happens frequently to U.S.-based corporations operating in the global marketplace. Multinational entities are facing a fastchanging environment in financial governance of their non-U.S.-based operations. The Foreign Corrupt Practices Act of 1977 (FCPA), coupled with increased U.S. government scrutiny and the Sarbanes-Oxley Act, is making it ever more important that corporate leaders enact tighter controls on their foreign entities’ financial practices.
Indeed, these controls often extend beyond the original intent of the FCPA to encompass related activities, such as financial reporting and due diligence in the pursuit of offshore mergers and acquisitions.
The FCPA has taken on increasing significance with post-Enron attention by government regulators and investors on corporate accounting practices. Congress passed the FCPA "to bring a halt to the bribery of foreign officials," according to the Department of Justice. Fines, jail time for corporate officers, and debarment from government contracting were among the penalties. In the 1990s, the law was amended to encompass accounting practices that support the anti-bribery provisions of the FCPA.
Thirty years after the law’s enactment, amid a new business atmosphere of globalization, questionable payment practices are still occurring worldwide. In many countries, what we would consider inappropriate financial behavior is simply business 101. As one international colleague recently commented to me, "There’s been no outbreak of honesty" in many parts of the world since the U.S. got fiscal religion.
The challenge today is for a company to successfully monitor and control the financial practices of their offices and subsidiaries in places far removed from its corporate headquarters. It is incumbent upon company leadership— especially the audit committee of the board of directors, the company’s general counsel and the chief financial officer—to address this difficult task.
Current safeguards inadequate
The most common attitude we encounter among corporate officials today is thinking that they have the problem "covered." This is a dangerous assumption.
Your firm may have the most sophisticated global accounting system available, but it might not provide enough protection because the technology might not be in use at the local level. Consider a firm in the Asia- Pacific region, whose headquarters is in Hong Kong or Singapore. That regional office may be overseeing local offices in half a dozen countries, and a country such as Indonesia might have multiple local locations. How far into that network do you think your SAP or Hyperion software is being used or being used correctly or completely?
We often find, when drilling down through those levels, that the local office in an emerging economy will be operating on a legacy cash accounting system. Financial records might be kept in a manual set of books or entered into a simple Excel spreadsheet. That data must be compiled and sent to a regional office, where it is compiled with other local offices and sent again to the division, where it is finally entered into your accounting system. I’ve seen regions that have six (6) to twenty (20) countries reporting to it, and each country has five (5) to thirty (30) local entities within it.
When a company has such multiple layers of disparate systems in use by offices in far-flung places, the difficulty of adequate oversight is extreme, and the potential for manipulation is very real.
Human interaction and cultural differences add another layer of challenge. How do you get goods through customs, or get corrupt local government officials to allow you to operate, without playing by the established "pay to play" rules? In some business cultures, providing "facilitation payments" to the underpaid local official is seen as no more inappropriate than tipping a restaurant waiter. Some people argue that in those places, you simply can’t do business otherwise.
In the U.S., we assume that long-term employees are more trustworthy, and our comfort level over their performance increases. But in some foreign localities, a long-time employee operating autonomously might act like he is the company’s owner, and think nothing of using company funds for himself or inappropriately disbursing them without approval. Following some distant orders on accountability and transparency would be unlikely, to put it mildly.
So, if your local representatives are doing something that is unethical or illegal by corporate standards or U.S. laws, how might that affect you? Besides the risk of legal action under the FCPA, which could result in fines and criminal indictments, there also are monetary and reputational risks to the entire enterprise. It would be wise to dig more deeply into how your corporate financial requirements are being implemented.
Sarbox and FCPA rules
It is well-known that Sarbanes- Oxley requires corporate officers to be responsible for establishing and maintaining internal controls, and that public disclosure must fairly present a company’s financial position. Also, disclosures must be made to the audit committee and the company auditor of all significant deficiencies in internal controls, or of any fraud that involves employees with significant roles in internal control. Most importantly, the board and its audit committee must cause senior management to "take timely and appropriate remedial action" for financial reporting deficiencies or problems, and someone must inform the SEC.
Layer upon those requirements the existing rules of the FCPA. The law requires companies to make and keep books, records and accounts which, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the company’s assets.
Further, the FCPA requires that a sufficient system of internal accounting controls be in place to provide reasonable assurances that:
- transactions are executed in accordance with management’s general and specific authorization;
- transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles or other criteria;
- and accountability of assets is maintained.
In addition, the law requires that access to assets is permitted only in accordance with management authorization, and that recorded accountability for assets is compared with existing assets at reasonable intervals, with management taking appropriate action with respect to any differences.
Questions and actions for the board
How does a company exert adequate control over all its worldwide legal entities to comply with this stringent set of rules?
Some common themes and practices are emerging among companies I’ve seen that are trying to fully address such questions. The actions include understanding the entire corporate structure, researching local management and adequately funding internal audit operations.
First, the board or its audit committee should be asking whether the multinational has global accounting and control systems. Are there global accounting procedures and operating manuals to accompany it, and are they disbursed throughout the organization?
Further, is the board aware of how many countries report to each operating region and, within each country, how many legal entities are reporting up to the country and regional levels?
Within those regions and local entities, does the board know how many accounting systems or practices are in place to support their activities?
How the information is reported from each office is equally important. How does the local information get combined and consolidated at the regional level? How does the regional information flow to company headquarters?
Second, awareness of local management is necessary, yet a difficult for the board and internal auditors to undertake. Who are the general managers and controllers actually running your business on the local level?
Sometimes getting a handle on your general managers takes more than just a look at employee files and financial information. Is the board aware of the background, experience and time of service to the company by its local staff? It might require some investigation to uncover the interrelationships those employees have with the "power people" in local government.
You must also be cognizant of the associations with strategic partners. In many areas of the world you need a joint venture partner in order to succeed. What value is added by that partner, and what are they doing that you should know about but might not know? Such a review might take some concentrated due diligence.
The third strand in your corporate web of protection against improper local financial practices comes from a solid review of your internal audit group. What is their role in addressing financial policies and reporting?
Internal auditors commonly have a responsibility for both financial and operational activities. However, in many cases, insufficient resources are devoted to a robust financial audit function. In companies with adequately funded internal audit teams, the focus very often is on manufacturing, distribution or other operational functions.
If U.S.-based multinationals are to thrive in an expanding global marketplace, it must be on the terms laid down by the laws and customs of their domicile, which means operating by U.S. rules. The alternative is to have the corporation’s fortunes and reputation damaged by the myriad, and oftimes illegal (under U.S. law) practices of the world’s emerging economies.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
