Preparing for an FCPA investigation

Miriam G Bahcall and George Qi
[email protected] and [email protected]

An audit committee can best protect its company by mastering the relevant Foreign Corruption Practices Act (FCPA) facts before the Securities Exchange Commission (SEC) or the Department of Justice (DOJ) arrives on the scene. Knowledge is the best defence to the threat presented by a regulatory or criminal investigation. Regulators tend to punish companies that fail to promptly and vigorously investigate potential FCPA issues. They give credit to those that look into any surfaced issues, self-disclose any violations and genuinely attempt to remediate these issues. The FCPA is aimed at detecting and reporting wrongful conduct, therefore an internal investigation should be commenced immediately.

Audit committees take the lead

Given the potential for legal prosecution as well as reputational issues associated with an FCPA violation, FCPA investigations usually require active leadership by the audit committee. Normally, internal auditors or general counsel, assisted by external resources, look into the issues and report them to an audit committee. But the audit committee should take over the investigation when a conflict over managing the investigation or a possibility of exerting undue influence arises. In some cases, a special committee of independent directors may even be established to oversee the investigation. This can achieve an additional measure of independence and legitimacy, as FCPA allegations often implicate the senior management of a company and cause conflicts of interest. While some investigations can be adequately conducted internally, the potential materiality of FCPA violations and the complexity may require the use of external firms.

Scope of investigation

It is important to define the scope of an internal investigation at the outset – it must be comprehensive and thorough, but not excessive. An audit committee should carefully consider how credible the allegations are and establish a reasonable scope with external firms early on. In terms of thoroughness, it should be assumed that the result of the investigation will be shared with regulators to show that the company acted promptly and appropriately when it became aware of an internal issue. The scope of the investigation will depend heavily on the nature of the allegations and the circumstances of the company. Due to the unpredictable outcome of an investigation, an audit committee must also monitor the investigation as it proceeds, reaching judgments and tuning the scope accordingly.

Handling the results

Companies often seek to shield the findings by the attorney-client privilege or work-product doctrine because information leakage may lead to litigation against the companies or their officers and directors. An audit committee then needs to retain outside firms, who in turn retain other experts and consultants, since many countries do not attach the same legal protections to the work of in-house counsel as outside attorneys. In certain instances, counsels may deliberately decide against reducing the findings to writing. An audit committee may hear and receive a complete report of the investigation results without jeopardising any applicable privilege. If the results become the focus of regulators such as the SEC or DOJ, the dynamic changes – they may simply require access to the report regardless of the privilege. If denied access, they may either conduct their own investigations or simply bring charges.

In some cases, even before regulators get involved, an internal investigation may present an audit committee with the question of whether there is a requirement (or practical benefit) to self-report FCPA violations revealed by the internal investigation. Generally companies are often reluctant to notify regulators about internal investigations, particularly if the issue seems fairly minor. Even so, it may show serious FCPA violations that require notification. Regulators will then often allow the company to continue conducting the internal investigation but hold certain expectations. The SEC and DOJ will want a thorough, organised and properly-conducted investigation that adheres to standard practices in gathering documentary evidence, interviewing witnesses and using outside experts as appropriate. The government will review the investigation in close detail, question the conclusions reached, the evidence gathered, and hold in highest regard whether the investigating firm had the cooperation of management and was given full access to all of the information and personnel deemed necessary to conduct its investigation.

Always be alert

After the completion of an FCPA internal investigation, an audit committee is often closely involved in follow-up activities including terminating the misconduct and remediation. For example: discipline as appropriate; revise the code of conduct; review policies and procedures; modify internal controls. There may be years of active follow-up and periodic checks. While overseeing an investigation is undoubtedly demanding, managing one well from the beginning through the implementation of remedial measures can ultimately leave a company stronger than it was before.