Compliance into the Weeds

The Mattis Memo on ethics is so significant that every CCO and compliance practitioner should read it and the Memo's substance into your compliance program.

Learn more about your ad choices. Visit megaphone.fm/adchoices

We consider the enforcement action around the issue of internal controls, their effectiveness (or lack thereof) and management over-ride of internal controls.

Learn more about your ad choices. Visit megaphone.fm/adchoices

In this episode, Matt Kelly and I take a deep dive into the Dodd-Frank and Sarbanes-Oxley reform initiatives in the House of Representatives and as articulated by incoming SEC Chairman Jay Clayton. Will the new administration gut SOX and Dodd-Frank compliance requirements? For more see Matt Kelly's blog post SEC Chair Clayton Talks Compliance Costs. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

In this episode, Matt Kelly and I discuss the recent Second Circuit Court of Appeals decision in HSBC v. Moore. In this case a federal district court had ordered the release of redacted monitor’s report in the HSBC money-laundering Deferred Prosecution Agreement (DPA), based upon the request of an interested citizen. Both the Department of Justice (DOJ) and HSBC appealed the order and the Court of Appeals supported their position in overturning the trial court’s decision. The case is about a hook, line and sinker overturning of any trial court jurisdiction as one can have. The district court tried to claim it did not have the same role as a “potted plant” but the Court of Appeals left no doubt that is the only role it sees for any district court where a DPA is filed. We discuss the implications for the compliance practitioner, FCPA enforcement and any potential changes going forward. 

For additional reading, see my blog post on this case by clicking  here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

In this episode, Matt Kelly and I take a deep dive into the 4th of July weekend use of the New Jersey beaches by Governor Chris Christie. Governor Christie had closed the beaches in a budget dispute but was still able, as Governor, to give himself and his family full access to the now wide open beaches on the recently passes holiday weekend. We consider Governor Christie’s example of undeserved privilege in the context of ethical leadership and tone at the top. Matt draws upon his Catholic school education to remind us that undeserved privilege is private law, as “privilege” comes from the Latin privus, private law; and lex, law. It’s a private law that benefits only one person, who doesn’t deserve it. 

Read more about the issue and Matt’s thoughts on his blog post  Tone at the Top Gone Wrong: The Christie Example.

Learn more about your ad choices. Visit megaphone.fm/adchoices

In this episode, Matt Kelly and I take a deep dive, literally into the weeds of the convergence of the compliance profession and the nascent cannabis industry. While several states have made pot for medical use legal and one state, Colorado has made it legal for personal consumption, it is still illegal under federal law. We consider such questions as:

Lawyers and accountants are required to report large cash transactions to the federal government—but large cash transactions are common in the cannabis industry, since commercial operators don’t have easy access to the banking system. So if you report one of these transactions, are you turning over evidence of illegal activities of your client to authorities? Or do you not report, and risk sanctions against yourself?If the Justice Department does act against a commercial weed business, will prosecutors really seek to impanel a federal grand jury, with jurors drawn from a state where they voted to legalize? Could prosecutors ask a candidate juror whether he or she smokes weed? Could that juror invoke the Fifth Amendment?Should lawyers be allowed to own equity in a legally operating marijuana business? What about judges? Do the two groups need different standards? Professional conduct rules for lawyers require competency in rendering legal advice. What does competency even look like in this branch of business conduct, when the laws are so new and in conflict with federal law?Will the nascence of the cannabis industry allow for innovations such as incorporation of blockchain to create fully auditable trails for all aspects of the business?Will any state which taxes cannabis sales be required to remit this money under a theory of profit disgorgement from funds generated by illegal activity.For more from Matt Kelly:

See his blog post  Compliance, Careers and Cannabis Industry;

Hear Matt Kelly’s interview with Amy McDougal (yes Matt has his own podcast as well-the Radical Compliance podcast) by clicking  here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

On June 16, 2017, the Department of Justice (DOJ) issued a Declination to Linde North American Inc. and Linde Gas North America LLC (collectively “Linde”). This is the first Declination issued by the DOJ in the era of the Trump Administration. For that reason alone, it was instructive and should be studied by the compliance profession. However, the case presented several interesting factors which merit consideration so we are discussing in depth to present lessons to be learned for the Chief Compliance Officer (CCO) or compliance practitioner.

Lessons Learned

This was yet another Foreign Corrupt Practices Act (FCPA) action where a company performed insufficient due diligence in the acquisition phase. The timing of the Linde purchase of Spectra Gases and Spectra Gases’ purchase of the income producing assets is too close in time to be a coincidence. It would certainly appear that Linde purchased Spectra Gases to facilitate its acquisition of the boron column and other assets. If your company is going to make such a multi-step acquisition, you must perform due diligence on all the actors and the assets involved.

The Byzantine corporate structure created for the ownership of the boron column, its operation and management contract are clear red flags that any CCO should sniff out immediately. While I am sure the internal corporate excuse for this clear ruse was the ubiquitous ‘tax considerations’; every such transaction should be reviewed by compliance as well. Anytime there is more than one entity to accomplish one task, there is the possibility of fraud present. Further, it is not clear how Linde could not have been aware of the ownership interests of a company which it ultimately controlled. It would seem that the company did not even make any inquiry.

Even in 2006, the Republic of Georgia’s reputation for bribery and corruption was quite high. The 2006 Transparency International-Corrupt Perceptions Index (TI-CPI) listed Georgia at 99 out of 176 countries listed so that alone warranted red flag scrutiny. If you are purchasing an entity in a country with such well known affinity for corruption, extra care is warranted. Perhaps back in 2006, Linde did not view the FCPA as something which it would deal with in such a situation.

Yet even with all the apparent miss-steps and non-steps of compliance, the company was able to secure a declination from the DOJ. While there may be some additional penalties or sanctions by the Securities and Exchange Commission (SEC) for the failures of internal controls, the result obtained by Linde was certainly a superior result. The company would seem to have met the four pillars under the FCPA Pilot Program through (a) self-disclosure, (b) extraordinary cooperation, (3) full remediation, and (d) profit disgorgement. Interestingly, the profit disgorgement in this case would appear to have been beyond the five year of limitations for profit disgorgement under the recent Supreme Court decision in Kokesh. If there is a FCPA enforcement action brought by the SEC perhaps additional facts will be recited in any resolution documents.

Nevertheless, kudos are due to Linde and its counsel for obtaining this declination. Every CCO should study it for both the superior result received and underlying facts to see if you face anything similar in the Republic of Georgia or elsewhere.

For a full copy of the Linde Declination, click here. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

In this episode, Matt Kelly and I take a deep dive into the corporate governance fiasco which is Uber. We consider the revelations in the failures of corporate governance, culture and internal controls at the organization. The company provides a fascinating study of what happens when a tech start up raised in the fraternity culture is successful and how changes are required for it to act like a multi-billion organization. Both Matt and I have written on Uber. Our podcast comes out the same day the Holder Report to the Uber Board was released so we weave in the recommendations from Covington & Burling as well. 

For more on Uber see the following: 

Matt Kelly’s piece  Car Crash Governance at Uber

Tom Fox’s pieces on Uber

 Will Culture Change at Uber Before its Too Late

 CEOs and Win at All Costs-Where Does it Lead

 Uber and Corporate Culture

For a copy of the Holder Report on corporate governance, cultural and internal controls failures at Uber and recommendations, click  here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

In this episode Matt Kelly and I take a deep dive into the revisions to the COSO ERM Framework, which were based on comments by practitioners. We consider the role of culture and risk, the integration of the COSO ERM Framework into functional business units moving to operationalize ERM in organizations and we consider how the ERM Framework differs yet is complimentary to the COSO Internal Controls Framework. 

For additional information, see Matt's Blogs posts on the COSO ERM Framework:

 More Details on COSO ERM Framework

 Update to COSO ERM Framework Update

 ERM Framework: Govt. Calls for Unity

 More Clues on Draft ERM Framework

 Draft ERM Framework is Here: How to Get Started

Learn more about your ad choices. Visit megaphone.fm/adchoices

In this episode Matt Kelly and I take a deep dive into the question of whether a company has a duty to disclose ransomware attacks. We consider it from the regulatory, legal, ethical, law enforcement, business, PR and some other angles. What may seem to be a straight-forward answer to a regulatory obligations turns out to be anything but. 

For additional research, see Matt Kelly's blogpost, "Ransomware: To Disclose or Not".

Learn more about your ad choices. Visit megaphone.fm/adchoices