Prison Professors

ComplianceMitigation.com

Previous modules offered insights we believe leaders should consider when designing an effective compliance program and risk-management strategy for their organizations. The more leaders customize their compliance and best-practice programs, the better they safeguard against intrusive investigations that could threaten the business and its team members.

Regardless of what efforts team members make to protect a company, possibilities always exist for a breakdown, or for a rogue team member that could expose the organization to liability. For that reason, all companies should create a plan that would coordinate a team response in the event of an inquiry from regulators or law enforcement.

Lack of Planning Brings Vulnerabilities:

In the absence of a structured response plan, team members may not know what to do if they learn that authority figures have taken an interest in the company or in a team member. Sometimes, leaders act rashly. People have gone to prison for their response to a government investigation, rather than for the underlying reasons behind the inquiry.

Consider the case of the famous celebrity, Martha Stewart. Many people are familiar with her brand, which sells household products. In 2001, however, a personal scandal over a stock sale completely disrupted her life. Her response to a government inquiry led to criminal charges.

According to the U.S. Securities and Exchange Commission, in late December 2001, her stockbroker at Merrill Lynch, Peter Baconovic, called her. Peter revealed that Sam Waksal, the CEO of ImClone Systems had placed an order to sell all of his shares in his company as a result of an adverse decision by the Food and Drug Administration. In response, Martha sold approximately 4,000 shares that she owned, avoiding losses of more than $45,000.

When government investigators began making inquiries, Martha did not have a good plan. The responses she gave to the government investigators resulted in criminal charges. The fees and costs associated with the disruption likely exceeded several million dollars. Besides losing money for legal costs, Martha's response to the investigation led to a prison term, a shareholder derivative suit against Martha Stewart and other directors at her company, and five months in prison. With a felony conviction, Martha endured lifelong complications, including bans on travel to some countries.

Clearly, Martha Stewart did not have a principled plan that would guide her response to a government inquiry. Sadly, many people find themselves in the same predicament. Those who operate businesses without designing a response plan for government inquiries may leave themselves vulnerable to knee-jerk reactions that can exacerbate troubles.

A lack of a plan can lead to confusion during the first few hours, days and weeks of an inquiry. The unfolding drama can distract team members, as everyone may worry about personal liability. If people don't know what to do, they may make futile attempts at self-preservation, such as destroying incriminating evidence, or lying to government investigators. Either response would expose the individual, and potentially others, to criminal charges.

Risk Management:

A good response plan will ensure that all team members have guidelines to follow. Whether government regulators inquire about business operations or potential fraud, everyone should know what steps to take. To protect both the business and the team members, corporate leaders should articulate the appropriate protocol any time an investigator makes an inquiry.

• Does everyone in your organization know how to respond in the event that an investigator asks a question?

Leaders can easily get an answer to that question by creating a plan. Then, they should create a training exercise for all team members. The more transparency leaders bring to an investigation-response plan, the more they will strengthen arguments that the organization has made a genuine effort to act in compliance with all regulations and laws.

Point for business leaders to consider:

• Regulators and judges are increasingly asking not just whether a company has an anti-fraud, anti-money laundering, or corporate ethics policy in place. They are also asking how well such programs work and whether their quality and results make sense. They are asking, in other words, how good are they? This trend raises the stakes for those charged with governance.

An example of an effective "anti-fraud policy" may prove helpful to business leaders that want to create an organizational-specific plan. Our team at Compliance Mitigation offers the following as a template:

1. INTRODUCTION

• Our company (the "Company") has a commitment to high legal, ethical and moral standards. We expect all members of staff to share this commitment. The Board of Directors tries to ensure that a risk (and fraud) awareness culture exists in this organization. Fraud is an ever-present threat and hence must be a concern to all members of staff. Our Company views fraud as an extremely serious matter and is committed to the promotion of an Anti-Fraud Culture throughout the
• We created this document to provide direction and help to those who find themselves having to deal with suspected cases of theft, fraud or corruption. This document gives a framework for a response, advice and information on various aspects and implications of an investigation. It is not intended to provide direction on prevention of
• This Policy applies to any irregularity, or suspected irregularity, involving employees as well as consultants, vendors, contractors, customers and/or any other parties having a business relationship with the Company. Any investigative activity required will be conducted without regard to any person's relationship to this organization, position or length of service. All managers and supervisors have a duty to familiarize themselves with the types of improprieties that might be expected to occur within their areas of responsibility and to be alert for any indications of

2. DEFINITIONS – WHAT IS FRAUD?

• We define Fraud as "dishonestly obtaining an advantage, avoiding an obligation or causing a loss to another party." The term "fraud" commonly includes activities such as theft, corruption, conspiracy, embezzlement, deception, bribery and extortion. It may involve:
  • manipulation, falsification or alteration of records or documents;
  • suppression or omission of the effects of transactions from records or documents;
  • recording of transactions without substance;
  • misappropriation (theft) or willful destruction or loss of assets including cash; and
  • deliberate misapplication of accounting or other regulations or
• The criminal act is the attempt to deceive, and attempted fraud is therefore treated as seriously as accomplished
• Computer fraud arises where information technology equipment has been used to manipulate programs or data dishonestly (for example, by altering, substituting or destroying records, or creating spurious records), or where the use of an IT system was a material factor in the perpetration of fraud. Theft or fraudulent use of computer time and resources is included in this definition.
• Some illustrations of incidents which would be classified as fraud are contained in Appendix A to this

3. PURPOSE OF THE FRAUD RESPONSE PLAN

• The purpose of the Fraud Response Plan (the "Plan") is to ensure that effective and timely action is taken in the event of a fraud. The Plan aims to help minimize losses, reduce liability and increase the chances of a successful
• The Plan defines authority levels, responsibilities for action, and reporting lines in the event of a suspected fraud or irregularity. It acts as a checklist of actions and a guide to follow in the event of fraud being suspected. The Plan is designed to enable the Company to:
  • prevent further loss;
  • establish and secure evidence necessary for criminal, civil and/or disciplinary action;
  • determine when to contact the police and establish lines of communication;
  • assign responsibility for investigating the incident;
  • minimize and recover losses;
  • review the reasons for the incident, the measures taken to prevent a recurrence, and determine any action needed to strengthen future responses to

4. COMPANY RESPONSIBILITIES

• The company will undertake fraud investigations where there is suspected fraud and take the appropriate legal and/or disciplinary action in all cases where that would be justified. Whether there is fraud (proven or suspected), the Company should make any necessary changes to systems and procedures to prevent similar frauds from occurring in the future. The Company should establish systems for recording and subsequently monitoring all discovered cases of fraud (proven or suspected).
• Responsibility for exercising disciplinary actions rests with the Director of Human Resources [or the Director of Compliance, for a company large enough to have independent compliance personnel], although this should be done in consultation with other Executives where

5. MANAGING THE RISK OF FRAUD - RESPONSIBILITIES

• The Executives (CEO and CFO) of the Company are responsible for establishing and maintaining a sound system of internal controls that support the achievement of Company policies, aims and objectives. The system of internal controls is designed to respond to and manage the whole range of risks that the Company faces. Managing fraud risk will be seen in the context of the management of this wider range of
• Overall responsibility for managing the risk of fraud has been delegated to front line managers and an internal auditor (whose duties are defined below). Their responsibilities include:

• developing a fraud risk profile and undertaking a regular review of the fraud risks associated with each of the key organizational objectives in order to keep the profile current;
• designing an effective control environment to prevent fraud from happening;
• establishing appropriate mechanisms for:
  • reporting fraud risk issues,
  • reporting significant incidents of fraud to the CFO and Human Resources [or the Compliance Department].
• making sure that all staff are aware of the Company's attitude to fraud and know what their responsibilities are in relation to combating fraud;
• developing skill and experience competency frameworks;
• ensuring that appropriate anti-fraud training and development opportunities are available to appropriate staff in order to meet the defined competency;
• ensuring that vigorous and prompt investigations are carried out if fraud occurs or is suspected;
• taking appropriate disciplinary action against supervisors where supervisory failures have contributed to the commission of fraud;
• taking appropriate action to safeguard the recovery of assets;
• ensuring that appropriate action is taken to minimize the risk of similar frauds occurring in the future.
  • Line Managers are responsible for:
• ensuring that an adequate system of internal controls exists within their areas of responsibility and that controls operate effectively;
• preventing and detecting fraud;
• assessing the types of risk involved in the operations for which they are responsible;
• regularly reviewing and testing the control systems for which they are responsible;
• ensuring that controls are being complied with and their systems continue to operate effectively;
• implementing new controls to reduce the risk of similar fraud occurring where frauds have taken
  • The Internal Auditor is responsible for:
• delivering an opinion to the CFO and Audit Committee on the adequacy of arrangements for managing the risk of fraud and ensuring that the Company promotes an anti-fraud culture;
• assisting in the deterrence and prevention of fraud by examining and evaluating the effectiveness of controls commensurate with the extent of the potential exposure/risk in the various segments of Company's operations;
• assisting management in conducting fraud
  • Every member of staff bears responsibility for:
• acting with propriety in the use of Company resources and the handling and use of Company funds whether they are involved with cash or payments systems, receipts or dealing with suppliers or
• being conscious to the possibility that unusual events or transactions could be indicators of fraud;
• reporting details immediately through the appropriate channel, if they suspect that a fraud has been committed or see any suspicious acts or activities;
• co-operating fully with whoever is conducting internal checks, reviews or fraud investigations.

6. FRAUD DETECTION

• Line Managers should be alert to the possibility that unusual events or transactions could be symptoms of fraud or attempted fraud. Fraud may also be highlighted as a result of specific management checks or be brought to management's attention by a third party. Additionally, irregularities occasionally come to light in the course of audit
• The factors which gave rise to the suspicion should be determined and examined to clarify whether a genuine mistake has been made or an irregularity has occurred. An irregularity may be defined as any incident or action which is not part of the normal operation of the system or the expected course of
• Preliminary examination may involve discreet enquiries with staff or the review of documents. It is important for staff to be clear that any irregularity of this type, however apparently innocent, will be

7. ACTION FOLLOWING DETECTION

• When any member of staff suspects that a fraud has occurred, he/she should notify his/her Line Manager or Internal Auditor immediately. Speed is of the essence and this initial report can be verbal and must be followed up within 24 hours by a written report addressed to the Line Manager/Internal Auditor which should cover:
  • The amount/value if
  • The position regarding
  • The period over which the irregularity occurred, if
  • The date of discovery and how the suspected fraud was
  • Whether the person responsible has been
  • Whether any collusion with others is
  • Details of any actions taken to
  • Any other information or comments which might be

• Before completing the report above, line management may want to undertake an initial inquiry to ascertain the facts. This enquiry should be carried out as speedily as possible after suspicion has been aroused: prompt action is essential. The purpose of the initial enquiry is to confirm or negate, as far as possible, the suspicions that have arisen so that, if necessary, disciplinary action including further and more detailed investigation may be initiated. The Internal Auditor is available to offer advice on any specific course of action which may be necessary.

• As the gravity of each irregularity might be different, a reporting member of staff may wish to act in accordance with the "Policy on Reporting and Investigating Allegations of Suspected Improper Activities."

8. CONSULTATION AND REPORTING WITHIN THE COMPANY

• On verbal notification of a possible fraud the Line Manager/Internal Auditor must immediately contact the CFO. He/She will inform and consult with the CEO (General Director) in cases where the loss is potentially significant or where the incident may lead to adverse
• The CFO will maintain a log of all reported suspicions, including those dismissed as minor or otherwise not investigated. The log will contain details of actions taken and conclusions reached and will be presented to the Audit Committee for inspection annually. Significant matters will be reported to the Board of Directors as soon as
• Where a member of staff is to be interviewed or disciplined, the CFO and/or Internal Auditor will consult with, and take advice from, the Director of Human Resources [or Director of Compliance]. He will advise those involved in the investigation in matters of employment law, Company policy and other procedural matters (such as disciplinary or complaints procedures) as

9. INVESTIGATION / FURTHER ACTION

• If it appears that a criminal act has not taken place, an internal investigation will be undertaken to:

• determine the facts;
• consider what, if any, action should be taken against those involved;
• consider what may be done to recover any loss incurred; and
• identify any system weakness and look at how internal controls could be improved to prevent a recurrence.

After proper investigation, the Company will take legal and/or disciplinary action in all cases where leaders consider further action appropriate. There will be consistent handling of cases without regard to position or length of service of the perpetrator.

• Where an investigation involves a member of staff and it is determined that no criminal act has taken place, the CFO will liaise with the Director of Human Resources [or Director of Compliance] and appropriate Line Manager to determine which of the following has occurred and therefore whether, under the circumstances, disciplinary action is appropriate:

• gross misconduct (i.e. acting dishonestly but without criminal intent);
• negligence or error of judgment was seen to be exercised; or
• nothing untoward occurred and therefore there is no case to
  • Where, after having sought legal advice, the CFO judges it cost effective to do so, the Company will normally pursue civil action in order to recover any losses. The CFO will refer the case to the Company's legal advisers for
  • Where initial investigations point to the likelihood of a criminal act having taken place, the Executives (CEO or CFO) will contact the police (or appropriate Federal agency, as the case may be) and the Company's legal advisers at once. The advice of the police will be followed in taking forward the
  • The investigations described above will also consider whether there has been any failure of supervision. Where this has occurred, appropriate disciplinary action will be taken against those responsible for this

10. RECOVERY OF LOSSES

The recovery of losses should be a major objective of any fraud investigation. To this end, the quantification of losses is important. Repayment of losses should be sought in all cases. Where necessary, the Company will seek external advisors and legal advice on the most effective actions to secure recovery of losses.

11. MANAGERS' DUTY OF CARE

• Managers conducting initial enquiries must be conscious that internal disciplinary action and/or criminal prosecution may result. If such action is later taken, then under proper procedure the member of staff concerned has a right to representation and may have the right to remain silent. Utmost care is therefore required from the outset in conducting enquiries and
• In addition, in order to protect the Company from further loss and damage from destruction of evidence, it may be necessary to suspend the member of staff concerned immediately after the allegation has been made or following the submission of the Manager's initial verbal report. Specific advice should be sought from Human Resources [Compliance] before

12. PROTECTION OF EVIDENCE

If the initial examination confirms the suspicion that a fraud has been perpetrated, then to prevent the loss of evidence which may subsequently prove essential for disciplinary action or prosecution, the person heading up the investigation ("Head of Investigation") should:

• take steps to ensure that all original evidence is secured as soon as possible;
• be able to account for the security of the evidence at all times after it has initially been secured, including keeping a record of its movement and signatures of all persons to whom the evidence has been transferred. For this purpose, all items of evidence should be individually numbered and descriptively labeled;
• not alter or amend the evidence in any way;
• keep a note of when investigators came into possession of the evidence. This will be useful later if proceedings take place;
• remember that all memoranda relating to the investigation must be disclosed to the defense in the event of formal proceedings against an employee, so it is important to carefully consider what information needs to be recorded. Particular care must be taken with phrases such as "discrepancy" and "irregularity" when what is really meant is fraud or theft;

• ensure that electronic evidence is appropriately handled by certified

13. HEAD OF INVESTIGATION

13.1 Executives of the Company will nominate in writing the Head of Investigation on a case by case basis depending on the gravity of issues and potential losses involved. The Internal Auditor will oversee and control the subsequent investigation, therefore for this purpose the Head of Investigation will report to the Internal Auditor.

• The Terms of Reference should be agreed between those involved in the investigation. The Head of Investigation should arrange for an action plan to be put in place with, as far as is possible, a set timeframe and regular reviews. He should call on the assistance of various sources of help at all stages (technical assistance, personnel, external audit, attorneys, etc.) but ultimate responsibility and accountability in progressing the case should remain with the Head of Investigation.
• The Head of Investigation should have the necessary authority (i.e. the appropriate rank and experience) to enable him/her to properly discharge these duties. Depending on the volume of work to be performed and the issues involved, this person might be released from his/her main duties in the Company on a temporary
• The Head of Investigation should also be independent from the matter in question. It is the responsibility of the Head of Investigation to keep the Internal Auditor abreast of developments and report all material developments promptly to facilitate onward reporting to the Executive Team and Audit

14. LEARNING FROM EXPERIENCE

Following completion of the case, the Internal Auditor should prepare a summary report on the outcome and lessons learned circulating it to all other interested parties who must take the appropriate action to improve controls to mitigate the scope for future recurrence of the fraud. Where a fraud has occurred, Management must make any necessary changes to systems and procedures to minimize prospects for similar acts of fraud.

SUMMARY

Deloitte, one of the world's largest business consultants, offers the following guidance for businesses that want to begin a fraud-response plan:

• Create an allegation system:
  • In what ways does the company systematically receive complaints?
  • What process exists to assess the validity of complaints?
  • How does the company train team members on what they should do if they suspect fraud?
  • How does the company train team members on what they should not do if they suspect fraud?
• Allegation Triage:
  • How does the company determine when to escalate a complaint to a formal investigation?
  • How does the company document the criteria to determine which complaints get investigated?
  • What protocols guide the investigator's assignment?
• Case Investigation:
  • What work plan exists to guide investigations?
  • How do investigators handle evidence?
  • What level of competency do investigators have?
  • How does the company review case status?
  • Who has access to case files?
• Communication and Reporting:
  • How do investigators communicate with stakeholders?
  • How does the company reveal investigations to team members?

Action List

The following checklist of actions may guide a person that suspects fraud within the company.

1. Do not act on emotion. It's time to gather all the facts.
2. Alert appropriate management within your organization. This, of course, heavily depends on who's suspected of committing the fraud. Fraud discovered at the lower echelons of the company can probably be handled by the direct manager in association with the compliance supervisor. Things get a bit more complicated the higher you move up the corporate ladder. Accountability, though, goes straight to the President, CEO and Board of Directors. So, make sure compliance is amply prepared and authorized to do what's necessary even upon discovery of high-level fraud with the company.
3. Document date, time and details of initial report/discovery. This is important for both the reporting of the suspected fraud and ongoing investigation.
4. Take notes (and/or pictures and video) of all observations and actions. Important information can quickly be forgotten or confused over time. Creating copious notes and/or documenting photographic evidence helps ensure you have all the information the company needs to maintain the integrity of the investigation.
5. Maintain confidentiality (only inform those people who need to know about the suspected act). Loose lips sink ships – and investigations. Prematurely alerting the suspect(s) leads to destruction of evidence and cover-ups.
6. Do not confront the suspect. You could be putting yourself in danger, in addition to undermining the investigation.
7. Write out in full the suspected act or wrongdoing in as much detail as possible, including:

• The alleged occurrence,
• Who was involved in the occurrence,
• Whether the activity is ongoing,
• Location of occurrence,
• The value of the loss or potential loss, and
• A list of who else may know of the activity.

Collection of evidence is critical for proving the crime. Corporate investigations can take months and legal ones even longer.

1. Identify all documentary and other evidence connected to the activity, such as:

• Invoices,
• Contract and Agreements,
• Purchase orders,
• Checks,
• Computers,
• Laptops,
• Tablets,
• Cell phones,
• Cloud access accounts,
• Credit card statements, and
• Relevant social media accounts.

1. Immediately gather the evidence (only if doing so will not alert the suspects) and place it in a secure area. Bear in mind a need to maintain a legitimate chain of evidence in case it becomes necessary to bring in outside authorities.
2. Protect the evidence from damage or contamination. This includes all confiscated electronic devices. You may need the evidence for civil or criminal proof, or even use it in a countersuit should you need to against a litigious fired employee.
3. Identify all potential witnesses. This includes people within and without your organization. Certain people may even alternate from witness to suspect and vice-a-verse during the course of your investigation.
4. If possible, secure and/or remove the suspect's access to relevant computers and security systems. This decision is delicate and may need to be made at the highest levels of authority within the organization. There's a fine balance between mitigating damages and continuing to collect evidence. You may want to consult outside legal and accounting firms and request an Opinion Letter regarding your decisions, depending on the situation.
5. Ensure regular back-up of all files and secretly place additional security on all accounts the suspect(s) may have access to.
6. Contact the company's outside counsel and accountants for advice and recommendations. This should occur early on in the process but, typically, at the highest levels of management.
7. Contact the company's insurance carrier. You may or may not be covered for the type of fraud under investigation. Should you be covered, the insurer may have its own processes for conducting investigations and you may unwittingly forfeit certain rights or claims by not alerting them early enough. The insurer, moreover, may try to deny the claim and you might be forced to retain additional counsel to sue your insurer for coverage.
8. You may need to retain a forensic accountant. Some frauds can be quite elaborate and complex, involve multiple jurisdictions and/or require advanced training in computer programming. A full investigation may require particular expertise.
9. Continue to monitor suspicious personnel and activities to ascertain the full breadth and extent of the fraud.

ComplianceMitigation.com

Previous modules offered insights we believe leaders should consider when designing an effective compliance program and risk-management strategy for their organizations. The more leaders customize their compliance and best-practice programs, the better they safeguard against intrusive investigations that could threaten the business and its team members.

Regardless of what efforts team members make to protect a company, possibilities always exist for a breakdown, or for a rogue team member that could expose the organization to liability. For that reason, all companies should create a plan that would coordinate a team response in the event of an inquiry from regulators or law enforcement.

 

Lack of Planning Brings Vulnerabilities:

In the absence of a structured response plan, team members may not know what to do if they learn that authority figures have taken an interest in the company or in a team member. Sometimes, leaders act rashly. People have gone to prison for their response to a government investigation, rather than for the underlying reasons behind the inquiry.

Consider the case of the famous celebrity, Martha Stewart. Many people are familiar with her brand, which sells household products. In 2001, however, a personal scandal over a stock sale completely disrupted her life. Her response to a government inquiry led to criminal charges.

According to the U.S. Securities and Exchange Commission, in late December 2001, her stockbroker at Merrill Lynch, Peter Baconovic, called her. Peter revealed that Sam Waksal, the CEO of ImClone Systems had placed an order to sell all of his shares in his company as a result of an adverse decision by the Food and Drug Administration. In response, Martha sold approximately 4,000 shares that she owned, avoiding losses of more than $45,000.

When government investigators began making inquiries, Martha did not have a good plan. The responses she gave to the government investigators resulted in criminal charges. The fees and costs associated with the disruption likely exceeded several million dollars. Besides losing money for legal costs, Martha’s response to the investigation led to a prison term, a shareholder derivative suit against Martha Stewart and other directors at her company, and five months in prison. With a felony conviction, Martha endured lifelong complications, including bans on travel to some countries.

Clearly, Martha Stewart did not have a principled plan that would guide her response to a government inquiry. Sadly, many people find themselves in the same predicament. Those who operate businesses without designing a response plan for government inquiries may leave themselves vulnerable to knee-jerk reactions that can exacerbate troubles.

A lack of a plan can lead to confusion during the first few hours, days and weeks of an inquiry. The unfolding drama can distract team members, as everyone may worry about personal liability. If people don’t know what to do, they may make futile attempts at self-preservation, such as destroying incriminating evidence, or lying to government investigators. Either response would expose the individual, and potentially others, to criminal charges.

 

Risk Management:

A good response plan will ensure that all team members have guidelines to follow. Whether government regulators inquire about business operations or potential fraud, everyone should know what steps to take. To protect both the business and the team members, corporate leaders should articulate the appropriate protocol any time an investigator makes an inquiry.

• Does everyone in your organization know how to respond in the event that an investigator asks a question?

Leaders can easily get an answer to that question by creating a plan. Then, they should create a training exercise for all team members. The more transparency leaders bring to an investigation-response plan, the more they will strengthen arguments that the organization has made a genuine effort to act in compliance with all regulations and laws.

Point for business leaders to consider:

• Regulators and judges are increasingly asking not just whether a company has an anti-fraud, anti-money laundering, or corporate ethics policy in place. They are also asking how well such programs work and whether their quality and results make sense. They are asking, in other words, how good are they? This trend raises the stakes for those charged with governance.

An example of an effective “anti-fraud policy” may prove helpful to business leaders that want to create an organizational-specific plan. Our team at Compliance Mitigation offers the following as a template:

 

1.              INTRODUCTION

• Our company (the “Company”) has a commitment to high legal, ethical and moral standards. We expect all members of staff to share this commitment. The Board of Directors tries to ensure that a risk (and fraud) awareness culture exists in this organization. Fraud is an ever-present threat and hence must be a concern to all members of staff. Our Company views fraud as an extremely serious matter and is committed to the promotion of an Anti-Fraud Culture throughout the
• We created this document to provide direction and help to those who find themselves having to deal with suspected cases of theft, fraud or corruption. This document gives a framework for a response, advice and information on various aspects and implications of an investigation. It is not intended to provide direction on prevention of
• This Policy applies to any irregularity, or suspected irregularity, involving employees as well as consultants, vendors, contractors, customers and/or any other parties having a business relationship with the Company. Any investigative activity required will be conducted without regard to any person’s relationship to this organization, position or length of service. All managers and supervisors have a duty to familiarize themselves with the types of improprieties that might be expected to occur within their areas of responsibility and to be alert for any indications of

 

 

2.              DEFINITIONS – WHAT IS FRAUD?

• We define Fraud as “dishonestly obtaining an advantage, avoiding an obligation or causing a loss to another party.” The term “fraud” commonly includes activities such as theft, corruption, conspiracy, embezzlement, deception, bribery and extortion. It may involve:
  • manipulation, falsification or alteration of records or documents;
  • suppression or omission of the effects of transactions from records or documents;
  • recording of transactions without substance;
  • misappropriation (theft) or willful destruction or loss of assets including cash; and
  • deliberate misapplication of accounting or other regulations or
• The criminal act is the attempt to deceive, and attempted fraud is therefore treated as seriously as accomplished
• Computer fraud arises where information technology equipment has been used to manipulate programs or data dishonestly (for example, by altering, substituting or destroying records, or creating spurious records), or where the use of an IT system was a material factor in the perpetration of fraud. Theft or fraudulent use of computer time and resources is included in this definition.
• Some illustrations of incidents which would be classified as fraud are contained in Appendix A to this

 

 

3.              PURPOSE OF THE FRAUD RESPONSE PLAN

• The purpose of the Fraud Response Plan (the “Plan”) is to ensure that effective and timely action is taken in the event of a fraud. The Plan aims to help minimize losses, reduce liability and increase the chances of a successful
• The Plan defines authority levels, responsibilities for action, and reporting lines in the event of a suspected fraud or irregularity. It acts as a checklist of actions and a guide to follow in the event of fraud being suspected. The Plan is designed to enable the Company to:
  • prevent further loss;
  • establish and secure evidence necessary for criminal, civil and/or disciplinary action;
  • determine when to contact the police and establish lines of communication;
  • assign responsibility for investigating the incident;
  • minimize and recover losses;
  • review the reasons for the incident, the measures taken to prevent a recurrence, and determine any action needed to strengthen future responses to

 

4.              COMPANY RESPONSIBILITIES

• The company will undertake fraud investigations where there is suspected fraud and take the appropriate legal and/or disciplinary action in all cases where that would be justified. Whether there is fraud (proven or suspected), the Company should make any necessary changes to systems and procedures to prevent similar frauds from occurring in the future. The Company should establish systems for recording and subsequently monitoring all discovered cases of fraud (proven or suspected).
• Responsibility for exercising disciplinary actions rests with the Director of Human Resources [or the Director of Compliance, for a company large enough to have independent compliance personnel], although this should be done in consultation with other Executives where

 

5.              MANAGING THE RISK OF FRAUD - RESPONSIBILITIES

• The Executives (CEO and CFO) of the Company are responsible for establishing and maintaining a sound system of internal controls that support the achievement of Company policies, aims and objectives. The system of internal controls is designed to respond to and manage the whole range of risks that the Company faces. Managing fraud risk will be seen in the context of the management of this wider range of
• Overall responsibility for managing the risk of fraud has been delegated to front line managers and an internal auditor (whose duties are defined below). Their responsibilities include:

• developing a fraud risk profile and undertaking a regular review of the fraud risks associated with each of the key organizational objectives in order to keep the profile current;
• designing an effective control environment to prevent fraud from happening;
• establishing appropriate mechanisms for:
  • reporting fraud risk issues,
  • reporting significant incidents of fraud to the CFO and Human Resources [or the Compliance Department].
• making sure that all staff are aware of the Company’s attitude to fraud and know what their responsibilities are in relation to combating fraud;
• developing skill and experience competency frameworks;
• ensuring that appropriate anti-fraud training and development opportunities are available to appropriate staff in order to meet the defined competency;
• ensuring that vigorous and prompt investigations are carried out if fraud occurs or is suspected;
• taking appropriate disciplinary action against supervisors where supervisory failures have contributed to the commission of fraud;
• taking appropriate action to safeguard the recovery of assets;
• ensuring that appropriate action is taken to minimize the risk of similar frauds occurring in the future.
  • Line Managers are responsible for:
• ensuring that an adequate system of internal controls exists within their areas of responsibility and that controls operate effectively;
• preventing and detecting fraud;
• assessing the types of risk involved in the operations for which they are responsible;
• regularly reviewing and testing the control systems for which they are responsible;
• ensuring that controls are being complied with and their systems continue to operate effectively;
• implementing new controls to reduce the risk of similar fraud occurring where frauds have taken
  • The Internal Auditor is responsible for:
• delivering an opinion to the CFO and Audit Committee on the adequacy of arrangements for managing the risk of fraud and ensuring that the Company promotes an anti-fraud culture;
• assisting in the deterrence and prevention of fraud by examining and evaluating the effectiveness of controls commensurate with the extent of the potential exposure/risk in the various segments of Company’s operations;
• assisting management in conducting fraud
  • Every member of staff bears responsibility for:
• acting with propriety in the use of Company resources and the handling and use of Company funds whether they are involved with cash or payments systems, receipts or dealing with suppliers or
• being conscious to the possibility that unusual events or transactions could be indicators of fraud;
• reporting details immediately through the appropriate channel, if they suspect that a fraud has been committed or see any suspicious acts or activities;
• co-operating fully with whoever is conducting internal checks, reviews or fraud investigations.

 

 

6.              FRAUD DETECTION

• Line Managers should be alert to the possibility that unusual events or transactions could be symptoms of fraud or attempted fraud. Fraud may also be highlighted as a result of specific management checks or be brought to management's attention by a third party. Additionally, irregularities occasionally come to light in the course of audit
• The factors which gave rise to the suspicion should be determined and examined to clarify whether a genuine mistake has been made or an irregularity has occurred. An irregularity may be defined as any incident or action which is not part of the normal operation of the system or the expected course of
• Preliminary examination may involve discreet enquiries with staff or the review of documents. It is important for staff to be clear that any irregularity of this type, however apparently innocent, will be

 

7.              ACTION FOLLOWING DETECTION

• When any member of staff suspects that a fraud has occurred, he/she should notify his/her Line Manager or Internal Auditor immediately. Speed is of the essence and this initial report can be verbal and must be followed up within 24 hours by a written report addressed to the Line Manager/Internal Auditor which should cover:
  • The amount/value if
  • The position regarding
  • The period over which the irregularity occurred, if
  • The date of discovery and how the suspected fraud was
  • Whether the person responsible has been
  • Whether any collusion with others is
  • Details of any actions taken to
  • Any other information or comments which might be

 

• Before completing the report above, line management may want to undertake an initial inquiry to ascertain the facts. This enquiry should be carried out as speedily as possible after suspicion has been aroused: prompt action is essential. The purpose of the initial enquiry is to confirm or negate, as far as possible, the suspicions that have arisen so that, if necessary, disciplinary action including further and more detailed investigation may be initiated. The Internal Auditor is available to offer advice on any specific course of action which may be necessary.

 

• As the gravity of each irregularity might be different, a reporting member of staff may wish to act in accordance with the "Policy on Reporting and Investigating Allegations of Suspected Improper Activities."

 

 

8.              CONSULTATION AND REPORTING WITHIN THE COMPANY

• On verbal notification of a possible fraud the Line Manager/Internal Auditor must immediately contact the CFO. He/She will inform and consult with the CEO (General Director) in cases where the loss is potentially significant or where the incident may lead to adverse
• The CFO will maintain a log of all reported suspicions, including those dismissed as minor or otherwise not investigated. The log will contain details of actions taken and conclusions reached and will be presented to the Audit Committee for inspection annually. Significant matters will be reported to the Board of Directors as soon as
• Where a member of staff is to be interviewed or disciplined, the CFO and/or Internal Auditor will consult with, and take advice from, the Director of Human Resources [or Director of Compliance]. He will advise those involved in the investigation in matters of employment law, Company policy and other procedural matters (such as disciplinary or complaints procedures) as

 

 

9.              INVESTIGATION / FURTHER ACTION

• If it appears that a criminal act has not taken place, an internal investigation will be undertaken to:

• determine the facts;
• consider what, if any, action should be taken against those involved;
• consider what may be done to recover any loss incurred; and
• identify any system weakness and look at how internal controls could be improved to prevent a recurrence.

 

After proper investigation, the Company will take legal and/or disciplinary action in all cases where leaders consider further action appropriate. There will be consistent handling of cases without regard to position or length of service of the perpetrator.

• Where an investigation involves a member of staff and it is determined that no criminal act has taken place, the CFO will liaise with the Director of Human Resources [or Director of Compliance] and appropriate Line Manager to determine which of the following has occurred and therefore whether, under the circumstances, disciplinary action is appropriate:

• gross misconduct (i.e. acting dishonestly but without criminal intent);
• negligence or error of judgment was seen to be exercised; or
• nothing untoward occurred and therefore there is no case to
  • Where, after having sought legal advice, the CFO judges it cost effective to do so, the Company will normally pursue civil action in order to recover any losses. The CFO will refer the case to the Company’s legal advisers for
  • Where initial investigations point to the likelihood of a criminal act having taken place, the Executives (CEO or CFO) will contact the police (or appropriate Federal agency, as the case may be) and the Company’s legal advisers at once. The advice of the police will be followed in taking forward the
  • The investigations described above will also consider whether there has been any failure of supervision. Where this has occurred, appropriate disciplinary action will be taken against those responsible for this

 

10.           RECOVERY OF LOSSES

The recovery of losses should be a major objective of any fraud investigation. To this end, the quantification of losses is important. Repayment of losses should be sought in all cases. Where necessary, the Company will seek external advisors and legal advice on the most effective actions to secure recovery of losses.

 

 

11.           MANAGERS’ DUTY OF CARE

• Managers conducting initial enquiries must be conscious that internal disciplinary action and/or criminal prosecution may result. If such action is later taken, then under proper procedure the member of staff concerned has a right to representation and may have the right to remain silent. Utmost care is therefore required from the outset in conducting enquiries and
• In addition, in order to protect the Company from further loss and damage from destruction of evidence, it may be necessary to suspend the member of staff concerned immediately after the allegation has been made or following the submission of the Manager’s initial verbal report. Specific advice should be sought from Human Resources [Compliance] before

 

 

12.           PROTECTION OF EVIDENCE

If the initial examination confirms the suspicion that a fraud has been perpetrated, then to prevent the loss of evidence which may subsequently prove essential for disciplinary action or prosecution, the person heading up the investigation (“Head of Investigation”) should:

• take steps to ensure that all original evidence is secured as soon as possible;
• be able to account for the security of the evidence at all times after it has initially been secured, including keeping a record of its movement and signatures of all persons to whom the evidence has been transferred. For this purpose, all items of evidence should be individually numbered and descriptively labeled;
• not alter or amend the evidence in any way;
• keep a note of when investigators came into possession of the evidence. This will be useful later if proceedings take place;
• remember that all memoranda relating to the investigation must be disclosed to the defense in the event of formal proceedings against an employee, so it is important to carefully consider what information needs to be recorded. Particular care must be taken with phrases such as “discrepancy” and “irregularity” when what is really meant is fraud or theft;

 

• ensure that electronic evidence is appropriately handled by certified

 

 

13.           HEAD OF INVESTIGATION

13.1     Executives of the Company will nominate in writing the Head of Investigation on a case by case basis depending on the gravity of issues and potential losses involved. The Internal Auditor will oversee and control the subsequent investigation, therefore for this purpose the Head of Investigation will report to the Internal Auditor.

• The Terms of Reference should be agreed between those involved in the investigation. The Head of Investigation should arrange for an action plan to be put in place with, as far as is possible, a set timeframe and regular reviews. He should call on the assistance of various sources of help at all stages (technical assistance, personnel, external audit, attorneys, etc.) but ultimate responsibility and accountability in progressing the case should remain with the Head of Investigation.
• The Head of Investigation should have the necessary authority (i.e. the appropriate rank and experience) to enable him/her to properly discharge these duties. Depending on the volume of work to be performed and the issues involved, this person might be released from his/her main duties in the Company on a temporary
• The Head of Investigation should also be independent from the matter in question. It is the responsibility of the Head of Investigation to keep the Internal Auditor abreast of developments and report all material developments promptly to facilitate onward reporting to the Executive Team and Audit

 

 

14.           LEARNING FROM EXPERIENCE

Following completion of the case, the Internal Auditor should prepare a summary report on the outcome and lessons learned circulating it to all other interested parties who must take the appropriate action to improve controls to mitigate the scope for future recurrence of the fraud. Where a fraud has occurred, Management must make any necessary changes to systems and procedures to minimize prospects for similar acts of fraud.

 

SUMMARY

Deloitte, one of the world’s largest business consultants, offers the following guidance for businesses that want to begin a fraud-response plan:

• Create an allegation system:
  • In what ways does the company systematically receive complaints?
  • What process exists to assess the validity of complaints?
  • How does the company train team members on what they should do if they suspect fraud?
  • How does the company train team members on what they should not do if they suspect fraud?
• Allegation Triage:
  • How does the company determine when to escalate a complaint to a formal investigation?
  • How does the company document the criteria to determine which complaints get investigated?
  • What protocols guide the investigator’s assignment?
• Case Investigation:
  • What work plan exists to guide investigations?
  • How do investigators handle evidence?
  • What level of competency do investigators have?
  • How does the company review case status?
  • Who has access to case files?
• Communication and Reporting:
  • How do investigators communicate with stakeholders?
  • How does the company reveal investigations to team members?

 

Action List

The following checklist of actions may guide a person that suspects fraud within the company.

1. Do not act on emotion. It’s time to gather all the facts.
2. Alert appropriate management within your organization. This, of course, heavily depends on who’s suspected of committing the fraud. Fraud discovered at the lower echelons of the company can probably be handled by the direct manager in association with the compliance supervisor. Things get a bit more complicated the higher you move up the corporate ladder. Accountability, though, goes straight to the President, CEO and Board of Directors. So, make sure compliance is amply prepared and authorized to do what’s necessary even upon discovery of high-level fraud with the company.
3. Document date, time and details of initial report/discovery. This is important for both the reporting of the suspected fraud and ongoing investigation.
4. Take notes (and/or pictures and video) of all observations and actions. Important information can quickly be forgotten or confused over time. Creating copious notes and/or documenting photographic evidence helps ensure you have all the information the company needs to maintain the integrity of the investigation.  
5. Maintain confidentiality (only inform those people who need to know about the suspected act). Loose lips sink ships – and investigations. Prematurely alerting the suspect(s) leads to destruction of evidence and cover-ups.
6. Do not confront the suspect. You could be putting yourself in danger, in addition to undermining the investigation.
7. Write out in full the suspected act or wrongdoing in as much detail as possible, including:

• The alleged occurrence,
• Who was involved in the occurrence,
• Whether the activity is ongoing,
• Location of occurrence,
• The value of the loss or potential loss, and
• A list of who else may know of the activity.

 

Collection of evidence is critical for proving the crime. Corporate investigations can take months and legal ones even longer.

 

1. Identify all documentary and other evidence connected to the activity, such as:

 

• Invoices,
• Contract and Agreements,
• Purchase orders,
• Checks,
• Computers,
• Laptops,
• Tablets,
• Cell phones,
• Cloud access accounts,
• Credit card statements, and
• Relevant social media accounts.

 

1. Immediately gather the evidence (only if doing so will not alert the suspects) and place it in a secure area. Bear in mind a need to maintain a legitimate chain of evidence in case it becomes necessary to bring in outside authorities.
2. Protect the evidence from damage or contamination. This includes all confiscated electronic devices. You may need the evidence for civil or criminal proof, or even use it in a countersuit should you need to against a litigious fired employee.
3. Identify all potential witnesses. This includes people within and without your organization. Certain people may even alternate from witness to suspect and vice-a-verse during the course of your investigation.
4. If possible, secure and/or remove the suspect’s access to relevant computers and security systems. This decision is delicate and may need to be made at the highest levels of authority within the organization. There’s a fine balance between mitigating damages and continuing to collect evidence. You may want to consult outside legal and accounting firms and request an Opinion Letter regarding your decisions, depending on the situation.
5. Ensure regular back-up of all files and secretly place additional security on all accounts the suspect(s) may have access to.
6. Contact the company’s outside counsel and accountants for advice and recommendations. This should occur early on in the process but, typically, at the highest levels of management.
7. Contact the company’s insurance carrier. You may or may not be covered for the type of fraud under investigation. Should you be covered, the insurer may have its own processes for conducting investigations and you may unwittingly forfeit certain rights or claims by not alerting them early enough. The insurer, moreover, may try to deny the claim and you might be forced to retain additional counsel to sue your insurer for coverage.
8. You may need to retain a forensic accountant. Some frauds can be quite elaborate and complex, involve multiple jurisdictions and/or require advanced training in computer programming. A full investigation may require particular expertise.
9. Continue to monitor suspicious personnel and activities to ascertain the full breadth and extent of the fraud.

Compliance Mitigation dot com

For reasons expressed throughout these modules, every business leader should consider possible steps to lessen potential exposure to a government investigation. Three suggestions follow:

1. Show a commitment "to doing good" in all communications.
2. Document processes that show a commitment to operating the business with principled, transparent policies that are easily defensible.
3. Train all team members to understand the corporate culture, and also the reasons behind every policy in place.

These three components would go a long way toward protecting businesses and individuals.

Government Officials:

In 1991, the U.S. Sentencing Commission (USSC) amended its guidelines. The amendments incentivized business owners to act in compliance with regulations and the law. Those changes opened opportunities for prosecutors to grant leniency, non-prosecution agreements, or deferred-prosecution agreements to businesses that put "effective compliance programs" in place.

Theoretically, if business leaders designed effective compliance programs, their efforts would show a good-faith effort toward corporate responsibility. By building a record demonstrating that they want all team members to act appropriately, leaders reduce risk levels. Although no one can eliminate the possibility of a government investigation, good records will serve as an excellent defense mechanism.

As we've stated throughout, although business leaders can control personal decisions, they cannot observe decisions that other people on their team make. For those reasons, leaders should add training on the personal costs that can accompany an investigation or a prosecution for white-collar crime.

Agencies within the Department of Justice now incentivize businesses to make bigger investments in compliance. Guidance from 2019 advises federal prosecutors to consider the following questions when evaluating corporate compliance programs:

1. Is the program well designed?
2. Is the program being implemented effectively?
3. Does the compliance program work in practice?

In 2020, the DOJ emphasized another two key points with its publication of: Evaluation of Corporate Compliance Programs (2020 Guidance):

• https://www.justice.gov/criminal-fraud/page/file/937501/download

First:

Corporate compliance programs, to be deemed genuine and effective by the DOJ, must be examined, tested, and updated on a continual basis, including (and perhaps especially) during a government investigation.

Compliance efforts should integrate current data analytics, capabilities wherever possible. If deficiencies are found, then changes should be made, and the 2020 Guidance makes clear that DOJ expects regular review of compliance efforts.

Second:

The quality of a company's compliance program continues to be a major factor in deciding on the appropriate resolution of a government investigation. The 2020 Guidance makes clear a program's effectiveness will be considered at the close of an investigation as well as when the underlying company conduct occurred.

Consequently, under DOJ policy, the strength of a company's past and present compliance efforts will ordinarily have an effect on the terms of a resolution, including the often quite important matter of whether a monitor is required (and the scope of a monitorship).

The DOJ's guidance can help business leaders make decisions to lessen exposure to investigations.

Effective compliance programs will not only show people what they should do, it will help those people understand what they should not do. In addition, they may also profile the consequences that follow for bad behavior.

If a company invests the time to show a person how to make the right decisions, and it requires the people to acknowledge that they understand corporate policy, the business protects itself. Good compliance programs will encourage both corporate accountability, and personal accountability. If there is a breach of policy, the company should create a record and demonstrate the steps that it has taken to make things right.

Two questions that investigators may ask include:

• Has the company ever terminated or otherwise disciplined anyone for the type of misconduct at issue?
• Have the disciplinary actions and incentives been fairly and consistently applied across the organization?

To demonstrate individual accountability, the company will record disciplinary measures taken against people charged with violations of compliance policies. If a company shows that it pays more than lip service to compliance, it may lessen exposure to a government investigation.

Compliance programs serve as an insurance policy. Although business leaders may strive to do the right thing every time, rogue employees can expose the business to risks. The compliance program may influence the lens through which prosecutors view the company. That said, some metrics show that the mere existence of a compliance program doesn't show commitment to compliance. Solely requiring employees to sign forms showing that they're familiar with the corporate polices won't move the needle if a pattern of fraud is uncovered.

In 2012, the prosecutors brought criminal charges against Garth Peterson, a trader at Morgan Stanley. Documents noted that Peterson had gone through seven compliance-training sessions and 35 related reminders on bribery. Despite that training, he pleaded guilty to bribery charges. Compliance initiatives had little influence on Peterson, because he viewed them as pro forma, something he needed to do in order to keep his job.

If a business doesn't create a compliance program with robust follow-through, it may be ineffective and dubious from the perspective a government investigator. Prosecutors will not give credit for compliance programs that fail to inspire appropriate conduct.

A company protects itself when it comes up with innovative ways to help people within the organization embrace the principles of compliance—but also understand the consequences for non-compliance.

Designing A Compliance Program:

Compliance is not a "one-size-fits-all" proposition. Leaders within a company should:

• Document the reasons behind the compliance training.
• Show the tools, tactics, and resources they've implemented to train.
• Create accountability logs to show people that have gone through the training, encouraging them to self-report what they've learned from the program.

If the program doesn't work, the leader should show what adjustments he or she has made.

Federal and state regulations, as well as industry standards, evolve constantly. For this reason, leaders should conduct regular assessments to minimize the risks associated with noncompliance.

Risk factors:

• What inherent risks exist in the company's market?
• What efforts does the company leadership make to stay aware of the market?
• In what ways does the company solicit third-party expertise?

Objectives:

• What purpose does each module within a compliance program serve?
• In what ways do members of the team understand the objectives of a corporate compliance program?

Departmental Responsibilities:

• In what ways does the company delegate responsibility for compliance programs?
• In what ways does the company measure excellence in delivering compliance training?
• How does the company record employee buy-in of the training?
• What do team members or stakeholders understand about reporting metrics?

Training:

• What level of commitment does the company make to training?
• What efforts does the company make to update the training?
• In what ways can employees independently participate in computer-based training?
• How does the company measure employee engagement?

Corresponding Policies:

Like every individual has a personality, every organization has an identity. Different businesses will need a compliance program that matches the business's identity. Some organizations may require a policy that scrutinizes new hires more than others. For example, a business that controls financial information for consumers may require criminal-background checks on all new hires, while a company that specializes in landscaping may not.

A compliance program should show a commitment to transparency. All policies should harmonize with the behavior of officials at the highest level. In this era of cloud-based computing, leaders may make use of computer-based training, encouraging members of the team to review lessons remotely. If employees have feedback, mechanisms should exist for them to provide feedback in a manner that will not undermine their position—provided they offer the feedback in a good-faith effort to promote compliance.

Summary:

In summary, the best way to minimize vulnerabilities to government investigations is to create a good compliance program that is consistent with the corporate culture. Document every practice within the company. Show the reasons behind the ways that the company makes decisions. Train team members on how to work within the framework of the corporate culture. Leaders may want to review guidance from the Department of Justice, and question whether the compliance programs they've put in place measure up.

A good tactic may include bringing in a neutral third party who has that credentials to ask the questions that investigators will ask. Create a program that will allow leaders of the organization to respond honestly, with their dignity intact. When making a decision on whether to bring charges against a company, government attorneys will ask:

1. Is the program well designed?
2. Is the program being implemented effectively?
3. Does the compliance program work in practice?

If a company leader can respond to those questions as quickly as he can answer the questions regarding corporate profitability, the leader will have done everything possible to minimize vulnerabilities to a government investigation. In our era of big government, that doesn't mean a government investigation will not begin. It only means that a company is in as good a position as possible. No one can change past behavior. But we all can work toward minimizing risks in the future.

Compliance Mitigation dot com

 

For reasons expressed throughout these modules, every business leader should consider possible steps to lessen potential exposure to a government investigation. Three suggestions follow:

1. Show a commitment “to doing good” in all communications.
2. Document processes that show a commitment to operating the business with principled, transparent policies that are easily defensible.
3. Train all team members to understand the corporate culture, and also the reasons behind every policy in place.

These three components would go a long way toward protecting businesses and individuals.

 

Government Officials:

In 1991, the U.S. Sentencing Commission (USSC) amended its guidelines. The amendments incentivized business owners to act in compliance with regulations and the law. Those changes opened opportunities for prosecutors to grant leniency, non-prosecution agreements, or deferred-prosecution agreements to businesses that put “effective compliance programs” in place.

Theoretically, if business leaders designed effective compliance programs, their efforts would show a good-faith effort toward corporate responsibility. By building a record demonstrating that they want all team members to act appropriately, leaders reduce risk levels. Although no one can eliminate the possibility of a government investigation, good records will serve as an excellent defense mechanism.

As we’ve stated throughout, although business leaders can control personal decisions, they cannot observe decisions that other people on their team make. For those reasons, leaders should add training on the personal costs that can accompany an investigation or a prosecution for white-collar crime.

Agencies within the Department of Justice now incentivize businesses to make bigger investments in compliance. Guidance from 2019 advises federal prosecutors to consider the following questions when evaluating corporate compliance programs:

 

1. Is the program well designed?
2. Is the program being implemented effectively?
3. Does the compliance program work in practice?

 

In 2020, the DOJ emphasized another two key points with its publication of: Evaluation of Corporate Compliance Programs (2020 Guidance):

• https://www.justice.gov/criminal-fraud/page/file/937501/download

 

First:

Corporate compliance programs, to be deemed genuine and effective by the DOJ, must be examined, tested, and updated on a continual basis, including (and perhaps especially) during a government investigation.

 

Compliance efforts should integrate current data analytics, capabilities wherever possible. If deficiencies are found, then changes should be made, and the 2020 Guidance makes clear that DOJ expects regular review of compliance efforts.

 

Second:

The quality of a company’s compliance program continues to be a major factor in deciding on the appropriate resolution of a government investigation. The 2020 Guidance makes clear a program’s effectiveness will be considered at the close of an investigation as well as when the underlying company conduct occurred.

 

Consequently, under DOJ policy, the strength of a company’s past and present compliance efforts will ordinarily have an effect on the terms of a resolution, including the often quite important matter of whether a monitor is required (and the scope of a monitorship).

 

The DOJ’s guidance can help business leaders make decisions to lessen exposure to investigations.

Effective compliance programs will not only show people what they should do, it will help those people understand what they should not do. In addition, they may also profile the consequences that follow for bad behavior.

If a company invests the time to show a person how to make the right decisions, and it requires the people to acknowledge that they understand corporate policy, the business protects itself. Good compliance programs will encourage both corporate accountability, and personal accountability. If there is a breach of policy, the company should create a record and demonstrate the steps that it has taken to make things right.

Two questions that investigators may ask include:

 

• Has the company ever terminated or otherwise disciplined anyone for the type of misconduct at issue?
• Have the disciplinary actions and incentives been fairly and consistently applied across the organization?

 

To demonstrate individual accountability, the company will record disciplinary measures taken against people charged with violations of compliance policies. If a company shows that it pays more than lip service to compliance, it may lessen exposure to a government investigation.

Compliance programs serve as an insurance policy. Although business leaders may strive to do the right thing every time, rogue employees can expose the business to risks. The compliance program may influence the lens through which prosecutors view the company. That said, some metrics show that the mere existence of a compliance program doesn’t show commitment to compliance. Solely requiring employees to sign forms showing that they’re familiar with the corporate polices won’t move the needle if a pattern of fraud is uncovered.

In 2012, the prosecutors brought criminal charges against Garth Peterson, a trader at Morgan Stanley. Documents noted that Peterson had gone through seven compliance-training sessions and 35 related reminders on bribery. Despite that training, he pleaded guilty to bribery charges. Compliance initiatives had little influence on Peterson, because he viewed them as pro forma, something he needed to do in order to keep his job.

If a business doesn’t create a compliance program with robust follow-through, it may be ineffective and dubious from the perspective a government investigator. Prosecutors will not give credit for compliance programs that fail to inspire appropriate conduct.

A company protects itself when it comes up with innovative ways to help people within the organization embrace the principles of compliance—but also understand the consequences for non-compliance.

 

 

Designing A Compliance Program:

 

Compliance is not a “one-size-fits-all” proposition. Leaders within a company should:

• Document the reasons behind the compliance training.
• Show the tools, tactics, and resources they’ve implemented to train.
• Create accountability logs to show people that have gone through the training, encouraging them to self-report what they’ve learned from the program.

 

If the program doesn’t work, the leader should show what adjustments he or she has made.

Federal and state regulations, as well as industry standards, evolve constantly. For this reason, leaders should conduct regular assessments to minimize the risks associated with noncompliance.

 

Risk factors:  

• What inherent risks exist in the company’s market?
• What efforts does the company leadership make to stay aware of the market?
• In what ways does the company solicit third-party expertise?

 

Objectives:

• What purpose does each module within a compliance program serve?
• In what ways do members of the team understand the objectives of a corporate compliance program?

 

Departmental Responsibilities:  

 

• In what ways does the company delegate responsibility for compliance programs?
• In what ways does the company measure excellence in delivering compliance training?
• How does the company record employee buy-in of the training?
• What do team members or stakeholders understand about reporting metrics?

 

  

Training: 

 

• What level of commitment does the company make to training?
• What efforts does the company make to update the training?
• In what ways can employees independently participate in computer-based training?
• How does the company measure employee engagement?

 

  

Corresponding Policies:

 

Like every individual has a personality, every organization has an identity. Different businesses will need a compliance program that matches the business’s identity. Some organizations may require a policy that scrutinizes new hires more than others. For example, a business that controls financial information for consumers may require criminal-background checks on all new hires, while a company that specializes in landscaping may not.

A compliance program should show a commitment to transparency. All policies should harmonize with the behavior of officials at the highest level. In this era of cloud-based computing, leaders may make use of computer-based training, encouraging members of the team to review lessons remotely. If employees have feedback, mechanisms should exist for them to provide feedback in a manner that will not undermine their position—provided they offer the feedback in a good-faith effort to promote compliance.

 

 

Summary:

In summary, the best way to minimize vulnerabilities to government investigations is to create a good compliance program that is consistent with the corporate culture. Document every practice within the company. Show the reasons behind the ways that the company makes decisions. Train team members on how to work within the framework of the corporate culture. Leaders may want to review guidance from the Department of Justice, and question whether the compliance programs they’ve put in place measure up.

A good tactic may include bringing in a neutral third party who has that credentials to ask the questions that investigators will ask. Create a program that will allow leaders of the organization to respond honestly, with their dignity intact. When making a decision on whether to bring charges against a company, government attorneys will ask:

 

1. Is the program well designed?
2. Is the program being implemented effectively?
3. Does the compliance program work in practice?

 

If a company leader can respond to those questions as quickly as he can answer the questions regarding corporate profitability, the leader will have done everything possible to minimize vulnerabilities to a government investigation. In our era of big government, that doesn’t mean a government investigation will not begin. It only means that a company is in as good a position as possible. No one can change past behavior. But we all can work toward minimizing risks in the future.

Visit us at Compliance Mitigation.com

Although we can control our own behavior, we don't always have an ability to know how others will behave. When business leaders delegate responsibilities, they simultaneously raise their level of risk. Business leaders may not know what a team member is saying to a customer or how that team member may be acting in fulfilling job responsibilities. When that happens, the team member may expose the entire company to interference from regulators, or losses from internal fraud.

For example, consider Justin, a co-founder of one of our companies.

Justin graduated from USC and went on to become a stockbroker. While employed as a stockbroker at UBS, he executed market trades on behalf of people that managed private hedge funds. In that role, Justin had insight into account balances for the clients he served; he could also review balances in each of the client accounts at the hedge-fund. UBS trusted Justin took to look after the interests of his clients, and also after the interests of the firm.

When Justin walked into a meeting with one of his clients, he also met with people who had invested in the hedge fund. Those investors showed Justin an account statement that they had received from the hedge-fund manager. When Justin saw the statement, he knew at once that the document had been fraudulently inflated. His client had manipulated the statement to show balances that the client wanted to see, rather than what the account held.

Justin had been earning enormous commissions from the account. Despite seeing first-hand evidence of the fraud, he chose to remain quiet so as not to disturb the income stream from commissions. Rather than reporting the fraud, Justin allowed his client to continue deceiving investors. As a result, Justin immersed himself into an internal fraud that cost his employer millions of dollars. When authorities discovered the fraud, Justin lost his job.

Justin had deceived himself into believing that since he wasn't the person manipulating the financial statements, he wasn't responsible. Yet by continuing to claim commissions for trades that he knew had been predicated on fraud, he became complicitous. Fraud charges may stem from direct participation, or even from the observation of others that participate in fraud. As a result of his complicity, prosecutors brought criminal charges against him. While in prison, he said that while he was in the midst of the crime, he didn't realize the extent of his wrongdoing.

Business leaders and team members can learn from such examples. Many people do not set out to participate in fraudulent schemes. They fall into situations on the job or go through complications in life. Those situations can lead to a dilemma; doing the right thing can have bad consequences:

• A person can lose an income stream,
• A person can be ostracized on the job, and
• A person may have to serve as a witness against someone he or she cares about.

We'd like to believe that people of good character always act appropriately. Yet with the growing number of guilty pleas for white-collar crimes like fraud, bribery, or other types of self-dealing acts, people's characters are constantly tested.

Our team at Compliance Mitigation believes that business leaders would, therefore, be wise to invest more time and resources in training. Despite good intentions, opportunities or bad actors can tempt people. And people can delude themselves with all types of lies to excuse their behavior. When they do, they put their liberty on the line, and they expose the company to enormous costs.

Business leaders that invest time to train may lower a company's risk profile and a company's vulnerability to internal fraud. In earlier modules, we've noted three components that may increase possibilities for fraud:

1. Financial Pressure - such as significant personal debt, credit problems, or some kind of emergency.
2. Opportunity – the ability and capability to take advantage of an opening in either your security system or system of checks and balances.
3. Rationalization – justifications for illicit actions.

Since most people don't seek employment with an intention to commit fraud, it's difficult to predict a person's character during the hiring process. The thought of committing fraud usually occurs over time as circumstances and/or disillusionment sinks in. For this reason, compliance programs should task a specific individual with responsibility to conduct spot checks, or audits, with an expressed goal of looking for signs of internal fraud.

Without good compliance, internal fraud may go undetected for years, as in the following examples:

Example 1: An employee's lifestyle doesn't coincide with income levels

• Rita served as the Comptroller of a small city in Illinois. The $80,000 salary she earned would not support her luxurious lifestyle, including a $2 million custom RV, a vacation home, and a world-class horse breeding farm with 400 horses. Despite splurging on so many extravagant purchases, her peers did not suspect wrongdoing. Over the course of two decades, Rita's internal fraud led to the embezzlement of more than $53 million, a huge sum for such a small city. By abusing her position of trust and authority, she schemed to funnel public money into her private accounts. While Rita was on leave, a temporary worker found confusing paperwork. When the temporary worker called the city's bank, they discovered the fraud. A federal judge sentenced Rita to serve more than 19 years in prison.

Example 2: Personal financial difficulties

• Barbara, a long-time secretary and clerk at a local church, found herself in a bind. She struggled with a gambling addiction that sent her into a spiraling debt. Over nine years, Barbara's losses exceeded $800,000. To cope, she pilfered money from the church's collection basket. After authorities uncovered her fraud, they charged her with crimes. A conviction led to Barbara's nine-year prison term. She claimed that she didn't know her actions could lead to imprisonment. Such statements give us reason to suggest that compliance programs should include human stories of people that broke the law; they should highlight the fallout for business owners and the person who broke the law.

Example 3: Lack of Transparency

• Brian, a charismatic physician, served as the administrative director for 20 years in his practice that included 12 physicians. Despite a robust practice, the group showed paltry profits. Brian had a strong personality, and he could bully the other partners into believing that expenses were high—without providing documentation. If people questioned him, he had the power to ostracize them, or provide less desirable working conditions. Finally, one of the partners hired an outside firm to investigate. The internal investigation showed that, over two decades, Brian bilked the practice out of more than $25 million. A conviction led to a prison term of more than 20 years.

Example 4: An employee colludes with vendors

• Tony, a construction manager for a fast-growing media company oversaw projects around the world. In that role, he had the discretion to assign contracts to various suppliers, contractors, and subcontractors. Some of those contracts exceeded millions of dollars in value. Although his employer paid Tony an excellent salary, he supplemented his income by accepting bribes from contractors that wanted to do business with him. The people paying the bribe would get the job, but without having to compete on price, victimizing Tony's employer. Over the course of five years, authorities accused Tony of participating in a bribery scheme that exceeded $5 million in value. After a guilty plea, a federal judge sentenced Tony to serve a five-year prison term. Further, besides suffering losses as a result of Tony's betrayal, the company lost millions of dollars in additional legal costs resulting from both an internal investigation, and a government investigation.

Minimizing Vulnerabilities:

Although we can control our own behavior, none of us can control the choices that other people make. A person may seem to be a pillar of propriety, but circumstances may lead that person to make bad decisions, or to act out of character. Those bad decisions can lead a business, or other people, into investigations that reveal internal fraud and potential liability to criminal charges.

To minimize vulnerabilities, we recommend that business leaders create compliance systems and best practices for their organizations. Good CRM systems may help. Companies that train others on the dangers of white-collar crime may go a long way toward minimizing vulnerabilities to internal fraud.

Visit us at Compliance Mitigation.com

 

Although we can control our own behavior, we don’t always have an ability to know how others will behave. When business leaders delegate responsibilities, they simultaneously raise their level of risk. Business leaders may not know what a team member is saying to a customer or how that team member may be acting in fulfilling job responsibilities. When that happens, the team member may expose the entire company to interference from regulators, or losses from internal fraud.

For example, consider Justin, a co-founder of one of our companies.

Justin graduated from USC and went on to become a stockbroker. While employed as a stockbroker at UBS, he executed market trades on behalf of people that managed private hedge funds. In that role, Justin had insight into account balances for the clients he served; he could also review balances in each of the client accounts at the hedge-fund. UBS trusted Justin took to look after the interests of his clients, and also after the interests of the firm.

When Justin walked into a meeting with one of his clients, he also met with people who had invested in the hedge fund. Those investors showed Justin an account statement that they had received from the hedge-fund manager. When Justin saw the statement, he knew at once that the document had been fraudulently inflated. His client had manipulated the statement to show balances that the client wanted to see, rather than what the account held.

Justin had been earning enormous commissions from the account. Despite seeing first-hand evidence of the fraud, he chose to remain quiet so as not to disturb the income stream from commissions. Rather than reporting the fraud, Justin allowed his client to continue deceiving investors. As a result, Justin immersed himself into an internal fraud that cost his employer millions of dollars. When authorities discovered the fraud, Justin lost his job.

Justin had deceived himself into believing that since he wasn’t the person manipulating the financial statements, he wasn’t responsible. Yet by continuing to claim commissions for trades that he knew had been predicated on fraud, he became complicitous. Fraud charges may stem from direct participation, or even from the observation of others that participate in fraud. As a result of his complicity, prosecutors brought criminal charges against him. While in prison, he said that while he was in the midst of the crime, he didn’t realize the extent of his wrongdoing.

Business leaders and team members can learn from such examples. Many people do not set out to participate in fraudulent schemes. They fall into situations on the job or go through complications in life. Those situations can lead to a dilemma; doing the right thing can have bad consequences:

• A person can lose an income stream,
• A person can be ostracized on the job, and
• A person may have to serve as a witness against someone he or she cares about.

We’d like to believe that people of good character always act appropriately. Yet with the growing number of guilty pleas for white-collar crimes like fraud, bribery, or other types of self-dealing acts, people’s characters are constantly tested.

Our team at Compliance Mitigation believes that business leaders would, therefore, be wise to invest more time and resources in training. Despite good intentions, opportunities or bad actors can tempt people. And people can delude themselves with all types of lies to excuse their behavior. When they do, they put their liberty on the line, and they expose the company to enormous costs.

Business leaders that invest time to train may lower a company’s risk profile and a company’s vulnerability to internal fraud. In earlier modules, we’ve noted three components that may increase possibilities for fraud:

1. Financial Pressure - such as significant personal debt, credit problems, or some kind of emergency.
2. Opportunity – the ability and capability to take advantage of an opening in either your security system or system of checks and balances.
3. Rationalization – justifications for illicit actions.

Since most people don’t seek employment with an intention to commit fraud, it’s difficult to predict a person’s character during the hiring process. The thought of committing fraud usually occurs over time as circumstances and/or disillusionment sinks in. For this reason, compliance programs should task a specific individual with responsibility to conduct spot checks, or audits, with an expressed goal of looking for signs of internal fraud.

Without good compliance, internal fraud may go undetected for years, as in the following examples:

 

Example 1: An employee's lifestyle doesn’t coincide with income levels

• Rita served as the Comptroller of a small city in Illinois. The $80,000 salary she earned would not support her luxurious lifestyle, including a $2 million custom RV, a vacation home, and a world-class horse breeding farm with 400 horses. Despite splurging on so many extravagant purchases, her peers did not suspect wrongdoing. Over the course of two decades, Rita’s internal fraud led to the embezzlement of more than $53 million, a huge sum for such a small city. By abusing her position of trust and authority, she schemed to funnel public money into her private accounts. While Rita was on leave, a temporary worker found confusing paperwork. When the temporary worker called the city’s bank, they discovered the fraud. A federal judge sentenced Rita to serve more than 19 years in prison.

 

Example 2: Personal financial difficulties

• Barbara, a long-time secretary and clerk at a local church, found herself in a bind. She struggled with a gambling addiction that sent her into a spiraling debt. Over nine years, Barbara’s losses exceeded $800,000. To cope, she pilfered money from the church’s collection basket. After authorities uncovered her fraud, they charged her with crimes. A conviction led to Barbara’s nine-year prison term. She claimed that she didn’t know her actions could lead to imprisonment. Such statements give us reason to suggest that compliance programs should include human stories of people that broke the law; they should highlight the fallout for business owners and the person who broke the law.  

 

Example 3: Lack of Transparency

• Brian, a charismatic physician, served as the administrative director for 20 years in his practice that included 12 physicians. Despite a robust practice, the group showed paltry profits. Brian had a strong personality, and he could bully the other partners into believing that expenses were high—without providing documentation. If people questioned him, he had the power to ostracize them, or provide less desirable working conditions. Finally, one of the partners hired an outside firm to investigate. The internal investigation showed that, over two decades, Brian bilked the practice out of more than $25 million. A conviction led to a prison term of more than 20 years.

 

Example 4: An employee colludes with vendors

• Tony, a construction manager for a fast-growing media company oversaw projects around the world. In that role, he had the discretion to assign contracts to various suppliers, contractors, and subcontractors. Some of those contracts exceeded millions of dollars in value. Although his employer paid Tony an excellent salary, he supplemented his income by accepting bribes from contractors that wanted to do business with him. The people paying the bribe would get the job, but without having to compete on price, victimizing Tony’s employer. Over the course of five years, authorities accused Tony of participating in a bribery scheme that exceeded $5 million in value. After a guilty plea, a federal judge sentenced Tony to serve a five-year prison term. Further, besides suffering losses as a result of Tony’s betrayal, the company lost millions of dollars in additional legal costs resulting from both an internal investigation, and a government investigation.

 

 

Minimizing Vulnerabilities:

Although we can control our own behavior, none of us can control the choices that other people make. A person may seem to be a pillar of propriety, but circumstances may lead that person to make bad decisions, or to act out of character. Those bad decisions can lead a business, or other people, into investigations that reveal internal fraud and potential liability to criminal charges.

To minimize vulnerabilities, we recommend that business leaders create compliance systems and best practices for their organizations. Good CRM systems may help. Companies that train others on the dangers of white-collar crime may go a long way toward minimizing vulnerabilities to internal fraud.

Establishing a compliance and training system begins with a commitment to transparency. The first step would be to document the company's story and the value proposition it offers to consumers. The next step would be to write a process map and training schedule. The more detail leaders can bring to the process map, the more they will minimize exposure or vulnerability to a government investigation.

Ideally, the process map would include details of every function, including:

• How the business goes about recruiting staff,
• How the business organizes its hierarchy of positions,
• How the business compensates staff members,
• The roles and responsibilities of each staff position,
• How the company trains staff members,
• How the company attracts customers,
• How the company selects vendors,
• How the company processes customer orders, and
• How the company retains records.

Documenting the company story should show the company's good-faith effort to operate in compliance with all regulations and laws.

Further, the training should help all stakeholders understand consequences that can follow for those who fail to comply with the company's policies and procedures. Resources from the Department of Justice and various regulatory agencies show that transparency goes a long way toward protecting the business and the people that build careers in the business.

Training will lessen a business's exposure to charges of fraud, but it can also lessen a company's risk of becoming a victim of fraud. Our team members at Compliance Mitigation have worked with more than 1,000 people that have been charged with white-collar crimes.

Those people claim to have begun careers with the best of intentions. Somehow, circumstances changed for them. As a result, some of them became less vigilant about ethics or morality. Other times, they broke laws without knowing how they were putting themselves and their companies at risk. Good training will lower the company's risk profile. If that training includes lessons on the consequences of white-collar crime, more people may refrain from making the kinds of decisions that lead to criminal prosecution.

Overall Objectives:

1. If done well, compliance training will help everyone in the company get a clear understanding of corporate messaging. With better messaging, everyone on the team should work together to build a more efficient and profitable enterprise.
2. The compliance training should help employees grasp internal rules and regulations critical to their job responsibilities and tasks.
3. A good compliance training program helps a company avoid penalties and even potential lawsuits.
4. Simultaneously, it should improve employee efficiency, productivity, and satisfaction on the job.

General Requirements:

For a compliance training system to work effectively, the leadership team must commit. If the leaders embrace the organization's goals and culture, the entire team will be more effective. Leaders should understand the relevant laws and know how to manage risk. Further, they should understand how lowering risk levels can lead to a company's positive reputation, lessening the potential for penalties or lawsuits.

Without good leadership, the company may be vulnerable. The regulatory landscape may change, which could bring further problems. Leaders should give clear guidance with regard to all compliance matters.

Besides commitment, the leadership team must implement the training effectively. Our team recommends creating logs to measure the following key objectives of compliance training:

1. Do all staff members understand their compliance responsibilities?
2. Does everyone understand how the compliance program reduces risk?
3. In what ways does the compliance program minimize potential legal liability?
4. How does the compliance program protect the company's reputation?
5. In what ways does the compliance program encourage integrity in the corporate culture?

Compliance training should cover internal regulations as well as external laws. Good leaders will understand the importance of identifying areas at high risk for non-compliance. They would then prioritize resources to document a strategy showing sensible controls. A good compliance system is like a good defense, providing leaders with confidence that they could respond to an investigator's questions.

After covering the high-risk areas, leaders should create systems to show their commitment to good corporate citizenship. For example, the company may develop policies to show the business's position on:

• Customer service standards,
• Anti-harassment,
• Anti-discrimination,
• Anti-sexual harassment,
• Conflicts of interest,
• Code of ethical conduct,
• Client confidentiality,
• Health and safety issues,
• Reporting protocols, and
• Issues particular to the business's industry.

We encourage leaders to bring the training to life with human stories and interactive exercises. The business may build a stronger case of showing its commitment to compliance by designing quizzes that measure what each participant learned. By making those participant responses a part of each employee's file, the company can build a stronger case of its commitment to compliance.

When employees earn their livelihoods from contacting clients over the phone, for example, leaders may want to include training exercises that profile dangers associated with the FTC's Telemarketing Sales Rule and the Do Not Call List. The FTC regularly brings cases against small, medium, and large organizations if their investigations reveal a violation of FTC rules. The FTC's website highlights how those investigations have led to injunctions, fines, asset freezes, and massive judgments against business leaders that profess ignorance of how they were violating rules, regulations, or laws.

Consider the FTC case against Sanctuary Belize. In that case, a real estate developer used television commercials to advertise a 14,000-acre community in Belize. The commercials attracted viewers with images of crystal-clear water, palm trees, and white-sandy beaches. Those commercials induced people to visit the company's website. The website brought attention to what the developer called "a world-class marina" and other amenities at the project. Consumers that wanted to learn more would fill out a lead-capture form on the website, expressing interest in speaking with one of the developer's sales reps.

Telemarketers would contact the prospective buyers to schedule appointments. They would show a computer screenshare of the property and respond to questions from the consumers. If the consumer expressed interest, the telemarketer would coordinate a tour of the property in Belize. When consumers saw the property in Belize, they would make a decision on whether to purchase property in the development.

Using that technique, the developer entered into contracts with consumers, selling more than 1,000 homesites in his massive development. Sales surpassed $100 million.

The Federal Trade Commission launched an investigation, conducting an undercover call with the developer. Investigators at the FTC went through the entire telemarketing pitch. Although they never visited the property in Belize, they built a case to accuse the developer of deceiving consumers. The FTC alleged that developer deceived consumers with coordinated misrepresentations.

As a result of those charges, investigators from FTC stormed the developer's offices in Irvine, California. They seized computer records, all scripts, and other evidence to build a case. They began an investigation that turned telemarketers, managers, and leaders into either witnesses, subjects, or targets of their investigation. A lawsuit in federal court resulted in an asset freeze. Litigation expenses soared to several million dollars. In the end, a federal court issued a judgment in excess of $100 million. Further, the court placed enormous sanctions on the defendants, placing an earning cap of $5,000 per month on certain defendants; that earning cap would last a lifetime, or until the FTC fully recovered the full $100+ million judgment.

Had the company made a bigger investment in documenting the story, as well as its commitment to compliance training, the company's leaders may have had a better defense against FTC allegations that they were operating a scam.

Regular Training:

Regular training represents another key component to an effective compliance program. If the program does not offer regular training, it will not move the needle in arguing for leniency or non-prosecution agreements in a government investigation. The company must show a true commitment to building a culture of truth, honesty, and transparency.

A good online system that makes all of the training material easily accessible would show such a commitment to compliance. Some training programs may require interactive exercises, while others may require independent learning. All compliance programs should have a takeaway, showing that participants are learning. When companies build records of compliance training, they protect the enterprise, the leaders, and the entire team.

Each component of the compliance training program should include a designated person, or responsible party. That person should have the appropriate training to oversee compliance. For example, the person in charge of training telemarketers should show fluency with the FTC Act and the Do Not Call List.They should be able to show how and why the company trains all team members to comply with such rules.

It's important to ensure that all employees have an opportunity to speak with a responsible party. The company must be able to tell a story demonstrating the investment it made to operate in accordance with all regulations and laws.

Regular Analysis:

With changes in the regulatory landscape, an enterprise must show a concerted effort to stay on top of changes in laws and regulations and a pattern of continuously analyzing the effectiveness of its compliance or training program. Leaders should record every change, showing the company's commitment to excellence. By documenting best practices, the company goes a long way toward building credibility with investigators.

Some useful tools to demonstrate a willingness to analyze and improve may include:

• Confidential performance reviews from immediate superiors,
• Confidential performance reviews from subordinates,
• Randomized peer reviews,
• Quarterly reviews by senior management,
• Periodic company-wide town halls to discuss the general direction of the company and important corporate developments,
• Management accessibility via internal email, and
• Documented strategies for internal corporate communications.

An effective compliance program will show a company's commitment to do the right thing all the time, leading to more confidence that the enterprise can withstand an inquiry by investigators. Regulators look favorably upon such programs. By enacting steps to analyze and improve compliance policies, leaders show that they are not running the company by the seat-of-their pants, and that they're not engaging in willful blindness that can lead to charges of criminal negligence.

Case Study:

Members of our team at Compliance Mitigation served time alongside thousands of other people who were convicted of white-collar crimes. We knew one person who owned a brokerage firm that specialized in trading bonds. As the company grew, the owner began to delegate responsibilities for day-to-day trading activities. Instead of overseeing trades, the owner focused on bringing in more capital. That strategy would have been fine, provided that the owner created well-documented and vetted compliance systems. Sadly, the owner did not.

Changing market conditions resulted in one of the lead traders making a series of unprofitable transactions. The trader then launched a series of events to cover up his decisions. When markets went against him, he lost more money than authorized, resulting in a margin call. The owner said that he was not aware of the losses, and he lacked the capital to meet the margin call. Chaos ensued, leading to a flash crash and obliterating the company's entire portfolio.

The owner of the bond trading firm lost everything. A government investigation followed. Prosecutors brought charges against many people, including the owner for his criminal negligence in failing to supervise employees. After a guilty verdict, a judge sentenced the owner to serve a prison term of longer than 10 years and saddled him with a restitution order measured in the hundreds of millions of dollars.

Our team at Compliance Mitigation cannot vouch for the validity of what the owner told us—after all, we met him inside of a federal prison. On the other hand, we can say that if he had devised a better compliance system, he would have had a stronger defense against the charges that the government brought against him.

Elements of an Effective Compliance Program:

Like a three-legged stool, in order to stand, an effective compliance program should have three components:

1. The program should be clear with its objectives, communicating a commitment to compliance for all members of the enterprise;
2. It should show a commitment to transparency; and
3. It should include training on well-documented written policies, procedures, and standards of conduct. Having clear written policies and procedures in place that describe compliance expectations fosters uniformity within the company.

Without all three components, the compliance program will not serve much purpose in protecting the leaders or members of the enterprise. A clear authority figure should oversee the compliance program, and the person in that role should have appropriate training for oversight. That person must accept responsibility for staff training and demonstrate a good-faith effort to ensure every person in the enterprise understands the purpose behind every policy. Some compliance training will be basic, essential for all new hires. Other training modules may require monthly or even daily accountability logs.

A good system will encourage two-way communication throughout the organization. All team members should express confidence that the organization will consider their ideas for improvement. If the organization is willing to listen to concerns, the company can strengthen its defense of its commitment to act as a good corporate citizen.

All compliance training should include steps to document how the responsible person within the company monitors and audits compliance. A robust monitoring and auditing system may induce all company representatives to comply and shows corporate commitment to doing the right thing. Such tactics should:

• Lessen the company's exposure to risks,
• Contribute to more efficient operations,
• Improve corporate messaging,
• Heighten each team member's awareness of the dangers of government investigations, and
• Offer more insight to the risk levels associated with white-collar crime.

Corporate leadership must have the courage to be swift and certain when it comes to discipline. Sometimes, such a commitment can lead to an ethical dilemma. If a person serves in a leadership role and has a history of being a rainmaker for the company, owners may be reluctant to discipline the individual for noncompliance. Yet if the rainmaker undermines the enterprise's commitment to compliance, the level of risk increases, often well in excess of the perceived benefit of the business generated by such rainmaker.

Again, leaders protect a company with well-documented commitments to transparency. If a team member fails to comply with program requirements, a clear record should show the appropriate corporate response.

When a company identifies vulnerabilities or violations through monitoring and auditing, management must take timely, consistent action to correct the issue. No company can implement a compliance program expecting to have considered all possibilities. We never know what we don't know. For this reason, leaders within the enterprise should build a record of analyzing corporate compliance and making improvements when necessary.

How to Best Articulate a Company's Compliance Program:

Google caught the world's attention with its simple corporate motto: "Don't do evil." Since then, it's become the target of several government investigations.

A company strengthens itself when it clarifies the corporate mission, then builds a compliance program that reflects a commitment to the mission. To that end, a company should establish and maintain a culture that promotes:

• Quality and efficiency,
• High standards of ethical and business conduct,
• The effective operation of the business,
• High-standard maintenance of customer, client and vendor relationships, and
• The prevention, detection and resolution of conduct that does not conform to the company's standards and policies and applicable law.

A commitment to compliance should reflect those qualities above. It should apply to all company personnel equally, including but not limited to senior management, administration, personnel, ongoing contractors and all full-time and part-time employees of an organization.

All company programs should include elements that reflect best practices, including:

1. Written standards, policies and procedures to promote the company's commitment to compliance with its own proscribed code of corporate conduct, applicable laws and regulations,
2. Designation of an employee as the Compliance Officer (at least, as a part of the employee's overall job description) or the hiring of a full-time Compliance Officer charged, with the responsibility of implementing and monitoring the Compliance Program,
3. Designation of a Compliance Committee, if the corporate size warrants,
4. Regular, effective education and training programs for all personnel as appropriate to their functions,
5. A process to receive complaints concerning possible Compliance Program violations, procedures to protect the anonymity of complainants to the extent possible, and policies that protect complainants from retaliation,
6. Granting the Compliance Officer and/or the Compliance Committee, as the case may be, sufficient authority to investigate, report and make recommendations directly to senior management and the Board of Directors regarding any irregularities and all findings,
7. A process to respond to allegations of improper activities and the enforcement of appropriate disciplinary action against personnel who have violated policies, laws, regulations, or program requirements,
8. Periodic audits or other methods to monitor compliance and assist in the reduction of problems in any identified areas,
9. A process for investigating and resolving any identified problems, after investigation, report and recommendation by the Compliance Officer and/or Compliance Committee, as the case may be, and
10. A document stating the foregoing points that all stakeholders sign, including a member of senior management, the Compliance Officer and the employee, either upon initial implementation of the program or upon the hiring of any new employee.

The company's compliance program should grow stronger and more effective over time, becoming an integral part of the corporate culture. When company leaders fail to implement a compliance or training program, they expose themselves and their team members to higher levels of risk.

As stated at the start of this module, the company should create an accurate organizational chart, defining excellence within each role of the organization. Such an organizational chart should become a part of the enterprise process map, illustrating the functions and responsibilities of every role. For example, the organizational chart should articulate the role of senior executives, showing responsibility for:

1. Evaluating risks that result from non-compliance with rules and regulations,
2. Approving and supporting the compliance program, and
3. Overseeing the performance of the compliance program to reduce risk.

The chart should show who bears responsibility to train on:

1. Compliance with laws and regulations,
2. Regulatory requirements of each functionary within the organization,
3. The company's internal rules and codes of conduct, and
4. How the company works to remediate weaknesses and prevent violations.

The Compliance Officer/Committee should accept responsibility for:

1. Coordinating audits and examinations in connections with laws, regulations and corporate rules and codes of conduct,
2. Acting in an advisory capacity on the company's policies and procedures,
3. Monitoring corporate transactions, functions, events and internal systems seeking violations and to uphold the integrity of the organization, and
4. Communicating issues to Senior Management and the Board of Directors.

Employees should acknowledge responsibility for:

1. Acknowledging that they've been trained in the compliance program,
2. Acting in accordance with the company's compliance program,
3. Partaking and engaging in all of the company's compliance program activities,
4. Reporting any violations of the company's compliance program to either a direct manager or the Compliance Officer/Committee, confidentially or otherwise, as the case may be.

As a living, breathing entity, the enterprise should maintain the compliance program to protect against disruptions from litigation and government investigations, as well as to show a commitment to professionalizing the business. An effective program would demonstrate how the company pursues excellence, which leads to more success for all team members.

Establishing a compliance and training system begins with a commitment to transparency. The first step would be to document the company’s story and the value proposition it offers to consumers. The next step would be to write a process map and training schedule. The more detail leaders can bring to the process map, the more they will minimize exposure or vulnerability to a government investigation.

Ideally, the process map would include details of every function, including:

• How the business goes about recruiting staff,
• How the business organizes its hierarchy of positions,
• How the business compensates staff members,
• The roles and responsibilities of each staff position,
• How the company trains staff members,
• How the company attracts customers,
• How the company selects vendors,
• How the company processes customer orders, and
• How the company retains records.

Documenting the company story should show the company’s good-faith effort to operate in compliance with all regulations and laws.

Further, the training should help all stakeholders understand consequences that can follow for those who fail to comply with the company’s policies and procedures. Resources from the Department of Justice and various regulatory agencies show that transparency goes a long way toward protecting the business and the people that build careers in the business.

Training will lessen a business’s exposure to charges of fraud, but it can also lessen a company’s risk of becoming a victim of fraud. Our team members at Compliance Mitigation have worked with more than 1,000 people that have been charged with white-collar crimes.

Those people claim to have begun careers with the best of intentions. Somehow, circumstances changed for them. As a result, some of them became less vigilant about ethics or morality. Other times, they broke laws without knowing how they were putting themselves and their companies at risk. Good training will lower the company’s risk profile. If that training includes lessons on the consequences of white-collar crime, more people may refrain from making the kinds of decisions that lead to criminal prosecution.

 

Overall Objectives:

1. If done well, compliance training will help everyone in the company get a clear understanding of corporate messaging. With better messaging, everyone on the team should work together to build a more efficient and profitable enterprise.
2. The compliance training should help employees grasp internal rules and regulations critical to their job responsibilities and tasks.
3. A good compliance training program helps a company avoid penalties and even potential lawsuits.
4. Simultaneously, it should improve employee efficiency, productivity, and satisfaction on the job.

 

 

General Requirements:

For a compliance training system to work effectively, the leadership team must commit. If the leaders embrace the organization’s goals and culture, the entire team will be more effective. Leaders should understand the relevant laws and know how to manage risk. Further, they should understand how lowering risk levels can lead to a company’s positive reputation, lessening the potential for penalties or lawsuits.

Without good leadership, the company may be vulnerable. The regulatory landscape may change, which could bring further problems. Leaders should give clear guidance with regard to all compliance matters.

Besides commitment, the leadership team must implement the training effectively. Our team recommends creating logs to measure the following key objectives of compliance training:

 

1. Do all staff members understand their compliance responsibilities?
2. Does everyone understand how the compliance program reduces risk?
3. In what ways does the compliance program minimize potential legal liability?
4. How does the compliance program protect the company’s reputation?
5. In what ways does the compliance program encourage integrity in the corporate culture?

 

Compliance training should cover internal regulations as well as external laws. Good leaders will understand the importance of identifying areas at high risk for non-compliance. They would then prioritize resources to document a strategy showing sensible controls. A good compliance system is like a good defense, providing leaders with confidence that they could respond to an investigator’s questions.

After covering the high-risk areas, leaders should create systems to show their commitment to good corporate citizenship. For example, the company may develop policies to show the business’s position on:

• Customer service standards,
• Anti-harassment,
• Anti-discrimination,
• Anti-sexual harassment,
• Conflicts of interest,
• Code of ethical conduct,
• Client confidentiality,
• Health and safety issues,
• Reporting protocols, and
• Issues particular to the business’s industry.

 

We encourage leaders to bring the training to life with human stories and interactive exercises. The business may build a stronger case of showing its commitment to compliance by designing quizzes that measure what each participant learned. By making those participant responses a part of each employee’s file, the company can build a stronger case of its commitment to compliance.

When employees earn their livelihoods from contacting clients over the phone, for example, leaders may want to include training exercises that profile dangers associated with the FTC’s Telemarketing Sales Rule and the Do Not Call List. The FTC regularly brings cases against small, medium, and large organizations if their investigations reveal a violation of FTC rules. The FTC’s website highlights how those investigations have led to injunctions, fines, asset freezes, and massive judgments against business leaders that profess ignorance of how they were violating rules, regulations, or laws.

Consider the FTC case against Sanctuary Belize. In that case, a real estate developer used television commercials to advertise a 14,000-acre community in Belize. The commercials attracted viewers with images of crystal-clear water, palm trees, and white-sandy beaches. Those commercials induced people to visit the company’s website. The website brought attention to what the developer called “a world-class marina” and other amenities at the project. Consumers that wanted to learn more would fill out a lead-capture form on the website, expressing interest in speaking with one of the developer’s sales reps.

Telemarketers would contact the prospective buyers to schedule appointments. They would show a computer screenshare of the property and respond to questions from the consumers. If the consumer expressed interest, the telemarketer would coordinate a tour of the property in Belize. When consumers saw the property in Belize, they would make a decision on whether to purchase property in the development.

Using that technique, the developer entered into contracts with consumers, selling more than 1,000 homesites in his massive development. Sales surpassed $100 million.

The Federal Trade Commission launched an investigation, conducting an undercover call with the developer. Investigators at the FTC went through the entire telemarketing pitch. Although they never visited the property in Belize, they built a case to accuse the developer of deceiving consumers. The FTC alleged that developer deceived consumers with coordinated misrepresentations.

As a result of those charges, investigators from FTC stormed the developer’s offices in Irvine, California. They seized computer records, all scripts, and other evidence to build a case. They began an investigation that turned telemarketers, managers, and leaders into either witnesses, subjects, or targets of their investigation. A lawsuit in federal court resulted in an asset freeze. Litigation expenses soared to several million dollars. In the end, a federal court issued a judgment in excess of $100 million. Further, the court placed enormous sanctions on the defendants, placing an earning cap of $5,000 per month on certain defendants; that earning cap would last a lifetime, or until the FTC fully recovered the full $100+ million judgment.

Had the company made a bigger investment in documenting the story, as well as its commitment to compliance training, the company’s leaders may have had a better defense against FTC allegations that they were operating a scam.

 

 

Regular Training:

 

Regular training represents another key component to an effective compliance program. If the program does not offer regular training, it will not move the needle in arguing for leniency or non-prosecution agreements in a government investigation. The company must show a true commitment to building a culture of truth, honesty, and transparency.

A good online system that makes all of the training material easily accessible would show such a commitment to compliance. Some training programs may require interactive exercises, while others may require independent learning. All compliance programs should have a takeaway, showing that participants are learning. When companies build records of compliance training, they protect the enterprise, the leaders, and the entire team.

Each component of the compliance training program should include a designated person, or responsible party. That person should have the appropriate training to oversee compliance. For example, the person in charge of training telemarketers should show fluency with the FTC Act and the Do Not Call List.They should be able to show how and why the company trains all team members to comply with such rules.

It’s important to ensure that all employees have an opportunity to speak with a responsible party. The company must be able to tell a story demonstrating the investment it made to operate in accordance with all regulations and laws.

 

 

Regular Analysis:

With changes in the regulatory landscape, an enterprise must show a concerted effort to stay on top of changes in laws and regulations and a pattern of continuously analyzing the effectiveness of its compliance or training program. Leaders should record every change, showing the company’s commitment to excellence. By documenting best practices, the company goes a long way toward building credibility with investigators.

Some useful tools to demonstrate a willingness to analyze and improve may include:

• Confidential performance reviews from immediate superiors,
• Confidential performance reviews from subordinates,
• Randomized peer reviews,
• Quarterly reviews by senior management,
• Periodic company-wide town halls to discuss the general direction of the company and important corporate developments,
• Management accessibility via internal email, and
• Documented strategies for internal corporate communications.

An effective compliance program will show a company’s commitment to do the right thing all the time, leading to more confidence that the enterprise can withstand an inquiry by investigators. Regulators look favorably upon such programs. By enacting steps to analyze and improve compliance policies, leaders show that they are not running the company by the seat-of-their pants, and that they’re not engaging in willful blindness that can lead to charges of criminal negligence.

 

 

Case Study:

Members of our team at Compliance Mitigation served time alongside thousands of other people who were convicted of white-collar crimes. We knew one person who owned a brokerage firm that specialized in trading bonds. As the company grew, the owner began to delegate responsibilities for day-to-day trading activities. Instead of overseeing trades, the owner focused on bringing in more capital. That strategy would have been fine, provided that the owner created well-documented and vetted compliance systems. Sadly, the owner did not.

Changing market conditions resulted in one of the lead traders making a series of unprofitable transactions. The trader then launched a series of events to cover up his decisions. When markets went against him, he lost more money than authorized, resulting in a margin call. The owner said that he was not aware of the losses, and he lacked the capital to meet the margin call. Chaos ensued, leading to a flash crash and obliterating the company’s entire portfolio.

The owner of the bond trading firm lost everything. A government investigation followed. Prosecutors brought charges against many people, including the owner for his criminal negligence in failing to supervise employees. After a guilty verdict, a judge sentenced the owner to serve a prison term of longer than 10 years and saddled him with a restitution order measured in the hundreds of millions of dollars.

Our team at Compliance Mitigation cannot vouch for the validity of what the owner told us—after all, we met him inside of a federal prison. On the other hand, we can say that if he had devised a better compliance system, he would have had a stronger defense against the charges that the government brought against him.

 

 

Elements of an Effective Compliance Program:

Like a three-legged stool, in order to stand, an effective compliance program should have three components:

1. The program should be clear with its objectives, communicating a commitment to compliance for all members of the enterprise;
2. It should show a commitment to transparency; and
3. It should include training on well-documented written policies, procedures, and standards of conduct. Having clear written policies and procedures in place that describe compliance expectations fosters uniformity within the company.

Without all three components, the compliance program will not serve much purpose in protecting the leaders or members of the enterprise. A clear authority figure should oversee the compliance program, and the person in that role should have appropriate training for oversight. That person must accept responsibility for staff training and demonstrate a good-faith effort to ensure every person in the enterprise understands the purpose behind every policy. Some compliance training will be basic, essential for all new hires. Other training modules may require monthly or even daily accountability logs.

A good system will encourage two-way communication throughout the organization. All team members should express confidence that the organization will consider their ideas for improvement. If the organization is willing to listen to concerns, the company can strengthen its defense of its commitment to act as a good corporate citizen.

All compliance training should include steps to document how the responsible person within the company monitors and audits compliance. A robust monitoring and auditing system may induce all company representatives to comply and shows corporate commitment to doing the right thing. Such tactics should:

 

• Lessen the company’s exposure to risks,
• Contribute to more efficient operations,
• Improve corporate messaging,
• Heighten each team member’s awareness of the dangers of government investigations, and
• Offer more insight to the risk levels associated with white-collar crime.

 

Corporate leadership must have the courage to be swift and certain when it comes to discipline. Sometimes, such a commitment can lead to an ethical dilemma. If a person serves in a leadership role and has a history of being a rainmaker for the company, owners may be reluctant to discipline the individual for noncompliance. Yet if the rainmaker undermines the enterprise’s commitment to compliance, the level of risk increases, often well in excess of the perceived benefit of the business generated by such rainmaker.

Again, leaders protect a company with well-documented commitments to transparency. If a team member fails to comply with program requirements, a clear record should show the appropriate corporate response.

When a company identifies vulnerabilities or violations through monitoring and auditing, management must take timely, consistent action to correct the issue. No company can implement a compliance program expecting to have considered all possibilities. We never know what we don’t know. For this reason, leaders within the enterprise should build a record of analyzing corporate compliance and making improvements when necessary.

 

 

How to Best Articulate a Company’s Compliance Program:

Google caught the world’s attention with its simple corporate motto: “Don’t do evil.” Since then, it’s become the target of several government investigations.

A company strengthens itself when it clarifies the corporate mission, then builds a compliance program that reflects a commitment to the mission. To that end, a company should establish and maintain a culture that promotes:

• Quality and efficiency,
• High standards of ethical and business conduct,
• The effective operation of the business,
• High-standard maintenance of customer, client and vendor relationships, and
• The prevention, detection and resolution of conduct that does not conform to the company’s standards and policies and applicable law.

A commitment to compliance should reflect those qualities above. It should apply to all company personnel equally, including but not limited to senior management, administration, personnel, ongoing contractors and all full-time and part-time employees of an organization.

All company programs should include elements that reflect best practices, including:

 

1. Written standards, policies and procedures to promote the company’s commitment to compliance with its own proscribed code of corporate conduct, applicable laws and regulations,
2. Designation of an employee as the Compliance Officer (at least, as a part of the employee’s overall job description) or the hiring of a full-time Compliance Officer charged, with the responsibility of implementing and monitoring the Compliance Program,
3. Designation of a Compliance Committee, if the corporate size warrants,
4. Regular, effective education and training programs for all personnel as appropriate to their functions,
5. A process to receive complaints concerning possible Compliance Program violations, procedures to protect the anonymity of complainants to the extent possible, and policies that protect complainants from retaliation,
6. Granting the Compliance Officer and/or the Compliance Committee, as the case may be, sufficient authority to investigate, report and make recommendations directly to senior management and the Board of Directors regarding any irregularities and all findings,
7. A process to respond to allegations of improper activities and the enforcement of appropriate disciplinary action against personnel who have violated policies, laws, regulations, or program requirements,
8. Periodic audits or other methods to monitor compliance and assist in the reduction of problems in any identified areas,
9. A process for investigating and resolving any identified problems, after investigation, report and recommendation by the Compliance Officer and/or Compliance Committee, as the case may be, and
10. A document stating the foregoing points that all stakeholders sign, including a member of senior management, the Compliance Officer and the employee, either upon initial implementation of the program or upon the hiring of any new employee.

 

The company’s compliance program should grow stronger and more effective over time, becoming an integral part of the corporate culture. When company leaders fail to implement a compliance or training program, they expose themselves and their team members to higher levels of risk.

As stated at the start of this module, the company should create an accurate organizational chart, defining excellence within each role of the organization. Such an organizational chart should become a part of the enterprise process map, illustrating the functions and responsibilities of every role. For example, the organizational chart should articulate the role of senior executives, showing responsibility for:

1. Evaluating risks that result from non-compliance with rules and regulations,
2. Approving and supporting the compliance program, and
3. Overseeing the performance of the compliance program to reduce risk.

The chart should show who bears responsibility to train on:

1. Compliance with laws and regulations,
2. Regulatory requirements of each functionary within the organization,
3. The company’s internal rules and codes of conduct, and
4. How the company works to remediate weaknesses and prevent violations.

The Compliance Officer/Committee should accept responsibility for:

1. Coordinating audits and examinations in connections with laws, regulations and corporate rules and codes of conduct,
2. Acting in an advisory capacity on the company’s policies and procedures,
3. Monitoring corporate transactions, functions, events and internal systems seeking violations and to uphold the integrity of the organization, and
4. Communicating issues to Senior Management and the Board of Directors.

 

Employees should acknowledge responsibility for:

1. Acknowledging that they’ve been trained in the compliance program,
2. Acting in accordance with the company’s compliance program,
3. Partaking and engaging in all of the company’s compliance program activities,
4. Reporting any violations of the company’s compliance program to either a direct manager or the Compliance Officer/Committee, confidentially or otherwise, as the case may be.

 

As a living, breathing entity, the enterprise should maintain the compliance program to protect against disruptions from litigation and government investigations, as well as to show a commitment to professionalizing the business. An effective program would demonstrate how the company pursues excellence, which leads to more success for all team members.

Visit us at ComplianceMitigation.com

What are some of the early signs that a government agency has launched an investigation? Subtle clues may surface. For example, a trusted friend or colleague may start asking questions, or sending emails that detail criminal acts.

Those inquiries may be fishing expeditions, or an effort to get incriminating evidence, like an admission of complicity in wrongdoing. It's important to understand that, in many cases, informants provide ammunition that investigators use to expand government investigations.

Investigators want to learn as much as possible, and they want to bring as many people as possible into the investigation. By questioning people as:

• witnesses,
• subjects, or
• targets,

investigators gather information and build cases. In most instances, investigators do so below the radar, suggesting that witnesses be discrete if they want to advance possibilities for leniency.

Besides going after witnesses that provide information, investigators may also seek cooperation from financial institutions. Those questions can, and often do, lead to account closures without an explanation. Although a small business owner may be oblivious to the costs of a government investigation, financial institutions have a deep bench of lawyers on staff.

All corporate leaders want to mitigate risk that can lead to damages against a firm. Executives in a financial institution, therefore, may elect to sever ties with an account holder if they learn of a government investigation. They do not want investigators dragging them into depositions or inquiries.

Consider, for example, the problems and expense that Deutsche Bank experienced as a result of the endless government investigations into the byzantine finances of President Donald Trump. Every member of our team at Compliance Mitigation can describe examples of bank and brokerage accounts being closed prior to criminal charges being filed.

In anticipation of disruptions to both personal and business accounts, anyone that owns a company or works in a company should develop a best-practice compliance guide to help avoid the disruptions that a government investigation can bring. Executives and employees must also be aware of, and prepared for, the steps to take when they suspect a government investigation might already be underway.

Watch for Red Flags:

At Compliance Mitigation, our team members served time alongside many people that suffered the pains of a government investigation; we've all gone through investigations ourselves. We can reflect on the red flags we missed along the way. Had we known more we could have taken precautions to minimize exposure.

For example, investigators approached the former CEO and Chairman of a Nasdaq 100 company for questioning. When the CEO called his general counsel, the lawyer told him that it would be fine to speak with the investigators alone, as the CEO didn't have anything to hide. Later, through legal proceedings, the CEO learned that the investigators had carved out a special deal for the general counsel; the lawyer served up the CEO as "a bigger fish" to satisfy the government's lust for a headline-grabbing investigation and prosecution.

The markets use many metrics to assess the performance of a CEO. Markets may look at revenue growth, profit growth, and market share. Investigative teams, though, work by an entirely different set of metrics. They advance their careers by bringing people and businesses down. Such motivations influence them to go after cases that generate headlines. Later, investigators and government attorneys rely upon such results as evidence of their value when advancing their career in government or as they transition to the private sector.

Long before an indictment comes down, investigators leave clues. It's crucial for all parties to keep their eyes wide open. Neither business leaders nor team members should minimize the complexities of a government investigation, including enormous levels of personal stress. The potential for exposure to criminal charges, injunctions, and enormous expenses can lead to total devastation for those that do not have a plan.

Marathon Levels of Stress:

Investigations typically play out over many years. The uncertainty disrupts business operations and obliterates personal sanity. The targets of a government investigation may feel powerless and helpless. This provides another strong reason to have an effective compliance program, to protect against such disruptions; that program, moreover, should include an understanding of what steps people can take to protect against the many complications that accompany a government investigation.

Based on our experience, we recommend that business owners use a solid plan to prepare, at the soonest possible time. For example:

Step 1:

• Create documents that clearly show how the organization defines success.

Step 2:

• Create documents that lay out a step-by-step plan, detailing every aspect of the organization. On a regular basis, preferably quarterly, but at least annually, revisit the plan and make adjustments.

Step 3:

• Create tools, tactics, and resources to articulate precisely how the organization functions and allocates resources. Show the investment that the corporation makes to train all staff members, and to communicate the message to all vendors and consumers. Build a system to organize how the corporation keeps records, with effective backup plans.

Step 4:

• Show the steps the corporation takes to measure progress. Make sure that each team member is aware of the documentation, and schedule periodic training to refine best practices.

Leaders should take defense measures to protect the business, and the leadership team, in advance, knowing that investigations begin in secret and can occur at any time.

CORPORATE PRE-EMPTIVE MEASURES

Hire a white-collar criminal defense attorney:

Entrepreneurs may have transactional and business lawyers to help them draft contracts. Yet as the business grows, leaders should also think about risks in the marketplace. They cannot live like an ostrich.

What does an ostrich do? Theory has it that an ostrich buries its head in the sand while in the presence of lions and hyenas; foolishly, the ostrich believes that if it cannot see the predator, the predator will not be able to devour the bird because the predator won't see it either. That strategy doesn't work out so well for the ostrich. And, it won't work out so well for business owners or executives that try to ignore the threat of big government.

The best offense is a great defense, so invest in writing out the corporate story. Create messaging that details every aspect of the corporate strategy. Document how the company processes incoming mail, to how the company attracts customers, to how the company sanitizes the bathroom, to how the company deals with complaints. The writing may seem tedious. Yet a written plan will demonstrate attention to detail, the kind of detail that lets investigators know the company takes compliance seriously. A compliance plan should protect the business, and the leaders of the business against government investigations.

To the extent possible, hire an attorney that specializes in white-collar crime. Task the attorney with assessing pertinent parts of the compliance manual. Business leaders protect themselves when they invest resources to show a commitment to comply with laws and regulations. Such an investment may open opportunities for leniency, deferred-prosecution agreements, or non-prosecution agreements in the unfortunate event that a government investigation begins.

The best chance to negotiate for leniency is before investigators bring charges. If a business gets appropriate counsel, leaders may minimize disruptions that could obliterate the business, and lead team members to prison.

Conduct an Internal Investigation:

Despite best efforts, and a strong compliance program, businesses sometimes learn of wrongdoing within the organization. If that happens, the business should take immediate, preventive action. One proven technique that has saved many businesses and business leaders from prosecution stems from internal investigations.

If a business leader conducts regular compliance training and auditing, those efforts could potentially lead to the discovery of wrongdoing. At that stage, the business executive must make a decision of how to proceed. As an example, we can cite the case of Robert Smith, Chairman and CEO of a private equity group.

He formed the Excelsior Trust in Belize and Flash Holdings in Nevis. Smith relied upon third parties to conceal his beneficial ownership and control of those companies, but he controlled both offshore structures; Smith used those entities to avoid paying U.S. taxes. To facilitate the venture, he relied upon foreign bank accounts in the British Virgin Islands and Switzerland to hide assets from the IRS and from the U.S. Treasury Department. As a result of his financial structuring, Smith did not report more than $200 million in partnership income.

Authorities did not know about Smith's criminal behavior. Yet, Smith understood that he broke laws. When pressured by a Swiss Bank to self-report, he was slow to come to the table. He continued to file false documents.

At some point, he got the right counsel. His lawyer helped him negotiate a non-prosecution agreement with the Department of Justice. Smith had to forfeit claims of more than $300 million. Had he waited for the government to bring an indictment, he would have also had to litigate his way out of criminal charges that could have led to multiple decades in federal prison.

For more details, take a look at the following press release and accompanying documents:

• Press Release: Private Equity CEO Enters into Non-prosecution Agreement on International Tax Fraud Scheme and Agrees to Pay $139 Million, to Abandon $182 Million in Charitable Contribution Deductions, and to Cooperate with Government Investigations
  • https://www.justice.gov/opa/pr/private-equity-ceo-enters-non-prosecution-agreement-international-tax-fraud-scheme-and-agrees
• Statement of Facts: Exhibit to Robert E. Smith Non-Prosecution Agreement
  • https://www.justice.gov/opa/press-release/file/1327911/download
• Non-Prosecution Agreement
  • https://www.justice.gov/opa/press-release/file/1327906/download

How did Smith persuade the government to issue a non-prosecution agreement? Well, from the documents above, it becomes clear that he served up a bigger fish. As a result of Smith's cooperation, the government brought criminal charges against the CEO of a computer company.

The facts of life are that government investigators will always look for a bigger fish. That strategy feeds the ecosystem of mass incarceration. When big government tries to bring more people into the system, everyone becomes vulnerable. For that reason, it's best to develop a best-practice compliance system, with total awareness that "Big Brother" is always watching, as George Orwell advised. To help keep the company and yourself from being that bigger fish.

Review Your Insurance Policy:

Many corporate insurance policies include fraud-protection provisions. Those policies may cover both legal costs and fines (up to a certain dollar amount). An effective policy would protect officers and directors from the enormous litigation costs that accompany a government investigation.

Effective business leaders should develop a solid appreciation for the financial costs associated with defending against a government investigation. Consider, for a moment, the process:

• Investigators will subpoena corporate documents.
• They will want to review every email, invoice, sales script, advertisement, receipt, contract, and so forth.
• They will take notes as they question witnesses.

That investigation will result in at least tens of thousands of pages, potentially millions of pages. It may also include hundreds of hours of recorded phone calls.

A business leader, and team members, should have a realistic understanding of the evidence that investigators will accumulate. On the government's side, dozens of agents and interns will sift through the evidence, categorizing it in a well-organized manner. They do not have to be sensitive to costs, unlike the target of the investigation. Investigators can deploy enormous resources, without consideration of a cost-benefit analysis. The investigators then deliver all of that information to government attorneys. Those attorneys will use that evidence to bring charges against individuals and potentially, the business.

Discovery:

When people hire defense attorneys to represent them in a government investigation, those defense attorneys enter into a "discovery" phase. While the business owner will consider the mountain of evidence a burdensome nuisance, the defense attorney may see something else: billable hours.

Indeed, the defense team will insist upon reviewing every piece of evidence the investigators accumulated. They will want to listen to every recording, watch every video, read every note that recorded what a witness revealed. Without insurance, the client ends up paying for those hours, at great expense.

In big cities like New York, San Francisco, Chicago, or Washington DC, defense attorneys that specialize in government investigations bill at rates that may shock the conscience of a typical business owner. Why? Because those attorneys are in the business of practicing law. In other words, they need to stay current with case law and regulations and defense strategies. To be the best in the world at what they do, they must invest countless hours researching decisions without pay. Clients therefore pay for that expertise at rates that may exceed $2,000 per hour. Multiply that number by the hundreds (or thousands) of hours necessary to read the mountains of evidence that investigators present. For this reason, legal costs associated with defending against a government investigation can easily surpass $10 million.

Such fees can decimate a company that does not have adequate insurance. For individuals that lack insurance indemnifying them against legal fees, a government investigation can bring enormous personal stress and lead to personal bankruptcy.

Consider the case of Rod Kazazi, who held the position of Chief Operating Officer for a real estate development company. When the Federal Trade Commission sued his company for violating the Federal Trade Commission Telemarketing Sales Rule and the FTC Act. Rod hired former Assistant U.S. Attorney, David Wiechert, to represent him in the matter. The attorney persuaded Rod to cooperate with the investigation, likely to avoid liability for a potential judgment of more than $140 million.

In order to settle the case, Rod Kazazi agreed to provide false and unsubstantiated testimony to support the Federal Trade Commission's case. He also agreed to make a payment of more than $250,000.

In crafting the settlement agreement, the FTC attorneys slipped in misleading language that would protect them, at the expense of Kazazi's attorney. Kazazi's attorney did not catch a single sentence in a settlement agreement spanning several thousand words. As a result, the FTC later filed documents to void Kazazi's settlement agreement, and also hold the attorney personally liable for more than $250,000.

Key Takeaway:

Business leaders should get a full understanding of the costs associated with defending against a government investigation. With that understood, each business leader should consider purchasing an insurance policy to cover the potential costs of litigation as soon as it's practical.

Organize Records:

Business leaders invest well when they build effective and well-organized record-keeping systems. In the startup phase of a business, the organizational structure may exist in the founder's head. All too often it stays there and only there, even after it would benefit the company to have it documented. That's an important reason why it's best to create exceptional record-keeping systems as soon as possible.

As the company grows, leaders of business should take time to document strategies and procedures. To the extent that they tell the company's story well, they build a protective mechanism in both running the company and in the event of litigation—assuming there's a solid commitment to building an honest and ethical organization.

When the company has sufficient resources, the best step would be to build an effective Customer Relationship Management (CRM) system. Some examples of CRM companies include Salesforce, Zoho, and Pipedrive. Those companies charge a per-user fee that may range from $30 a month to more than $200 a month, per seat. Great companies use CRMs for many reasons, including:

• They want to track their relationships with every consumer,
• They want to measure return-on-investment with regard to marketing, sales, and operations,
• They want to make certain that all team members relay the right corporate message to consumers,
• They want to create a central repository for all corporate communications, records, and transactions.

An investment in a CRM can serve as an outstanding resource for any business. It can save a company money, by protecting against government investigations. And, it can also make a company money by helping the business track the customer journey and more effectively communicate the company's value proposition.

A CRM becomes especially effective for business leaders that invest the time and energy to document their company's workflows. Regardless of whether the company invests in a CRM, the company should definitely invest in a system to organize and secure files—especially when it comes to storing data on customers. A data breach of customer information can lead to civil investigations with severe penalties—especially if the company is later determined to have acted recklessly with consumer information.

Remember that the destruction of company records during a government investigation can lead to criminal charges for obstruction of justice, or other crimes. The more leadership teams understand how much time, energy, and resources that government investigators will invest to build a case, the more they appreciate the need for caution.

Under the ostensible guise of furthering their agency's mission, unethical government attorneys may suborn perjury or hide evidence that could prove favorable to an individual or business they want to target. Good leaders will invest in transparency, knowing that at any time, government investigators may be listening or monitoring a business's activities.

Communicating with a Government Investigator:

The Fifth Amendment of the U.S. Constitution protects people from having to speak with a government investigator. No one can be compelled to provide evidence that could, theoretically, be used against a person; and government investigators are skilled at pulling evidence from a witness that they can use against him or her.

If a government investigator asks questions, remember that the investigator is trying gather evidence to build a case. The investigator may say that he is simply trying to get an understanding of what happened. Getting to the truth, however, doesn't advance the investigator's career. Investigators get promotions when they build cases against people and businesses that lead to findings of liability or guilt.

With that in mind, remember that no one has to talk to a government investigator. But if a person chooses to speak with a government investigator, that person should follow two principles:

Principle 1:

• If a person chooses to speak with a government investigator, the person should not lie. Lying to a government official is a federal crime, punishable by up to five years in federal prison—for each lie.

Principle 2:

• If a person chooses to speak with a government investigator, the person should hire competent counsel. Although the lawyer cannot protect a person from lying, the lawyer can advise the person more on how government investigators may use any statements to build a case to reach the investigator's agenda. Make no mistake, the investigator aspires to bring charges against people or businesses.

Just as some business leaders will do or so anything to increase profitability, some government investigators will do or say anything to induce people to incriminate others and provide evidence that lead to findings of liability, or guilt.

Visit us at ComplianceMitigation.com

 

What are some of the early signs that a government agency has launched an investigation? Subtle clues may surface. For example, a trusted friend or colleague may start asking questions, or sending emails that detail criminal acts.

Those inquiries may be fishing expeditions, or an effort to get incriminating evidence, like an admission of complicity in wrongdoing. It’s important to understand that, in many cases, informants provide ammunition that investigators use to expand government investigations.

 

Investigators want to learn as much as possible, and they want to bring as many people as possible into the investigation. By questioning people as:

 

• witnesses,
• subjects, or
• targets,

investigators gather information and build cases. In most instances, investigators do so below the radar, suggesting that witnesses be discrete if they want to advance possibilities for leniency.

 

Besides going after witnesses that provide information, investigators may also seek cooperation from financial institutions. Those questions can, and often do, lead to account closures without an explanation. Although a small business owner may be oblivious to the costs of a government investigation, financial institutions have a deep bench of lawyers on staff.

 

All corporate leaders want to mitigate risk that can lead to damages against a firm. Executives in a financial institution, therefore, may elect to sever ties with an account holder if they learn of a government investigation. They do not want investigators dragging them into depositions or inquiries.

 

Consider, for example, the problems and expense that Deutsche Bank experienced as a result of the endless government investigations into the byzantine finances of President Donald Trump.  Every member of our team at Compliance Mitigation can describe examples of bank and brokerage accounts being closed prior to criminal charges being filed.

 

In anticipation of disruptions to both personal and business accounts, anyone that owns a company or works in a company should develop a best-practice compliance guide to help avoid the disruptions that a government investigation can bring. Executives and employees must also be aware of, and prepared for, the steps to take when they suspect a government investigation might already be underway.

 

 

Watch for Red Flags:

 

At Compliance Mitigation, our team members served time alongside many people that suffered the pains of a government investigation; we’ve all gone through investigations ourselves. We can reflect on the red flags we missed along the way. Had we known more we could have taken precautions to minimize exposure.

 

For example, investigators approached the former CEO and Chairman of a Nasdaq 100 company for questioning. When the CEO called his general counsel, the lawyer told him that it would be fine to speak with the investigators alone, as the CEO didn’t have anything to hide. Later, through legal proceedings, the CEO learned that the investigators had carved out a special deal for the general counsel; the lawyer served up the CEO as “a bigger fish” to satisfy the government’s lust for a headline-grabbing investigation and prosecution.

 

The markets use many metrics to assess the performance of a CEO. Markets may look at revenue growth, profit growth, and market share. Investigative teams, though, work by an entirely different set of metrics. They advance their careers by bringing people and businesses down. Such motivations influence them to go after cases that generate headlines. Later, investigators and government attorneys rely upon such results as evidence of their value when advancing their career in government or as they transition to the private sector.

 

Long before an indictment comes down, investigators leave clues. It’s crucial for all parties to keep their eyes wide open. Neither business leaders nor team members should minimize the complexities of a government investigation, including enormous levels of personal stress. The potential for exposure to criminal charges, injunctions, and enormous expenses can lead to total devastation for those that do not have a plan.

 

 

Marathon Levels of Stress:

 

Investigations typically play out over many years. The uncertainty disrupts business operations and obliterates personal sanity. The targets of a government investigation may feel powerless and helpless. This provides another strong reason to have an effective compliance program, to protect against such disruptions; that program, moreover, should include an understanding of what steps people can take to protect against the many complications that accompany a government investigation.

 

Based on our experience, we recommend that business owners use a solid plan to prepare, at the soonest possible time. For example:

 

Step 1:

• Create documents that clearly show how the organization defines success.

Step 2:

• Create documents that lay out a step-by-step plan, detailing every aspect of the organization. On a regular basis, preferably quarterly, but at least annually, revisit the plan and make adjustments.

Step 3:

• Create tools, tactics, and resources to articulate precisely how the organization functions and allocates resources. Show the investment that the corporation makes to train all staff members, and to communicate the message to all vendors and consumers. Build a system to organize how the corporation keeps records, with effective backup plans.

Step 4:

• Show the steps the corporation takes to measure progress. Make sure that each team member is aware of the documentation, and schedule periodic training to refine best practices.

 

Leaders should take defense measures to protect the business, and the leadership team, in advance, knowing that investigations begin in secret and can occur at any time.

 

 

CORPORATE PRE-EMPTIVE MEASURES

 

Hire a white-collar criminal defense attorney:

 

Entrepreneurs may have transactional and business lawyers to help them draft contracts. Yet as the business grows, leaders should also think about risks in the marketplace. They cannot live like an ostrich.

 

What does an ostrich do? Theory has it that an ostrich buries its head in the sand while in the presence of lions and hyenas; foolishly, the ostrich believes that if it cannot see the predator, the predator will not be able to devour the bird because the predator won’t see it either. That strategy doesn’t work out so well for the ostrich. And, it won’t work out so well for business owners or executives that try to ignore the threat of big government.

 

The best offense is a great defense, so invest in writing out the corporate story. Create messaging that details every aspect of the corporate strategy. Document how the company processes incoming mail, to how the company attracts customers, to how the company sanitizes the bathroom, to how the company deals with complaints. The writing may seem tedious. Yet a written plan will demonstrate attention to detail, the kind of detail that lets investigators know the company takes compliance seriously. A compliance plan should protect the business, and the leaders of the business against government investigations.  

 

To the extent possible, hire an attorney that specializes in white-collar crime. Task the attorney with assessing pertinent parts of the compliance manual. Business leaders protect themselves when they invest resources to show a commitment to comply with laws and regulations. Such an investment may open opportunities for leniency, deferred-prosecution agreements, or non-prosecution agreements in the unfortunate event that a government investigation begins.

 

The best chance to negotiate for leniency is before investigators bring charges. If a business gets appropriate counsel, leaders may minimize disruptions that could obliterate the business, and lead team members to prison.

 

 

Conduct an Internal Investigation:

 

Despite best efforts, and a strong compliance program, businesses sometimes learn of wrongdoing within the organization. If that happens, the business should take immediate, preventive action. One proven technique that has saved many businesses and business leaders from prosecution stems from internal investigations.

 

If a business leader conducts regular compliance training and auditing, those efforts could potentially lead to the discovery of wrongdoing. At that stage, the business executive must make a decision of how to proceed. As an example, we can cite the case of Robert Smith, Chairman and CEO of a private equity group.

 

He formed the Excelsior Trust in Belize and Flash Holdings in Nevis. Smith relied upon third parties to conceal his beneficial ownership and control of those companies, but he controlled both offshore structures; Smith used those entities to avoid paying U.S. taxes. To facilitate the venture, he relied upon foreign bank accounts in the British Virgin Islands and Switzerland to hide assets from the IRS and from the U.S. Treasury Department. As a result of his financial structuring, Smith did not report more than $200 million in partnership income.

 

Authorities did not know about Smith’s criminal behavior. Yet, Smith understood that he broke laws. When pressured by a Swiss Bank to self-report, he was slow to come to the table. He continued to file false documents.

 

At some point, he got the right counsel. His lawyer helped him negotiate a non-prosecution agreement with the Department of Justice. Smith had to forfeit claims of more than $300 million. Had he waited for the government to bring an indictment, he would have also had to litigate his way out of criminal charges that could have led to multiple decades in federal prison.

 

For more details, take a look at the following press release and accompanying documents:

 

• Press Release: Private Equity CEO Enters into Non-prosecution Agreement on International Tax Fraud Scheme and Agrees to Pay $139 Million, to Abandon $182 Million in Charitable Contribution Deductions, and to Cooperate with Government Investigations
  • https://www.justice.gov/opa/pr/private-equity-ceo-enters-non-prosecution-agreement-international-tax-fraud-scheme-and-agrees
• Statement of Facts: Exhibit to Robert E. Smith Non-Prosecution Agreement
  • https://www.justice.gov/opa/press-release/file/1327911/download
• Non-Prosecution Agreement
  • https://www.justice.gov/opa/press-release/file/1327906/download

 

How did Smith persuade the government to issue a non-prosecution agreement? Well, from the documents above, it becomes clear that he served up a bigger fish. As a result of Smith’s cooperation, the government brought criminal charges against the CEO of a computer company.

 

The facts of life are that government investigators will always look for a bigger fish. That strategy feeds the ecosystem of mass incarceration. When big government tries to bring more people into the system, everyone becomes vulnerable. For that reason, it’s best to develop a best-practice compliance system, with total awareness that “Big Brother” is always watching, as George Orwell advised.  To help keep the company and yourself from being that bigger fish.

 

 

Review Your Insurance Policy:

 

Many corporate insurance policies include fraud-protection provisions. Those policies may cover both legal costs and fines (up to a certain dollar amount).  An effective policy would protect officers and directors from the enormous litigation costs that accompany a government investigation.

 

Effective business leaders should develop a solid appreciation for the financial costs associated with defending against a government investigation. Consider, for a moment, the process:

 

• Investigators will subpoena corporate documents.
• They will want to review every email, invoice, sales script, advertisement, receipt, contract, and so forth.
• They will take notes as they question witnesses.

 

That investigation will result in at least tens of thousands of pages, potentially millions of pages.  It may also include hundreds of hours of recorded phone calls.

 

A business leader, and team members, should have a realistic understanding of the evidence that investigators will accumulate. On the government’s side, dozens of agents and interns will sift through the evidence, categorizing it in a well-organized manner. They do not have to be sensitive to costs, unlike the target of the investigation. Investigators can deploy enormous resources, without consideration of a cost-benefit analysis. The investigators then deliver all of that information to government attorneys. Those attorneys will use that evidence to bring charges against individuals and potentially, the business.

 

 

Discovery:

When people hire defense attorneys to represent them in a government investigation, those defense attorneys enter into a “discovery” phase. While the business owner will consider the mountain of evidence a burdensome nuisance, the defense attorney may see something else: billable hours.

 

Indeed, the defense team will insist upon reviewing every piece of evidence the investigators accumulated. They will want to listen to every recording, watch every video, read every note that recorded what a witness revealed. Without insurance, the client ends up paying for those hours, at great expense.

 

In big cities like New York, San Francisco, Chicago, or Washington DC, defense attorneys that specialize in government investigations bill at rates that may shock the conscience of a typical business owner. Why? Because those attorneys are in the business of practicing law. In other words, they need to stay current with case law and regulations and defense strategies. To be the best in the world at what they do, they must invest countless hours researching decisions without pay. Clients therefore pay for that expertise at rates that may exceed $2,000 per hour. Multiply that number by the hundreds (or thousands) of hours necessary to read the mountains of evidence that investigators present. For this reason, legal costs associated with defending against a government investigation can easily surpass $10 million.

 

Such fees can decimate a company that does not have adequate insurance. For individuals that lack insurance indemnifying them against legal fees, a government investigation can bring enormous personal stress and lead to personal bankruptcy.

 

Consider the case of Rod Kazazi, who held the position of Chief Operating Officer for a real estate development company. When the Federal Trade Commission sued his company for violating the Federal Trade Commission Telemarketing Sales Rule and the FTC Act. Rod hired former Assistant U.S. Attorney, David Wiechert, to represent him in the matter. The attorney persuaded Rod to cooperate with the investigation, likely to avoid liability for a potential judgment of more than $140 million.

 

In order to settle the case, Rod Kazazi agreed to provide false and unsubstantiated testimony to support the Federal Trade Commission’s case. He also agreed to make a payment of more than $250,000.

 

In crafting the settlement agreement, the FTC attorneys slipped in misleading language that would protect them, at the expense of Kazazi’s attorney. Kazazi’s attorney did not catch a single sentence in a settlement agreement spanning several thousand words. As a result, the FTC later filed documents to void Kazazi’s settlement agreement, and also hold the attorney personally liable for more than $250,000.

 

Key Takeaway:

Business leaders should get a full understanding of the costs associated with defending against a government investigation. With that understood, each business leader should consider purchasing an insurance policy to cover the potential costs of litigation as soon as it’s practical.

 

 

Organize Records:

 

Business leaders invest well when they build effective and well-organized record-keeping systems. In the startup phase of a business, the organizational structure may exist in the founder’s head. All too often it stays there and only there, even after it would benefit the company to have it documented.  That’s an important reason why it’s best to create exceptional record-keeping systems as soon as possible.    

 

As the company grows, leaders of business should take time to document strategies and procedures. To the extent that they tell the company’s story well, they build a protective mechanism in both running the company and in the event of litigation—assuming there’s a solid commitment to building an honest and ethical organization.

 

When the company has sufficient resources, the best step would be to build an effective Customer Relationship Management (CRM) system. Some examples of CRM companies include Salesforce, Zoho, and Pipedrive. Those companies charge a per-user fee that may range from $30 a month to more than $200 a month, per seat. Great companies use CRMs for many reasons, including:

 

• They want to track their relationships with every consumer,
• They want to measure return-on-investment with regard to marketing, sales, and operations,
• They want to make certain that all team members relay the right corporate message to consumers,
• They want to create a central repository for all corporate communications, records, and transactions.

 

An investment in a CRM can serve as an outstanding resource for any business. It can save a company money, by protecting against government investigations. And, it can also make a company money by helping the business track the customer journey and more effectively communicate the company’s value proposition.

 

A CRM becomes especially effective for business leaders that invest the time and energy to document their company’s workflows. Regardless of whether the company invests in a CRM, the company should definitely invest in a system to organize and secure files—especially when it comes to storing data on customers. A data breach of customer information can lead to civil investigations with severe penalties—especially if the company is later determined to have acted recklessly with consumer information.

 

Remember that the destruction of company records during a government investigation can lead to criminal charges for obstruction of justice, or other crimes. The more leadership teams understand how much time, energy, and resources that government investigators will invest to build a case, the more they appreciate the need for caution.

 

Under the ostensible guise of furthering their agency’s mission, unethical government attorneys may suborn perjury or hide evidence that could prove favorable to an individual or business they want to target. Good leaders will invest in transparency, knowing that at any time, government investigators may be listening or monitoring a business’s activities.

 

 

Communicating with a Government Investigator:

 

The Fifth Amendment of the U.S. Constitution protects people from having to speak with a government investigator. No one can be compelled to provide evidence that could, theoretically, be used against a person; and government investigators are skilled at pulling evidence from a witness that they can use against him or her.

 

If a government investigator asks questions, remember that the investigator is trying gather evidence to build a case. The investigator may say that he is simply trying to get an understanding of what happened. Getting to the truth, however, doesn’t advance the investigator’s career. Investigators get promotions when they build cases against people and businesses that lead to findings of liability or guilt.

 

With that in mind, remember that no one has to talk to a government investigator. But if a person chooses to speak with a government investigator, that person should follow two principles:

 

Principle 1:

• If a person chooses to speak with a government investigator, the person should not lie. Lying to a government official is a federal crime, punishable by up to five years in federal prison—for each lie.

Principle 2:

• If a person chooses to speak with a government investigator, the person should hire competent counsel. Although the lawyer cannot protect a person from lying, the lawyer can advise the person more on how government investigators may use any statements to build a case to reach the investigator’s agenda. Make no mistake, the investigator aspires to bring charges against people or businesses.

Just as some business leaders will do or so anything to increase profitability, some government investigators will do or say anything to induce people to incriminate others and provide evidence that lead to findings of liability, or guilt.