Should Companies Turn Themselves in for FCPA Violations?
Last week, Oracle paid $2 million to the U.S. Securities and Exchange Commission to settle Foreign Corrupt Practices Act charges relating to a slush fund in India. Oracle, a technology company with a reputation for taking compliance seriously, voluntarily disclosed to the SEC that its subsidiary was maintaining funds off the books. Ultimately, the SEC concluded that the payments created the risk that the funds could be used for illicit purposes such as bribery or embezzlement. There was no actual finding of bribery.
It is easy to understand why the SEC and U.S. Department of Justice encourage the voluntary disclosure of actual or potential violations of the FCPA. Companies that walk through the DOJs front door to disclose wrongdoing arrive ready to cooperate and, ultimately, ready to settle. The DOJ can bring and resolve more enforcement actions with fewer resources and in less time. In addition, in light of the companies initial conciliatory gesture of disclosure, its reasonable to assume that the company will cooperate fully. This enables the DOJ to guide and oversee a comprehensive investigation run by private practitioners and funded by the company, as opposed to by the government.
The DOJ has used both carrots and sticks to encourage voluntary disclosure. In November 2009, Lanny Breuer reminded an audience at ACIs 22nd National Forum on the Foreign Corrupt Practices Act [PDF] that [t]he Department has repeatedly stated that a company will receive meaningful credit for that disclosure and that cooperation. The following year, at the same conference, he admonished companies to voluntarily disclose wrongdoing if you discover it, saying, I can assure you that if you do not voluntarily disclose your organizations conduct, and we discover it on our own, or through a competitor or a customer of yours, the result will not be the same . . . there is no doubt that a company that comes forward on its own will see a more favorable resolution than one that doesnt.
So, why do companies that uncover problems, especially relatively modest problems, disclose to the government, and what risk is a company taking by deciding not to disclose? The answers to both questions are surprisingly unclear.
The government has stated repeatedly that companies will be treated more favorably if they voluntarily disclose, but there is no reliable analysis of FCPA enforcement actions to date that proves this point. This assertion may well be true, but so few of the facts are made public that most companies remain unconvinced. Those that disclose make a bet on lenience; those that dont make a different bet, that the certainty of a fine, penalty, or reputational hit from disclosing an FCPA issue offsets the governments assurance that it is better to go to the DOJ before it comes to you.
The Oracle penalty was modest, but then so too was the wrongdoinga relatively minor books and records violation in a subsidiary five years ago. To point to a $2 million fine and attribute it to Oracles decision to disclose and cooperate misses the point: many practitioners believe that Oracle could have walked away entirely unscathed.
And what might the fine have been had Oracle not made the voluntary disclosure and the wrongdoing had been uncovered? In the challenging and murky world of international business in far-flung and opaque markets, a perfect track record simply isnt possible. (Dont misunderstandlapses should be addressed and companies should close loopholes and buttress internal controls, but these practices are not evidence of a rogue corporation caught gaming the system.)
What did Oracle buy with its voluntary disclosure? Oracle almost certainly earned itself the goodwill of the enforcement agencies by resolving this quickly and, according to the SEC, in cooperation with the enforcement agency. But the counterweight to that goodwill is that the company is now on the FCPA radar, and any future violations, however unrelated to these facts, may well be chalked up to recidivism.
In settling with the SEC, Oracle bought itself a quick resolution. But even this isnt a clear-cut advantage. Its not sufficient simply to compare a quick settlement to a lengthy trial. When companies dont fight FCPA cases, its often because they can take years to resolve, all while distracting management and introducing shareholder uncertainty. The other option for companies in this situation is to quietly fix the problem, terminate those involved, document the remedial measures, and get back to work. While the enforcement agencies like to warn of the risk of employees or competitors reporting on companies, the risk of a whistleblower can be diminished by the individual circumstances, as in Oracles situation where the wrongdoing was modest and dated back many years.
If the benefits of disclosure are unclear and hard to quantify, the costs are not. In the case of Oracle, to state the obvious, the opening number is $2 million. The penalty was a direct result of the disclosureunless you believe that the SEC would have learned, on its own, of the Indian subsidiarys 2007 fake invoices and the off-the-books account they funded. A disclosure also costs the company the expense of the investigation, with teams of lawyers and accountants. But this cost should be incurred whether a company decides to disclose or not: A well-governed company will want to understand and bridge their compliance gaps, and an investigation run by a company may be more narrowly tailored in scope than what is required by the enforcement agencies in the context of a voluntary disclosure. Finally, Oracle appears to have also bought itself, or at least its internal audit team, a lot more work. (The SEC complaint indicates that Oracle should have been auditing its distributors payments to third parties.)
A voluntary disclosure takes its toll on a companys reputation. Even when the wrongdoing is minor and the penalty modest, the companys name is associated with bribery in the headlines, and the stigma often lingers long after these details are forgotten. As a purely financial calculation, it is difficult to argue in favor of voluntary disclosure. Considerations of uncertainty, reputation, and market response make the argument more difficult still.
Alexandra Wrage is the president of TRACE, an antibribery compliance organization offering practical tools and services to multinational companies. TRACE offers several anti-bribery training resources to members and non-members including the training DVD, Toxic Transactions: Bribery, Extortion, and the High Price of Bad Business. TRACE recently launched TRAC, a publicly accessible platform that establishes a global standard for baselines due diligence and makes the information available to companies at no cost.