Day 6 of One Month to a Better Compliance Program

Where does “Tone at the Top” start. With any public and most private US companies, it is at the Board of Directors. But what is the role of a company’s Board in FCPA compliance? We start with several general statements about the role of a Board in US companies. First a Board should not engage in management but should engage in oversight of a CEO and senior management. The Board does this through asking hard questions, risk assessment and identification.

In a White Paper, entitled “Risk Intelligence Governance-A Practical Guide for Boards” Deloitte & Touche laid out six general principles to help guide Boards in the area of risk governance. These six areas can be summarized as follows: 

• Define the Board’s Role-there must be a mutual understanding between the Board, CEO and senior management of the Board’s responsibilities.

• Foster a culture of risk management-all stakeholders should understand the risks involved and manage such risks accordingly.
• Incorporate risk management directly into a strategy-oversee the design and implementation of risk evaluation and analysis.
• Help define the company’s appetite for risk-all stakeholders need to understand the company’s appetite or lack thereof for risk.
• How to execute the risk management process-the risk management process maintaining an approach that is continually monitored and had continuing accountability.
• How to benchmark and evaluate the process-systems need to be installed which allow for evaluation and modifying the risk management process as more information becomes available or facts or assumptions change.

All of these factors can be easily adapted to FCPA compliance and ethics risk management oversight. Initially it must be important that the Board receive direct access to such information on a company’s policies on this issue. The Board must have quarterly or semi-annual reports from a company’s Chief Compliance Officer to either the Audit Committee or the Compliance Committee. This commentator recommends that a Board create a Compliance Committee as an Audit Committee may more appropriately deal with financial audit issues. A Compliance Committee can devote itself exclusively to non-financial compliance, such as FCPA compliance. The Board’s oversight role should be to receive such regular reports on the structure of the company’s compliance program, its actions and self-evaluations. From this information the Board can give oversight to any modifications to managing FCPA risk that should be implemented.

There is one other issue regarding the Board and risk management, including FCPA risk management, which should be noted. It appears that the Securities and Exchange Commission (SEC) desires Boards to take a more active role in overseeing the management of risk within a company. The SEC has promulgated Reg SK 407 under which each company must make a disclosure regarding the Board’s role in risk oversight which “may enable investors to better evaluate whether the board is exercising appropriate oversight of risk.” If this disclosure is not made, it could be a securities law violation and subject the company which fails to make it to fines, penalties or profit disgorgement.

CCO reporting to the Audit/Compliance Committee has to be structured carefully to promote ethics and compliance. Here are my five best practices that should guide the reporting:

Quarterly Reports — The CCO should report in person to the Audit/Compliance Committee every quarter. If the CCO submits a written report and does not appear before the Committee, the failure to appear before the Committee reflects a defective relationship. The quarterly report is critical for both the CCO and the Committee to hear about compliance performance and challenges.

Executive Session – Every quarterly report should be concluded with an executive session where the CCO and the Committee can have a frank discussion on any potential issues. It is a valuable opportunity to raise important issues. An executive session demonstrates that the CCO is independent and empowered within the organization, and reinforces the CCO’s direct access to the Board, if necessary.

Sitting In on Other Reports – The CCO should sit in the Committee meeting when other important officers report to the Committee. For example, the CCO should attend the presentations by the Internal Auditor, the General Counsel, and the CFO. The CCO has a macro-view of the company and needs to be informed as to issues in other areas that may be significant and have compliance implications.

Informal Relationship – A CCO should actively maintain an ongoing informal relationship with the Chair of the Audit/Compliance Committee. A CCO has to have the ability to pick up the phone and call to Chair to discuss issues that may arise. A weekly meeting for coffee or a meal is important to develop and maintain the relationship.

Annual Report to Full Board – A CCO should report to the full Board once a year. The Audit/Compliance Committee quarterly reports are important but the full Board needs to hear about the challenges and risks facing the company, as well as improvements needed for the ethics and compliance program.

Three Key Takeaways

1. A Board Compliance Committee should provide oversight not management.
2. A CCO should use multiple reports to communicate with the Board Compliance Committee.
3. Board Compliance Committee oversight makes companies more efficient and at the end of the day more profitable.

For more information, check out my book Doing Compliance: Design, Create and Implement an Effective Anti-Corruption Compliance Program, which is available by clicking here.