52
Presenting a live 90minute webinar with interactive Q&A Foreign Corrupt Practices Act Foreign Corrupt Practices Act Compliance Audits Strategies to Ensure Effective FCPA Compliance Programs T d ’ f l f 1pm Eastern | 12pm Central | 11am Mountain | 10am Pacific THURSDAY, NOVEMBER 4, 2010 T odays faculty features: Kathryn Cameron Atkinson, Member, Miller Chevalier, Washington, D.C. Greta Lichtenbaum, Partner, O'Melveny & Myers, Washington, D.C. Edward J. Fishman, Partner, K&L Gates, Washington, D.C. Brent C. Carlson, Director, AlixPartners, San Francisco The audio portion of the conference may be accessed via the telephone or by using your computer's speakers. Please refer to the instructions emailed to registrants for additional information. If you have any questions, please contact Customer Service at 1-800-926-7926 ext. 10.

Foreign Corrupt Practices Act Compliance Auditsmedia.straffordpub.com/products/foreign-corrupt-practices-act... · Foreign Corrupt Practices Act Compliance Audits ... 47% - Moderate

Embed Size (px)

Citation preview

Presenting a live 90‐minute webinar with interactive Q&A

Foreign Corrupt Practices Act Foreign Corrupt Practices Act Compliance Audits Strategies to Ensure Effective FCPA Compliance Programs

T d ’ f l f

1pm Eastern | 12pm Central | 11am Mountain | 10am Pacific

THURSDAY, NOVEMBER 4, 2010

Today’s faculty features:

Kathryn Cameron Atkinson, Member, Miller Chevalier, Washington, D.C.

Greta Lichtenbaum, Partner, O'Melveny & Myers, Washington, D.C.

Edward J. Fishman, Partner, K&L Gates, Washington, D.C.

Brent C. Carlson, Director, AlixPartners, San Francisco

The audio portion of the conference may be accessed via the telephone or by using your computer's speakers.Please refer to the instructions emailed to registrants for additional information. If you have any questions,please contact Customer Service at 1-800-926-7926 ext. 10.

Continuing Education Credits FOR LIVE EVENT ONLY

For CLE and/or CPE purposes, please let us know how many people are listening at your location by completing each of the following steps:

• Close the notification box

• In the chat box, type (1) your company name and (2) the number of attendees at your location

• Click the blue icon beside the box to send

Tips for Optimal Sound Quality

If you are listening via your computer speakers, please note that the quality of your sound will vary depending on the speed and quality of your internet connection.

If the sound quality is not satisfactory and you are listening via your computer speakers, you may listen via the phone: dial 1-866-873-1442 and enter your PIN when prompted. Otherwise, please send us a chat or e-mail [email protected] immediately so we can address the problem.

If you dialed in and have any difficulties during the call, press *0 for assistance.

Implementing Audits to Ensure p gEffective FCPA Compliance

ProgramsPrograms

Kathryn Cameron AtkinsonyStrafford Publications Teleconference

November 4, 2010

Room to Improve

• 2008 PwC survey “Confronting Corruption”

80% of companies have an anti-corruption compliance programprogram

22% of companies are “very confident” that the program p y p gadequately identifies and mitigates risk

5

Room to Improve

• KPMG Fraud Survey 2009Wh t t bl f d d i d t? What most enables fraud and misconduct?

67% - Inadequate internal controls/compliance programs47% - Management override of internal controls47% - Management override of internal controls

How much room to improve your mitigation efforts?47% - Moderate to significant -- internal audit and g

compliance functions65% - Moderate to significant -- technology-driven

continuous auditing and monitoring techniquescontinuous auditing and monitoring techniques

6

Room to Improve OECD Phase III Report on United States - 2010

“R t ti f ll th b i t it d“Representatives from all the business sectors cited an internal audit as the most important compliance measure for preventing and detecting the bribery ofmeasure for preventing and detecting the bribery of foreign public officials, . . .”

REPORT ON THE APPLICATION OF THE CONVENTION ON COMBATING BRIBERY OF FOREIGN PUBLIC OFFICIALS IN INTERNATIONAL BUSINESS TRANSACTIONS AND THE 2009 REVISED RECOMMENDATION ON COMBATING BRIBERY IN INTERNATIONAL BUSINESS TRANSACTIONS, October 15, 2010, para. 102 at p. 30.INTERNATIONAL BUSINESS TRANSACTIONS, October 15, 2010, para. 102 at p. 30.

7

FCPA Statutory Requirements

• Maintain books, records, and accounts that, in reasonable detail, accurately reflect transactions and the disposition of assetsy p

• Maintain a system of internal accounting controls sufficient to reasonably assure that: Transactions are executed consistent with managementTransactions are executed consistent with management

authorizations; Transactions are recorded so that financials can conform with

GAAP and to maintain accountability for assets;GAAP and to maintain accountability for assets; Access to assets is permitted only in accordance with

management's general or specific authorization; andTh d d t bilit f t i d ith th i ti The recorded accountability for assets is compared with the existing assets at reasonable intervals and appropriate action is taken with respect to any differences.

8

U.S. Sentencing Guidelines

§8B2.1. Effective Compliance and Ethics Program

• The organization shall take reasonable steps—• to ensure that the organization’s compliance and ethics program is

followed including monitoring and auditing to detect criminal conduct;followed, including monitoring and auditing to detect criminal conduct;• to evaluate periodically the effectiveness of the organization’s

compliance and ethics program; and• The organization shall periodically assess the risk of criminal• The organization shall periodically assess the risk of criminal

conduct and shall take appropriate steps to design, implement, or modify [program elements] to reduce the risk of criminal conduct identified through this process.identified through this process.

9

Common DOJ Settlement Terms

"Periodic testing of the compliance code, standards and procedures designed to evaluate theirand procedures designed to evaluate their effectiveness in detecting and reducing violations of the anti-corruption laws and [company's] internal p [ p y ]controls system and compliance code."

10

Government Expectations

• Review books and records for completeness, detail and accuracy (no materiality test)and accuracy (no materiality test)

• Confirm that appropriate back-up documentation is provided and maintainedprovided and maintained

• Review internal controls systems• Reasonable intervalsReasonable intervals• Audit sites chosen upon objective factors, including

country corruption risky p

11

Benefits of Compliance Reviews and Audits

• Detect and deter violations

• Reassess risk profile

• Test compliance program effectiveness

• Satisfy DOJ/SEC expectations

12

Essential Anti-Corruption Program Components

• Prevention Risk Assessments Risk Assessments Policies and Procedures Training

D e Diligence Due Diligence

• Detection Hotlines Certifications Audits

• Response• Response Investigation Remediation

13

Authority and Framework

• Secure support from Board and senior managementA ti l t d Articulate need

Define scope Establish structure Establish structure Allocate resources – internal and external Set timeframes – progress reports completion Set timeframes progress reports, completion Establish team structure and leadership

14

Define Audit Scope

• Business CoverageE ti i ti ? Entire organization?

Particular business segments? Foreign subsidiaries? Foreign subsidiaries? Joint ventures? Third parties? Third parties?

• Audit Period May be driven by scale of operations v resources vMay be driven by scale of operations v. resources v.

time frame for audit completion

15

Define Audit Scope

• Program CoverageE ti ? Entire program?

Focus on sub-components?TrainingTrainingThird parties FCPA-related internal controlsHotline

16

Risk Assessment Update

• Country riskI d t i k• Industry risk Government customers?

G t l t ? Government regulators? Government partners?

• Business model risk• Business-model risk Size, geographic spread Decentralized v centralized? Decentralized v. centralized? Third-party heavy or light? JVs? Growth plans?

17

Growth plans?

Refining Risk Assessment: Existing Data Sources

• Review existing metricsH tli t Hotline reports

Security investigations Internal audit reports exceptions Internal audit reports, exceptions SOX Committee: Significant Deficiencies? Material

Weaknesses? Legal files HR files Compliance certifications/questionnaires Training records

18

Construct Risk Matrix: Roadmap for Audits

• Digest information gatheredB ild i k fil f b i it di i i• Build risk profiles for business unit, divisions, enterprise

• Assess probability of violations for each grouping• Assess probability of violations for each grouping• Evaluate potential seriousness of violations• Use ranking system to chart risk• Use ranking system to chart risk• Create chart showing consolidated ranking results Low probability minor violations Low probability, minor violations High probability, serious violations

19

Goals in Designing Testing Protocol

• A risk-based process that can be consistently and s stematicall applied to operations across thesystematically applied to operations across the globe

• Appropriate depth and scope in light of resources• Appropriate depth and scope in light of resources and risks

• Cost effective and non disruptive to business• Cost-effective and non-disruptive to business• Preserve privilege where appropriate

20

Scope of Review

• Test knowledge and application of existing FCPA compliance policies and proced rescompliance policies and procedures

• Review existing internal controls policies, proceduresprocedures

• Evaluate response to issues: people and process

21

Testing Protocol

• Desktop Review Hotline reports Security investigations Internal audit reports, exceptions Legal filesg HR files Compliance certifications/questionnairesCompliance certifications/questionnaires Training records

22

Testing Tools

• Document review• Business unit profiles• Knowledge surveys• Focus groups templates• Interviews• Individual self-assessment surveys

23

Areas of Focus

• Contacts with Government

• Industry-specific risks

• Channels to market: third partiesp

24

K th C AtkiKathryn Cameron [email protected]

202 626 5957202-626-5957

25

Greta L.H. LichtenbaumNovember 4, 2010

Implementing Audits to Ensure Effective FCPA Compliance Programs: Risks and Challenges of Anti-corruption Compliance Audits

Potential Consequences of Failure to Conduct an Audit/Risk Assessment – Penalties for Violations of Bribery Provisions• FCPA

– Individuals face up to five years imprisonment, a fine of $250,000, or both

– Corporations also risk millions fines• UK Bribery Act

– Individuals face up to 10 years imprisonment, a fine, or both, for each violation

– No limit on penalties for corporations• Collateral Consequences

– Deferred or non-prosecution agreements, corporate monitors, disgorgement of profits, attorneys fees, reputational damagereputational damage

• Auditing catches bad conduct early before it gets worse and leads to greater fines

27

Other Potential Risks of Failure to Conduct Appropriately Regular AuditsAppropriately Regular Audits• FCPA

At minimum, reduces mitigation, g– Risk that failure to audit viewed as insufficient internal

controls• UK Bribery ActUK Bribery Act

– Safe harbor for “adequate procedures”– Potential risk that procedures would be deemed inadequate

where no audit.– New guidance on the Act cites to importance of audits

• GeneralFailure to audit undermines work put in to creating– Failure to audit undermines work put in to creating compliance program

28

Potential Risks of Failure to Conduct Audit/Risk Assessment – Dodd-Frank BillAudit/Risk Assessment – Dodd-Frank Bill

• The Whistleblower ProvisionThe Whistleblower Provision– Provides significant monetary incentives for whistleblowers

that report violations of securities laws before the company does

• Potential Implications for Audits– Increases necessity of frequent audits

• shows potential whistleblowers that company takes complianceshows potential whistleblowers that company takes compliance seriously

• decreases risk of violations that whistleblower can report– Requires extra sensitivity when dealing with outcome of

audits – cannot be seen to “paper over” control problems

29

Challenges and Strategies – SCOPE

• Challenge: How to define scope of audit appropriately?• Considerations:

– There are many shapes and sizes of audits, and need to chose level of audit carefully

– Factors include maturity of program, company-specific risks (geographical business model) and audit history(geographical, business model) and audit history

– At a minimum, some risk-based account and transaction testing• Strategy: Tailor tailor tailor to company’s circumstances

– Define initial scope clearly, refine only if risk assessment warrants itDefine initial scope clearly, refine only if risk assessment warrants it• recognize that audits can be iterative

– Draft detailed Audit Plan, which should include: goals, scope, protocols on communications, division of responsibilities, coordination with third parties major categories of tasks andcoordination with third parties, major categories of tasks, and deliverables

– This will avoid needless expansion of scope, and keep auditors accountable

30

Challenges/Strategies: COST

• Challenge– Conducting a cost-sensitive yet effective audit– Conducting a cost-sensitive, yet effective audit

• Strategy– Create a detailed budget with input from all players– Break out individual tasks, such as interviewing, document

review, outside vendors, preparation of report, etc.– Periodically reassess budget to manage expectations of all,

and take into account any new developments or unforeseen expenses

– Multi-task during travel: for example, interview, then train– Align responsibility with competence – KEY POINT

31

Challenges and Strategies: Who Conducts the Audit?the Audit? • Challenge

– It is important to identify the right players appropriate to the scope and nature of the audit

• “Players” include counsel (in/outside) and auditors (in/outside), and compliance professionals

• Strategy– First initially define scope, then identify staffing needs st t a y de e scope, t e de t y sta g eeds– Usually the best choice is a combination of both in house and

outside resources, with responsibilities clearly delineated• Considerations

– In-house attorneys and compliance personnel: know the company– In-house attorneys and compliance personnel: know the company, but may lack expertise and objectivity

– Outside Counsel: expensive, and will need to learn about the company and gain trust through interviews, but have expertise and can jump right in if violations are foundcan jump right in if violations are found

– In-house audit team: may not have adequate resources or expertise

32

Challenges and Strategies: Possible Restrictions on AccessRestrictions on Access• Challenges

– Privacy laws– Failure of cooperation, particularly from third parties

• Strategies– Retain local counsel as needed for privacy issues– For uncooperative employees, communicate goals and purpose of

audit clearly– For intransigent third parties: invoke contractual rights– If no contractual rights conduct due diligence and plan to reviseIf no contractual rights, conduct due diligence and plan to revise

contract at first opportunity– Keep actions consistent across jurisdictions – no blind eye or

special favors

33

Challenges and Strategies/Considerations: What if Apparent Violations are Discovered?Apparent Violations are Discovered?

• Risks: Whi tl bl ti– Whistleblower action

– Improper handling of information in terms of preservation of information/data and privilege –preservation of information/data and privilege i.e., staying in audit mode

• Strategy:– Don’t wait until end of audit to act!– Develop protocols at the start of audit to shift

i t i t l i ti ti dinto internal investigation mode

34

Challenges and Strategies/Considerations: What to do with the Outcomes/Results?do with the Outcomes/Results?

• RisksI ti l k f t t– Inaction, lack of momentum, cost

• StrategyDon’t wait until end of audit to develop ideas on– Don’t wait until end of audit to develop ideas on corrective action

– Build corrective action into budget and plan, with g p ,deadlines

35

Greta Lichtenbaum202 383 5249202-383-5249

[email protected]

36

Keeping Sight of the Forest While Scrutinizing the Right Trees: C ff C CConducting Effective Anti-Corruption Compliance AuditsStrafford Publications Webinar – FCPA Compliance AuditsNovember 4, 2010

© AlixPartners, LLP, 2010

Ed Fishman, K&L GatesBrent Carlson, AlixPartners

Two Key Current Trends Resulting in More FCPA Compliance Audits

Increase in Global M&A Activity and Private Equity ExitsGlobal M&A Quarterly Trend

Volume

Global M&A Quarterly Private Equity Trend

300Volume

1,500

2,000

2,500

3,000

umbe

r of D

eals

150

200

250

300

mbe

r of E

xits

0

500

1,000

Q109

Q209

Q309

Q409

Q110

Q210

Q310

N

0

50

100

Q109

Q209

Q309

Q409

Q110

Q210

Q310

Num

New Regulatory & Enforcement Developments

09 09 09 09 10 10 10

The Dodd-Frank Wall Street R f d C

The 2010 UK Bribery Act New Anti-Corruption Initiatives in Key Countries

Priority Focus on the FCPAReform and Consumer

Protection Act

38

Initiatives in Key Countries (for example, China)

Anti-Corruption Risk Assessment Essentials

Core Objective: To conduct review of anti-corruption risks in a cost effective and

timely manner (either as part of routine control or in M&A context)timely manner (either as part of routine control or in M&A context)

Core Issue: What are the highest anti-corruption risks faced by the client?What are the highest anti corruption risks faced by the client?

Core Risk Factors:•Country Risky•Industry Sector Risk•Government Business Risk•Third Party Agent Risk•Regulatory Risk

39

Anti-Corruption Risk Assessment Essentials

Strategic Considerations:

•Need to align scope with risks

•Must get client management team to support the exercise

•Many clients elect to adopt phased approach to compliance reviews

•Risk assessment often will have ancillary compliance benefits (e g•Risk assessment often will have ancillary compliance benefits (e.g., exposing problematic tax or customs issues or general control gaps)

40

Establishing a Methodology

Dubai / Mexico City

Understand Current Practices, Assess Current Compliance Infrastructure, and Identify Key FCPA 

FCPA Compliance Audits/Assessments/Due Diligence Revolve Around Four Main Steps:

Step 1: Assess Current 

P ti P li i d Risk Areas

Conduct Detailed Transaction Testing Based on P i it Ri k A I l di F ti A K

Step 2:

Practices, Policies, and High‐Risk Areas

Priority Risk Areas – Including Function Areas, Key Individuals, Customers and Locations

l d d h

pTransaction Testing

Interview Employees and Conduct Further Transaction & Data Analysis as Needed Based on Initial Observations

Step 3: Employee Interviews & Follow‐up Analysis

Recommend Best Practice Improvements  and Implement Immediate Remediation Measures as Necessary

Step 4: Best Practices 

Recommendations & l i

y

www.alixpartners.com 41

Implementation

Establishing a Methodology

Step 1: Assess Current Practices, Existing Policies & High‐Risk Areas

R i l i i li i & d

Assess Current Practices, Existing Policies & High Risk Areas

• Review relevant existing policies & procedures

• Issue preliminary document request list

• Understand  the Company’s organization, and individuals’ l & ibili iroles & responsibilities

• Understand  the sales cycle and channels, review sales contracts, and review customer profiles and locations

Id if k FCPA i k b d h C ’• Identify key FCPA risk areas based on the Company’s business model, customer demographics, and international locations

www.alixpartners.com 42

Preliminary Document Request List (Illustrative)1) Description of any past red flag concerns/whistleblower allegations

2) List of all corporate entities & affiliates

3) List of all Company locations, addresses, and description of the facilities/business

4) Organization chart with departments & department leader names

5) All internal controls policies and procedures, including code of business ethics (in English and local language, as applicable)

6) Customer list with revenue amounts for periods to be reviewed

7) Master accounts payable vendor file, showing all vendors with description of business purpose and amounts

8) List of all agents and consultants with description of business purpose

9) Contracts with any agents, distributors, or any other third party mentioned in any whistleblower allegations (if any)9) Contracts with any agents, distributors, or any other third party mentioned in any whistleblower allegations (if any)

10) Chart of accounts

11) Monthly management financial reports for periods to be reviewed

12) Trial Balances by month for periods to be reviewed

13) GL details for all employee travel and entertainment reimbursement accounts for the periods to be reviewed

14) Internal audit reports (if any)

15) Employee roster including:

Employee ID number Name in local language Name/nickname in English

While every engagement is different, we find these documents helpful to Name/nickname in English

Title Department Corporate entity/affiliate Location Date of hire

we find these documents helpful to get things started. This list was

developed based on our experience with FCPA matters and helps to hone

in on the key areas of focus.

www.alixpartners.com 43

Date of hire Date left the company (if applicable)

Establishing a Methodology

Step 2:Step 2: Transaction Testing

• Select related high‐risk target accounts and obtain general ledger detail

• Select transactions for detailed analysis on yexperience/judgmental basis by priority of risk areas and any predication

• Prepare samples to be used for employee interviews

• Review use of third‐party agents and sample agreements

www.alixpartners.com 44

Identifying Key Expense Accounts

Samples are typically selected from accounts based on experience in other FCPA matters and consist of transactions primarily related to:

Account # Account Description 5501111 Advertising5501119 Business Development5502132 Cli Gif

• Sales, marketing, and administrative expenses • Employee expense reimbursements • Use of third parties, including agents,

consultants and professional services.

5502132 Client Gifts5501133 Client Maintenance5501172 Consulting Fees5501130 Entertainment (General & Administrative)5502130 Entertainment (Sales & Marketing)

The chart on the left shows an example of expense accounts from which samples were selected.

5502130 Entertainment (Sales & Marketing)5501113 Exhibitions5501117 Gifts5501173 Human Resources & Consulting Fees5501185 Legal

Every company varies in terms of the exact items on their chart of accounts. Redundancies are common.

A t f hi h l ill b t k

g5501151 Office Expenses5501115 Other Marketing Expenses5501112 Promotional Samples5501116 Public Relations

Accounts from which samples will be taken vary by objectives and scope of engagement. A due diligence or assessment matter will differ somewhat in approach from an internal investigation in response to specific allegations

5501131 Sales Promotion5502174 Training5501121 Transportation5501120 Travel (General & Administrative)5502120 T l (S l & M k ti )g p p g

or predication.

www.alixpartners.com 45

5502120 Travel (Sales & Marketing)

Common Corruption-Related Fraud SchemesCorruption-related fraud schemes are essentially variations of fraudulent disbursements.

Historically, companies in high-risk regions have quite often displayed a sense of blissful naiveté toward the FCPA and anti-corruption requirements. Quite often no attempt was made to hide relevant FCPA-related transactions and these were typically clearly labeled in a company’s books and records (e g “Alcohol &transactions and these were typically clearly labeled in a company s books and records (e.g., Alcohol & Cigarettes for Government Official Director Wu” noted in a general ledger line item description).

With the global trend of increasing anti-corruption legislation and enforcement, expect to see more use of the following fraudulent disbursement schemes:

P ll S h

Fraudulent Disbursements

Billi S hExpense

R i b t Payroll Schemes

Ghost Employee

Billing Schemes

Accomplice Vendor

Reimbursement Schemes

Mischaracterized Expenses

Bogus Vendor / Shell CompanyFictitious Expenses

www.alixpartners.com 46

Overstated Expenses

Establishing a Methodology

Step 3: Employee Interviews & Follow‐up Analysis

• Confirm employees’ understanding of the Company’s current practices and policies

• Compare results and observations from interviews with transaction testing

• Use initial transaction testing & data analysis  to compare with employee responses

• Conduct walk‐throughs of related internal controls

• Conduct further transaction analysis and analytics as needed based on interview findings

www.alixpartners.com 47

Establishing a Methodology

Step 4: 

id d i i h ’

pBest Practices Recommendations

• Provide recommendations on improvements to the Company’s FCPA/anti‐bribery program plan based on the OECD’s Good Practice Guidance on Internal Controls, Ethics and Compliance, covering the following areas:g g

• Policies & Procedures, • Training & Certifications, • Responsibility & Accountability, and • Follow‐on Testing• Follow on Testing

• If necessary, implement any immediate measures based on assessment findings to prevent  potential violations in high‐risk areas

www.alixpartners.com 48

Essential Components of an Effective FCPA Compliance ProgramAn effective FCPA compliance program contains four key elements:

Policies and Procedures• Need to be tailored to the organization’s business with appropriate oversight and designated responsible persons.• Need to contain specific travel, entertainment, and gift provisions; as well as policies for third-party intermediaries

and other consultants. • Must include provisions addressing the accounting function and (FCPA-specific) internal controls; SOX 404 policies

typically do not address FCPA specifically.

Training and Certification• Conduct annual training (and first-time and refresher) training for all sales, govt. relations, and finance/accountingConduct annual training (and first time and refresher) training for all sales, govt. relations, and finance/accounting

personnel.• Distribute materials summarizing the FCPA (in the local language) and the company’s relevant policies and

procedures.• Obtain signed certifications by employees acknowledging receipt, understanding, and willingness to abide by

relevant policies.

Responsibility and Accountability• Designate specific individuals with appropriate level of authority for on-going compliance.• Reinforce culture of compliance with regular internal communications by management demonstrating the

company’s commitment to ethical business practices.• Implement specific actions for non-compliance including termination and reflection in annual performance reviews• Implement specific actions for non-compliance, including termination and reflection in annual performance reviews.

Testing• Regularly test FCPA compliance policies and procedures to verify actual level of understanding and compliance, as

well as to reinforce training.• Conduct sample testing across company service lines prioritized by areas of higher risk.• Test for both compliance with anti-bribery provisions AND accounting provisions.• Use results in interviews with relevant employees to reinforce accountability.

www.alixpartners.com 49

Policies & Procedures - Internal Controls Recommendations

SOX 404-based internal controls programs have historically not addressed FCPA-specific issues. Internal controls programs should be enhanced in the following areas:

Internal Controls Areas Examples of FCPA-Specific Provisions

Delegation of Authority Dollar value thresholds in corporate policies often are not reasonable for local operations. Approval limits must be appropriate to local entity’s volume of business.

Segregation of DutiesIn an FCPA context this goes beyond ensuring that the cashier does not have change access to accounts payable; for any government-related transaction the company’s legal department outside local operations should be part of the approval process.

Vendor Approval Process In addition to establishing a due diligence process, companies need all vendors to sign Vendor Approval Process FCPA compliance certifications, without which the company cannot make any payments.

Disbursement Approval Process

Without satisfying the due diligence and FCPA compliance certifications, no transactions can be effected with any third parties. Employee expense reimbursements cannot include payments to vendors which would circumvent the vendor due diligence process.

On-going Monitoring and Testing

Internal and external audits based on SOX and/or COSO frameworks tend to exclude FCPA-specific controls in their periodic testing. Companies should have independent, efficient compliance assessments by experienced outside professionals.

www.alixpartners.com 50

Brent C. Carlson Director

Brent helps companies and their stakeholders in the areas of dispute consulting internal investigations restructuring &

DirectorSan [email protected]

Brent helps companies and their stakeholders in the areas of dispute consulting, internal investigations, restructuring & turnarounds, operational improvement, interim management, and mergers & acquisitions. His financial advisory experience spans a range of industries including construction, consumer products, life sciences, manufacturing, petrochemicals, technology, and transportation.

As a Certified Fraud Examiner, Brent has provided dispute and forensic consulting services in internal investigations, i l di t i l i di ti bit ti d i il liti ti ll i i l ti B t l h

• Over fifteen years of China business experience in a number of senior management roles including Chief Financial Officer, Deputy General Manager/COO, Chief Compliance Officer and Chief Representative.

• Conducted internal investigations on multiple engagements for U.S. companies facing possible Foreign Corrupt P ti A t i l ti E t i l d d d t il d l i f b k d d t t fl f f d f

commercial disputes involving mediation, arbitration, and civil litigation, as well as criminal prosecution. Brent also has testified in court as an expert witness in fraud-related matters. Brent is fluent in Mandarin Chinese.

Practices Act violations. Engagements included detailed analysis of books and records to trace flow of funds for potentially corrupt payments. Findings led to remediation measures including tightening of internal controls, designing company compliance programs and training employees in related ethics and compliance issues.

• Conducted FCPA due diligence and risk assessment engagements for U.S. multinationals with operations and acquisition targets in China. Efficiently and accurately focused on high-risk areas known from over fifteen years of prior China business experience

Association of Certified Fraud ExaminersAssociation of Insolvency and Restructuring AdvisorsTurnaround Management Association

China business experience.

• Served as interim Chief Compliance Officer at the Chinese subsidiary of a U.S. multinational following acquisition.

Brent holds a masters degree from Yale University and is a Summa Cum Laude graduate of the University of Minnesota.

www.alixpartners.com 51

Edward J. FishmanEdward J. Fishman is a Partner in the Government Enforcement Practice Group at the K&L Gates LLP law firm in Washington, p g ,D.C. He represents clients in connection with the Foreign Corrupt Practices Act ("FCPA") and related anti-corruption, export control, accounting and internal control matters. He leads a global team of lawyers at K&L Gates that specializes in conducting FCPA due diligence and compliance reviews and internal investigations around the world. He routinely represents clients in FCPA and related investigations being conducted by the U.S. Department of Justice, the U.S. Securities and Exchange Commission and foreign regulatory bodies.

i h id i d l d li d hi d i li i h d f lK&L GATES LLP Mr. Fishman provides ongoing FCPA and related compliance and ethics advice to clients in the defense, natural resources, biotechnology, pharmaceutical, consumer products, manufacturing, transportation, financial, consulting and numerous other industries. He regularly assists these clients in preparing and strengthening global business compliance policies and procedures, has conducted FCPA and code of ethics training sessions in various countries, and has extensive experience advising multinational clients with business operations in Asia, Africa and other parts of the world.

K&L GATES LLPWASHINGTON, D.C. OFFICE202.778.9456 TEL202.778.9100 [email protected]

RECENT REPRESENTATIVE EXPERIENCE• Managed FCPA and internal fraud investigation in China for U.S. public company in the consumer products industry.•Conducted FCPA investigation for U.S. mining company with joint venture operations in Africa.•Developed anti-corruption compliance programs for numerous Fortune 500 companies with operations around the world•Developed anti-corruption compliance programs for numerous Fortune 500 companies with operations around the world.•Advised U.S. biotechnology firm with respect to FCPA compliance issues in China and related investigation.•Managed FCPA investigation for a U.S. global manufacturing company relating to alleged payments by a foreign subsidiary to government officials in India. •Conducted FCPA investigation for the Audit Committee of a U.S. multinational relating to improper payments to European tax officialsofficials.•Outside FCPA counsel to a publicly-traded U.S. transportation and logistics company with extensive operations in Asia, Europe and North America.

BAR MEMBERSHIPSDistrict of ColumbiaM l dMaryland

EDUCATIONJ.D., George Washington University Law School, 1996 (highest honors)M.A., George Washington University Elliot School of International Affairs, 1996B.A., Duke University, 1991 (cum laude)