THE INTERNATIONAL IMPACT OF FRAUD GLOBAL INTERMEDIARY RISK RATING AND RESPONSE PROTOCOL

Transcription

1 THE INTERNATIONAL IMPACT OF FRAUD GLOBAL INTERMEDIARY RISK RATING AND RESPONSE PROTOCOL This session will cover a risk mitigating protocol that demonstrates a prudent approach to evaluating the risk involved with intermediary relationships and corresponding transactions when conducting business internationally. You will learn the phases to evaluation and standard risk responses for each phase depending on the risk rating. RICHARD PANSKE, CFE, CPA, CFF Senior Director, Business Assurance Oshkosh Corporation Oshkosh, WI Rick Panske is the Senior Director, Business Assurance, at Oshkosh Corporation serving as the lead fraud examiner and asset protection resource. Rick established and enforces Oshkosh s anti-fraud policy and procedure including the fraud risk assessment and risk response activities reported to the Audit Committee. In addition Rick collaborates with internal and external legal counsel to investigate matters involving allegations of financial fraud, theft, or abuse. Rick collaborates with legal and international sales teams to mitigate the risk of bribery and corruption. Rick has performed anti-fraud initiatives in Belgium, China, Colombia, Costa Rica, Germany, Italy, Mexico, the Netherlands, Peru, Poland, Romania, the United States, and Venezuela working with a highly skilled team of outsourced investigative resources. Rick is a Certified Fraud Examiner, Certified in Financial Forensics, and a Certified Public Accountant. Rick is a member of the Association of Certified Fraud Examiners (ACFE), American Institute of Certified Public Accountants, and the Institute of Internal Auditors. Rick has been a past speaker for the Wisconsin Institute of Certified Public Accountants and is pleased to have been selected to speak at the 2011 ACFE Annual Conference. Association of Certified Fraud Examiners, Certified Fraud Examiner, CFE, ACFE, and the ACFE Logo are trademarks owned by the Association of Certified Fraud Examiners, Inc. 2011

2 Summary This session covers a risk mitigating protocol that demonstrates a prudent approach to evaluating the risk involved with intermediary relationships and corresponding transactions when conducting business internationally. You will learn the phases to evaluation and standard risk responses for each phase depending on the risk rating. This risk mitigating protocol established by a Fortune 500 company was designed to evaluate the risk with the intermediaries including agents, consultants, dealers, brokers, and so on. There are two phases to evaluation first the relationship, then the transaction itself. A standard risk response is established for each phase depending on the risk rating. The risk response involves the use of both internal and external resources in both a collaborative and non-collaborative manner. This session is intended for those familiar with the risk of bribery and corruption with international transactions. Since this is an intermediate-level session, those with basic knowledge would benefit from a review of the following regulations: Foreign Corrupt Practices Act of 1977 ( Note: The U.S. Department of Commerce has unofficial translations of the FCPA in several different languages ( Bribery Act 2010 ( Each individual country might have their own version of anti-bribery and anti-corruption laws that apply to multiple countries. Some examples include the following:

3 ADB OECD (Organisation for Economic Cooperation and Development) Anti-Corruption Initiative for Asia and the Pacific ( 1_1_1_1_1,00.html) OECD Convention on Combating Bribery of Foreign Public Officials in International Business Transactions ( _1_1_1_37447,00.html) Council of Europe Criminal Law Convention on Corruption (conventions.coe.int/treaty/commun/quevoulezvous. asp?nt=173&cm=1&cl=eng) United Nations Convention Against Corruption ( Organization of American States Anti-Corruption ( Data points with comprehensive usability include the following: Transparency International ( According to the website, Transparency International, the global civil society organisation leading the fight against corruption, brings people together in a powerful worldwide coalition to end the devastating impact of corruption on men, women and children around the world. TI s mission is to create change towards a world free of corruption. Trace International ( According to the website, TRACE is a non-profit membership association that pools resources to provide practical and cost-effective anti-bribery compliance solutions for multinational companies and their commercial intermediaries (sales agents and representatives, consultants, distributors, suppliers, etc.)

4 Wisconsin s influence on FCPA: It was Wisconsin Congressman William Proxmire in his capacity as the Chair of the Senate Banking, Housing and Urban Affairs Committee, along with Senators Church and Sporkin, who advanced the books and records provision of the FCPA. Background Note The example used has been modified for the effect of generating questions and get you thinking about your own company. This session is based on my experiences during the past several years as my employer has continued efforts to expand globally. The risk of a violation of international anti-bribery laws and most specifically the Foreign Corrupt Practices Act had already been included as a top risk in the annual fraud risk assessment. The increased global focus simply escalated the risk in this area. To respond to this risk, our internal audit team established an audit of our international team responsible for performing due diligence on the intermediaries the company uses to market our products. This audit indicated opportunities to improve in this area. Policies and procedures were in place but needed to be revisited. Our products include aircraft rescue, firefighting trucks, ambulances, and refuse vehicles, all of which are sold to municipalities or government agencies. After a long history of success domestically, the shrinking domestic demand coupled with global opportunities led to the pursuit of an international market we had not previously tapped. This pursuit included signing up new representatives

5 Kick-Start to Risk Response: A New Deal At the same time, the internal audit team was putting the finishing touches on their report, one of our sales teams was considering a deal with a country that had a Transparency International Corruption Perception Index (CPI) of 2 (that s deep red if you re looking at their color map!). The lower the CPI index, the higher the risk, so this wasn t good. The deal included several units. The agent was new. Our salesperson was new. Internal legal counsel was reviewing the contract and called Leigh in Compliance to share his observations. Leigh called me, in Business Assurance, and said, Rick, I d like your thoughts on this. Key Point: Collaborate. The teams engaged at this point include International Sales, Legal, Compliance and now me Business Assurance. As indicated earlier, Internal Audit had performed a review that the Controller s office and other teams had access to. The point here is that addressing risk involves a collaborative approach across several different functions. Looking at the arrangement from a common-sense approach, it didn t lend itself to a high comfort level but we didn t have formal risk rating approach that demanded a particular next step to respond to the perceived risk. While the contract made its way through legal review, I requested the due diligence folder from the International Sales Support team. The folder was pretty thin. What was there included a checklist of general information (i.e., mailing address, phone number, owners, customers, bank references, etc.), only a portion of which was filled in. Having standard information gathered internally was our primary source of due diligence. A good first step but as risk rose, our response did not also rise. The thought was,

6 this standard checklist is helpful but we can expand on it to make our internal effort more comprehensive. I made a general media search on the Internet for any details on the intermediary and didn t find much. Our Compliance lead and I talked about what options existed to gain some additional comfort with the intermediary we were using. She referred to an she received from her team leader that recommended a company named Trace International (Trace). Neither of us had heard of the organization but if her team leader shared it with his team, we knew that he supported the firm. Trace seemed to offer a reasonable solution to learn more about an intermediary but first we have to be a member and that has a fee. In addition each level of Trace cost as a fee, which corresponded with the depth of the review. Specifically there is Trace Check (scratch the surface), Trace Standard (2 binder of details), and Trace Review (feet on the ground to dive more deeply). Trace s approach is collaborative and the intermediary is completely informed and on-board with the anti-bribery, anti-corruption protocol that Trace offers. I thought it was an interesting approach and that maybe they should be part of our risk response. But when? Other options Leigh and I consider included the use a noncollaborative approach by hiring a firm to look into the intermediary s due diligence. We had a network of firms to consider, and contacted Firm A first because we already had a master services agreement in place with it. Our experience was that they were costly but delivered high quality results and were well-connected globally. If you are looking for a comprehensive deep dive with a big name firm for big bucks, A will meet your needs. To conduct thorough due diligence on the new intermediary, Firm A quoted a cost of $23,000. Based on the lengthy proposal

7 that included a history of the bribery and corruption laws, including flow charts and an organizational chart of engagement team members along with their CVs, the cost was consistent with our expectations. Key Point: Know your scope. We wanted to know if these guys were who they said they were, who the principals were, if there were any government connections, any past history of being bad guys, etc. Bottom line were they the kind of guys we wanted to put our brand on? The second firm, Firm B, we had used for investigative support on fraud examinations, workplace violence issue resolution, physical protection and other sensitive projects. B was also well connected globally but they were more of a collection of small firms and they used their professional network to engage other trusted professional resources as subcontractors. Their proposal was also lengthy but didn t include charts like Firm A s proposal did. Firm B s estimate was $18,000. The search for an alternative continued. With the help of several former colleagues who were, and continue to be, much wiser and better networked than me, a strong alternative was identified. Firm C s proposal was an summary, with no legal history, flow charts, or org charts. It would cost $3,000 for a deep dive, including feet on the ground. Key Point: No names can have perceived risk. The benefit of large, big-dollar firms is when leadership asks, Who did we use? Name recognition might be helpful. Leadership will ask when there is a problem. This is when it is best to have a preapproved process in place. During this case, we were still forming what would become

8 our process but had yet to have management s endorsement. If we experienced a problem and had to say we used Firm C, it could have been a career-limiting move (CLM). That is why it s important to define a protocol with management s support and stick to it. This insulates the organization and maybe you too. Framing the Initial Risk Rating and Response Protocol Risk Rating As the quotes for the due diligence were being assembled the audit report was also delivered. It included an action item of more robust documentation regarding the due diligence for intermediaries. Our recent efforts with the new deal echoed the audit report. The Compliance, Business Assurance, and International Sales teams met to frame a risk-rating protocol along with the necessary steps to mitigate risk sufficiently. The first draft of the protocol utilized the details from the deal we were currently reviewing. Documenting the procedure was relatively simple. Key Point: Implement policies and procedures. For a draft of our procedures, including intermediary vetting, hosting foreign officials, and gift giving, contact me at Rpanske@oshkoshcorp.com. All we did was commit to documenting in a procedure what we had already talked about. A policy was already in place demanding proper due diligence. The procedure consisted of the questionnaire (several pages long) that was in the intermediary s due diligence folder. We agreed to work together to update the policy (and continue to update it on an annual basis as all policies should be). We also agreed to work together on a more comprehensive procedure. Once the concept was agreed to, I shared the risk-rating matrix. Initially

9 there was a cumulative rating based on 13 criteria, but the process has evolved. We now separate the relationship and the intermediary into 8 criteria, and each transaction is rated separately using 15 criteria (so a total of 23 criteria). Key Point: Incorporate lessons immediately. After the initial risk rating was prototyped for several months, we established more than 30 new intermediaries but only one exceeded the necessary threshold for additional due diligence. We were not selecting a sufficient number of intermediaries for advanced vetting. It was obvious we needed to revise our approach. The revision was to separate a relationship risk from a transaction risk. The relationship rating asks the following questions: R1. WHAT TYPE OF ARRANGEMENT IS BEING REQUESTED BY THE INTERMEDIARY? A drop-down list offers the user several options, including: Representative Exclusive (If this is selected, the risk rating auto populates a risk of 4 which is the highest risk rating for this first question.) Distributor Exclusive (This is also a 4.) Representative Non-Exclusive (This is a 3.) Distributor Non-Exclusive (This is a 3.) For each of the 12 relationships we offer, we created a risk rating. R2. WHAT IS THE CPI RATING FOR THE INTERMEDIARY S COUNTRY AND/OR COUNTRY OF RESPONSIBILITY? Follow Transparency International s CPI ratings. The ranges generally follow a color pattern in which

10 deep red carries the highest risk. A CPI rating of 1.9 or less (including no data ) = 10. A CPI of = 8. During the presentation we will review each of the other relationship criteria. The transaction rating focuses on the deal itself. Bigger dollars translate to bigger risks. Fifteen criteria have been established and ask questions like the following. T1. WHAT IS THE TRANSACTION SIZE AS A PERCENT OF ANNUAL NET SALES? If it is more than 5 percent of annual net sales for the particular business unit, a risk rating of 5 is assigned. This is the maximum for this category. T2. WHAT ARE THE CIRCUMSTANCES OF THE AWARD (E.G., PUBLIC TENDER, PREFERRED SUPPLIER, ETC)? We will populate this based on file details. During the presentation we will review each of the other transaction criteria. Risk Response The basic response required for all relationships and transactions regardless of size was defined as a comprehensive internally prepared set of documents, including an intermediary application form, antibribery/anti-corruption certification, and the sales manager s due diligence checklist. When the cumulative net risk score is 20 or less, this internal level of review is all that is required. The level of response grows as the risk grows with the concept that the

11 cumulative net score should ensure the relationship and/or transaction remains within our risk tolerance. If the risk is between 20 and 25, internal documentation and an ISP are required. This may involve engaging the intermediary locally as part of a limited level of local due diligence. For a rating of 25 30, we engage Trace to perform a collaborative Trace Standard Certification. We will discuss the Trace Standard process in greater detail during the session. The resulting work product is a comprehensive accumulation of data based on Trace s search of databases, inquiries, and intermediary response. If inconsistencies are identified, Trace works to resolve them. The challenge with relying solely on this is it is similar to auditing by inquiry. Those of you who are auditors know that to really know the facts, it is best to perform independent tests and make observations to verify results. The cost for this is $2,000 (on top of the ~$15,000 membership fee). Key Point: Trace membership benefits are significant. Resources include overviews for all countries in which we have operations. The overviews are prepared by attorneys at Trace. These attorneys can be engaged if a company does not already have a trusted local resource. As a member, you can also engage Trace to perform a screening (e.g., the $2,000 standard screening). For a risk rating of more than 30, we engage noncollaborative resources to validate the information gathered in the previous steps. This costs between $3,000 and $5,

12 It is important to recognize certain relationship deal breakers, such as a past history of unfavorable behavior, ownership that includes local government officials, or an end user in the deal. Transaction deal breakers can include an excessive commission (greater than 20 percent) or excessive in-country purchase requirement (i.e., offset). Key Point: Recognize the underground. The more attention paid to international bribery and corruption, the more our intermediaries will know what we are looking for. They realize government ownership or affiliation is prohibited. What was normal due diligence in the past is no longer acceptable. What Happened with the New Deal? The end result in our case was a post-transaction Trace Standard certification. That intermediary has since renewed their certification at their own cost (we pay for them to go through the certification process the first time; they pay the renewal fee on an annual basis and we are kept abreast of renewals). We continue to monitor certain intermediaries even if they have a Trace Standard certification to ensure the risk remains within our tolerance. Where We Are Today We strive to conduct sufficient due diligence overall. Our deal-by-deal approach has been endorsed by colleagues employed by large accounting and investigative firms. We continue to challenge the process by asking questions such as, How many deals have been disqualified? What percentage of our intermediaries are Trace Standard certified? and What percentage of our deals are subjected to the highest level of due diligence?

13 Good luck with your intermediary risk mitigating activities it is a journey that never ends