Fraud and corruption When an investigation is also a crisis. Andrew Macintosh Associate Director

Transcription

1 Fraud and corruption When an investigation is also a crisis Andrew Macintosh Associate Director

2 Agenda 1. The context: When is an investigation a crisis? 2. What is a crisis-led approach to investigations? 3. What is the role of crisis and investigation teams? 4. Auditors versus investigators 5. Case studies 1. Crisis in the sales force 2. A major crisis

3 Introduction Control Risks is a global, independent risk consultancy specialising in political, integrity and security risk Since 1975, we have worked in over 130 countries for more than 5,000 clients Trusted adviser to more than 80% of the Fortune 500 companies 36 offices on five continents Ethical and independent We enable our clients to succeed in complex, hostile environments

4 Control Risks practice areas Political and regulatory risk analysis Political, regulatory risk assessments Sector-focused power mapping Monitoring Pre-Transaction Integrity consulting Compliance support FCPA due diligence Business intelligence Political risk Integrity risk Security risk Post-Transaction Investigations Fraud and malfeasance IT and financial forensics Compliance breaches Malicious product tampering Crisis and Security Preparedness and response Complex problem solving Cyber security Crisis management and business continuity Security advisory support, audits and reviews

5 The context How to define a crisis Investigations as crises Management vs communications Approach and objectives Regulatory investigation impact

6 Crisis management What is a crisis? How do you define a crisis? Crises are extraordinary events that require extraordinary effort and commitment to resolve them positively

7 Crisis-led investigations Corruption allegations and threats: A senior sales manager refused to implement a corporate restructure. She had two regional managers beaten with an axe pole. A security crisis turned into corruption crises when a series of rumours about corruption and conflicts of interest were raised and confirmed. Counterfeit product/conflict of interest: A whistleblower identified senior sales managers as having a conflict of interest with a major distributor who was also manufacturing counterfeit and faulty products. The investigation turned into a crisis because of the potentially significant global impact and resources required to recover. Embezzlement: The head of the China business was alleged to have embezzled more than RMB 200m. Some of this money had been used to bribe government officials to secure business.

8 The crisis-led approach - when to use? Use a crisis-led approach for UNCONTAINED or CRISIS integrity related investigations: Uncontained: Event/issue is emerging and not clearly defined. The possibility of adverse effects on brand, profit and growth are high. There is a possibility authorities will investigate or intervene and there may be multiple stakeholders to manage. The management team lack necessary experience and/or resources to resolve it. Crisis: Event/issue is leading towards acute risk to profit, brand, growth, safety and/or serious public comment or criticism. There is be an immediate need for significant support. Until the situation is resolved, other business priorities are secondary.

9 Typical escalation China PSB NDRC SAT Multiple regions AIC Multiple tax investigations by region and product Multiple product and regions NDRC MPS/SAT/NDRC Whistle-blower Multiple AIC investigations SAT Multiple whistleblowers SAIC/PSB Regulator scrutiny Contained Uncontained Crisis

10 Defining a potential investigation crisis Types of complex problems experienced will vary depending on the environment and management experience. However, they all have similar core characteristics: (1) Not clearly defined: Confusing, incomplete or inaccurate information; limited previous experience (2) Dynamic: Multiple stakeholders with competing interests, motivations and ability to influence (3) Time dependent: Decisions need to be made at the correct place in time in relation to the dynamic environment (4) Complex: Many variables may be related; the problem requires not one decision, but a long series of inter-related decisions. For a task that is changing continuously, the same action can be important at step one and useless at step two (5) Significant potential impact: A critical impact on operations, reputation, business continuity, profit, growth, ability to execute strategy, etc. The C-suite has immediate decision-making authority

11 Symptoms of a crisis Lack of accurate information Number of interested stakeholders Public concern (actual or potential) Costs, damages and liability Perceived or real loss of control No immediate obvious solutions Lack of resources and expertise Effective resolution requires expertise outside your office

12 Immediate priorities Ensure health and safety ALWAYS THE FIRST PRIORITY Protect and secure evidence Understand the law identify any immediate legal obligations Limit the people who know or are involved Understand the wider context Identify a key decision maker; internal politics Conduct scenario planning Don t assume ANYONE knows what they re doing Establish a routine

13 Your immediate objectives should ensure Protection of life and health Termination of the incident Protection of the interests of the company or P eople E nvironment A ssets R eputation S takeholders

14 The longer term objectives Think beyond merely the resolution of the immediate investigation/issue Define what recovery looks like, for example: Sustainability (short term pain = long term gain?) Market position Relationships with stakeholders Legal Reputation The context The industry The client Competitors

15 Scenario planning Consider from each functional/individual perspective, what you believe is: The worst case scenario The most likely scenario The best case scenario

16 Crisis management vs crisis communications Crisis management deals with the reality of the crisis Crisis communications deals with the perception of the reality

17 The impact of regulatory investigations Employees, third parties, customers and consumers become nervous Immediate priorities are: To secure evidence To conduct a complete review of previous whistleblower complaints, internal audits and third-party relationships This is not (just) about FCPA. It is, first and foremost, a local legal issue The company response will need to include a crisis team in-country and at HQ

18 The crisis and investigation teams

19 Work streams A team will need to define the objectives and scope of various work streams. A chief of staff will need to co-ordinate and communicate results and tie up loose ends to see the big picture : Legal HR Communications Government relations Investigations: Security Internal Finance External Interviews

20 Audit versus investigation

21 Functions of an internal audit Evaluates and provides reasonable assurance that risk management, controls and governance systems are functioning as intended. Reports risks management issues and internal control deficiencies. Evaluates a regulatory compliance program with consultation from legal counsel. Engages in continuous education and staff development. Provides support to the company s anti-fraud programs.

22 What makes investigators different from auditors? Look beyond the surface more than a routine check Detailed examination of high-risk areas rather than sampling Open-minded approach that follows the leads, not a check-box exercise Tools that investigators use: Computer forensics Forensic accounting Public record research Investigative interviews

23 The little details matter! Media research, public record research and especially their overlap can be incredibly valuable and break a case wide open. Not only will these details become valuable keywords for IT forensics, pursuing each detail on its own in media can uncover important and unexpected connections. Real world examples: Phone number overlap between HR files and a vendor list showed the client s sales employees were using aliases to purchase their own product at below market rates. A personal address, supposedly linked to the client s employee, was also being used by a company that competes with the client. The contact person for the company using this address had the same name as the employee s wife.

24 Case studies

25 Crisis in the sales team? Client is a manufacturer of electronic components that are used in a wide range of items, including aerospace One of their top salesmen quits saying something bad is going on my life is under threat if I reveal anything His boss, the head of sales, said he had also received threats At the same time, the client identifies a counterfeit batch of goods bearing its name New CEO says he believes there is collusion in the sales team WHAT ARE THE IMPLICATIONS FOR THE VARIOUS WORK STREAMS?

26 Major case study Engineering company A company involved in engineering has a problem as the general manager: Is behaving inappropriately Has complete control of the facility Has the support of the personnel Has the support of external parties Might have supporters in HQ Controls a significant proportion of global business

27 In the beginning are you a PR agency?

28 D-day planning

29 D-day

30 Conclusions

31 Four critical factors 1. Perception 2. Control Understanding of the local and national political environments Success and failure of those before you Modus operandi of key stakeholders Rigorous analysis of limited/conflicting information Evidence, stakeholder communication, media, etc. 3. Organisation Multi-disciplinary team 4. Recovery Continuity Sustainability Improved market position/reputation

32 Some final lessons Complex problem solving requires leadership you may have to encourage it Be aware of and manage internal politics and stakeholders Simple processes are essential: Risk storm worst case and most likely First response assessment protocol Keep an open mind focus on the scenarios Finally, focus on the long term objective to recover the business

33 Questions?