Quad/Graphics, a provider of digital and print marketing, will pay $10 million to resolve charges with the Securities and Exchange Commission that it violated the Foreign Corrupt Practices Act by engaging in widespread bribery schemes in Peru and China.

According to the SEC’s order, from at least 2011 to January 2016, Quad/Graphics’ Peruvian subsidiary, Quad/Graphics Peru, in violation of the FCPA, repeatedly paid or promised bribes to Peruvian government officials to win sales contracts and avoid penalties and improperly attempted to influence the judicial outcome of a dispute with the Peruvian tax authority.

Quad/Graphics Peru also created false records to conceal transactions with a state-controlled Cuban telecommunications company, which were subject to U.S. sanctions and export controls laws. In addition, the order finds that from 2010 to 2015, Quad/Graphics’ China-based subsidiary, Quad/Tech Shanghai Trading Company, used sham sales agents to make and promise improper payments to employees of private and governmental customers to secure business.

“As a U.S.-listed company expanding abroad, Quad/Graphics failed to ensure that its internal accounting controls were sufficient to prevent the type of widespread bribery in Peru and China and the concealment of commercial sales in Cuba,” said Tracy Price, deputy chief of the SEC’s FCPA Unit.

Below are five compliance takeaways from Quad/Graphics’ missteps:

Lesson #1: When acquiring a company, first establish a compliance program. Prior to acquiring World Color Press, a Canadian printing company, in July 2010, Quad used to be a privately held printing company, focused on domestic sales. Following the acquisition, however, “Quad quickly became a public company with a major international presence,” the SEC said. “Quad acquired over 16,000 World Color employees, several subsidiaries, and multiple plants throughout Latin America, and its common shares began trading on the NYSE.”

Despite becoming a publicly traded company with a large global workforce and operations in high-risk areas, Quad’s compliance program was almost non-existent in 2010. At the time, Quad failed to implement sufficient internal accounting controls or anti-corruption policies and procedures and failed to conduct meaningful due diligence on third parties.

Lesson #2: Don’t ignore the importance of internal audit. At Quad/Graphics, “internal audit had no visible role in anti-corruption testing,” the order stated.

Lesson #3: Internal accounting controls are critical for preventing bribery. From at least 2011 to 2016, “Quad’s failure to implement a robust compliance program and maintain sufficient internal accounting controls contributed to ongoing bribery schemes in Peru to obtain business and win favorable outcomes in tax litigation,” according to the order. In total, Quad Peru allegedly paid or promised over $1 million in bribes through sham vendors to secure contracts by which Quad was unjustly enriched by over $4.4 million.

“The schemes were facilitated through third-party vendors,” the order states. “Quad’s then-operations executive for Latin America and a then-finance executive for Latin America, both based in the United States, either ignored significant red flags or participated in the misconduct. These failures also allowed Quad/Tech China’s bribery of customers to facilitate systems sales to continue from 2010 to 2015, and Quad Peru’s sanctions violations in connection with the sale of goods to Cuba in 2012. None of the improper payments were accurately reflected in Quad’s books and records and its internal accounting controls were not reasonably designed to detect or prevent them.”

Lesson #4: FCPA training is important. According to the SEC’s order, Quad/Graphics “failed to conduct broad FCPA or ethics training until approximately 2012.” Even then, training was “not taken seriously by certain Quad Latin America employees. High-level Latin America executives failed to support the effort, as illustrated by one management meeting in Peru, where sales performance issues were discussed, and the operations executive for Latin America alluded to bribery when he joked that everything about Quad Peru’s operations could be changed except the head sales executive, because he was the key to contracts with [the Ministry of Education], presumably due to his corrupt efforts to win those sales.”

Lesson #5: Compliance experience is relevant and important. Quad/Graphics appointed its first director of compliance in 2011. However, this individual had an information-technology background, with no compliance experience or training.

Quad Peru’s bribery activity continued until 2015, when a new senior finance manager was hired from outside Quad. At that time, two managers alerted the new hire to “several suspicious invoices that had recently been submitted by two of the sham vendors,” according to the order.

“Several of the invoices contained red flags, including having the same date and dollar amounts and consecutive invoice numbers. Upon review, the new senior finance manager agreed the invoices were problematic and declined to approve them.”

That new manager then reported his concerns to the same finance executive who, years earlier, was notified of similar suspicious payments by Quad Peru’s former senior finance manager. That time, however, the suspicious payments were reported to Quad’s U.S. legal department, where they were finally addressed.

In the end, the SEC found Quad/Graphics violated the anti-bribery, books and records, and internal controls provisions of the Securities Exchange Act of 1934. Without admitting or denying the SEC’s findings, Quad/Graphics has consented to a cease-and-desist order and has agreed to pay $10 million, consisting of $7 million in disgorgement, $959,160 in prejudgment interest, and a $2 million civil penalty. Quad/Graphics also agreed to self-report on its compliance program for a year.

DOJ declination

Notably, the Fraud Section of the Department of Justice’s Criminal Division declined prosecution. “We have reached this conclusion despite the bribery committed by employees of the company’s subsidiaries in Peru and China,” the Justice Department stated in a letter to the company’s counsel.

Citing its FCPA Corporate Enforcement Policy, the Justice Department mentioned the following factors as its reasoning: Quad/Graphics’ “prompt, voluntary, self-disclosure”; “thorough and comprehensive investigation”; “full and proactive cooperation”; the “nature and seriousness of the offense”; the company’s “lack of prior criminal history”; Quad’s “full remediation”; and the fact the company agreed to and will disgorge to the SEC the full amount of its ill-gotten gains.