Five compliance lessons from Walmart’s FCPA settlement

On June 20, Walmart and its wholly owned Brazilian subsidiary, WMT Brasilia, reached a combined $282.7 million settlement with the Department of Justice and the Securities and Exchange Commission—$138 million to resolve the criminal charges and $144.7 million to resolve civil charges—for violations of the books-and-records and internal accounting provisions of the FCPA concerning the company’s operations in Mexico, China, India, and Brazil. The settlement also resulted in a three-year non-prosecution agreement and the imposition of a compliance monitor for two years.

For many in the compliance space, Walmart’s FCPA case is old news. Since the retail giant first disclosed its FCPA concerns to U.S. government authorities in 2011, the facts and global scope of Walmart’s misconduct are, at this point, well-publicized, as are Walmart’s extensive remedial efforts regarding the revamping of its global anti-corruption compliance program.

That is not to say, however, that the settlement documents, together with Walmart’s own disclosures pertaining to its remediation efforts, don’t deserve a close read. Although Walmart declined to comment on the case beyond what is already in the public domain, the documents themselves provide compliance officers with a treasure trove of insight, both on how to run and how not to run an effective anti-corruption compliance program.

Below, we provide an analysis of five key lessons:

1. An anti-corruption compliance program on paper is meaningless without controls. Even though Walmart adopted an anti-corruption policy in 2005, it was not properly implemented. “In numerous instances, senior Walmart employees knew of failures of its anti-corruption-related internal controls involving foreign subsidiaries, and yet Walmart failed for years to implement sufficient controls comporting with U.S. criminal laws,” said Assistant Attorney General Brian Benczkowski.

Such failures allowed Walmart foreign subsidiaries in Mexico, India, Brazil, and China to hire certain third-party intermediaries (TPIs) “without establishing sufficient controls to prevent those TPIs from making improper payments to government officials in order to obtain store permits and licenses,” settlement documents state.

In the last seven years, however, Walmart has taken extensive steps to enhance its global anti-corruption compliance program, steps that the Justice Department and SEC acknowledged in the resolution agreements. “We’ve enhanced our policies, procedures, and systems and invested tremendous resources globally into ethics and compliance and now have a strong global anti-corruption compliance program,” said Walmart CEO Doug McMillon.

Some of those specific measures include hiring dedicated home office and market-level anti-corruption compliance leadership, including a global ethics and compliance officer, an international ethics and compliance officer, and a global anti-corruption officer; enhancing anti-corruption risk assessments across all international markets; and enhancing Walmart’s global anti-corruption training and awareness program.

“We’ve enhanced our policies, procedures, and systems and invested tremendous resources globally into ethics and compliance and now have a strong global anti-corruption compliance program.”

Doug McMillon, CEO, Walmart

2. Third-party intermediaries require due diligence. In 2009, Walmart issued an updated global anti-corruption policy that provided, among other things, that TPIs could not be retained without a due diligence review. “However, the 2008 policy was not sufficiently implemented, so certain of Walmart’s foreign subsidiaries did not follow all of the requirements,” settlement documents state. Walmart further failed to ensure compliance with this policy.

To mitigate TPI risks moving forward, Walmart said it has since implemented due diligence requirements, contractual requirements, and an auditing process. For example, Walmart worked with external experts to customize a system that screens and tracks TPIs, including companies and individuals.

Now, when the company contracts with TPIs, it requires them to adopt commitments to follow its anti-corruption policy and, in some instances, anti-corruption training is provided to help TPIs understand and apply these standards. Additionally, Walmart partnered with external experts to develop a methodology for proactively auditing a sample of TPIs, which includes a review of due diligence documents, contracts, payments, and expenses and can also include site visits and a review of the TPI’s financial records relating to Walmart transactions.

Starting in fiscal year 2016, Walmart selected a sample of companies for an audit based on several factors, including the risks associated with the region where the third party operates and the types of services it provides. “This process enables Walmart to see how third parties respond to the anti-corruption program and identify ways to improve training and controls,” Walmart stated. In fiscal year 2017, Walmart expanded this program to all international markets and, as of fiscal year 2019, has audited 230 TPIs.

3. Compliance controls must be centralized. In 2008, Walmart created an International Compliance Office and published a revised anti-corruption standard. As described in the settlement documents, “The concept for the new standard was ‘Freedom within a Framework.’ Instead of taking a centralized approach to ensuring that sufficient anti-corruption-related internal accounting controls were implemented throughout Walmart’s foreign subsidiaries, the new anti-corruption standard allowed individual markets to design and implement their own program as long as it met certain global standards.”

Without a centralized compliance program, however, weaknesses in internal controls related to anti-corruption were able to flourish. In Mexico, for example, a former attorney for Walmart’s local subsidiary reported to Walmart in 2005 that he had overseen a scheme for several years prior in which TPIs made improper payments to government officials to obtain permits and licenses for the subsidiary and that several executives at the subsidiary knew of and approved of the scheme.

In another example, Walmart’s operations in India were able to retain TPIs that made improper payments to government officials to obtain store operating permits and licenses in the country. These improper payments were then falsely recorded in Walmart’s joint venture’s books and records with vague descriptions like “miscellaneous,” “professional fees,” “incidental,” and “government fee.” And in Brazil, employees were able to hire agents without conducting proper due diligence and make improper payments to government officials.

As part of its remediation efforts, Walmart now conducts across each of the company’s markets “enhanced monthly and quarterly anti-corruption monitoring by dedicated company financial controls and continuous improvement teams, who monitor at the store-level, with results tracked in a centralized, real-time automated monitoring system,” according to settlement documents. Walmart also enhanced its annual anti-corruption risk assessment across all international markets.

4. Procedures and processes to obtain, monitor, and track licenses and permits should also be centralized. To reduce its corruption risk further, Walmart created and deployed a centralized licensing system, which it fully implemented in 2015. “This system reduces the risk of error or wrongdoing by organizing workflows and implementing safeguards, such as requirements for approvals and documentation for paying required fees,” Walmart said. “The system provides a repository for licensing information, creating transparency, and enabling the company to monitor compliance with both global policy and local procedures.”

5. Anti-corruption training is essential. In many instances, including in India and China, Walmart did not hold anti-corruption training. This is not the case anymore, now that Walmart has enhanced its global anti-corruption training and awareness program. In fiscal year 2019 alone, Walmart associate completions of computer-based modules exceeded 200,000; instructor-led training completions exceeded 10,000; and Walmart provided anti-corruption training to over 1,000 third-party companies and groups.

Importantly, neither the Department of Justice nor the SEC in this case brought anti-bribery charges against Walmart. Instead, they focused only on violations of the FCPA’s accounting principles and Walmart’s failure to implement anti-corruption-related internal controls.

While many in the compliance and legal community anticipated the settlement amount to be far higher than the resulting $282 million, its costs are still dwarfed by the more than $900 million Walmart spent over the past seven years on FCPA inquiries and investigations, its compliance program, and organizational enhancements. All told, failure to maintain a robust anti-corruption compliance program alone can amount to enormous costs for a company, serving as a cautionary tale for chief compliance officers everywhere.