Layne Christensen Co., an water services business out of Texas, became the newest member of the Foreign Corrupt Practices Act hall of shame yesterday; the Securities and Exchange Commission fined the company $5.1 million for various bribery infractions in Africa in the 2000s.

Let’s go straight to the money quote from Kara Brockmeyer, FCPA enforcement chief at the SEC:

“Layne’s lack of internal controls allowed improper payments to government officials in multiple countries to continue unabated for five years. However, Layne self-reported its violations, cooperated fully with our investigation, and revamped its FCPA compliance program. Those measures were credited in determining the appropriate remedy.”

Credit for self-reporting, cooperation with the investigation, thorough reforms to its compliance program—all wonderful news. I applaud Layne Christensen for its strong compliance leadership once the corruption was uncovered. The SEC rightly gave the company credit for working hard. All that effort, however, is the easier part of effective compliance. Companies want to clean up the messes they find in their financial operations. Disclosing misconduct and investigating how it happened are fairly straightforward processes, even if they’re as unpleasant as a root canal and far more expensive.

The root of Layne Christensen’s problem—weak internal control over financial reporting—is still the far harder challenge for companies to overcome.

In Layne Christensen’s case, the improper payments happened from 2005 to 2010. According to the SEC’s litigation release, various Layne Christensen subsidiaries paid the bribes across central Africa, mostly to reduce tax payments and also to expedite the hiring of workers or to get various other projects approved. The man behind the bribes was Eric Despain, head of Layne Christensen’s minerals exploration division until the company fired him in 2011.

An aside: the first element of a strong compliance program is a strong tone at the top. Despain answered directly to Andrew Schmitt, then-CEO of Layne Christensen, the entire time bribes were paid. If you answer directly to the CEO, and still offer bribes, one has to wonder whether the CEO’s tone is being heard—or whether the tone is wrong. Little wonder that when you search for the word “values” in Layne Christensen’s annual reports of at the time, it always relates to financial assets and never to, you know, good behavior.

Anyway, back to the internal controls that didn’t work. The bribes were masked as a series of payments, often made through third parties working on the company’s behalf, to cover allegedly routine costs of doing business in Africa. In 2008 in Guinea, for example, the mining division CFO asked for cash from Layne Christensen’s home office to pay a tax bill, even though the cash requested exceeded the taxes due. That’s a failure of matching invoice to the check being cut.

Or in Mali in 2005, another subsidiary paid $93,000 to Malian tax authorities through a local agent. That money was actually a bribe, hidden by listing the payment as “the take up cost” (whatever that is) for a freight invoice, when the local agents never provided any freight services to Layne Christensen. That’s a failure to confirm that promised goods or services were delivered for payments made.

We could find more examples all through the SEC’s 14-page litigation release and hop-scotch all over central Africa in the process. None of these specifics should surprise any compliance professional, especially those who work in emerging markets, which these days is pretty much everyone.

All of these failures could have been caught with sufficiently strong accounting controls. The problem is that strong accounting control is all about transparency, about seeing exactly where each bill comes from, and why, and from whom, and then seeing exactly how much money goes to that counter-party. You can’t achieve that in the real world without enormous effort and expense.

Walmart, for example, had similar FCPA problems with its improper payments in Mexico—payments for permitting approvals rather than tax payments, yes, but still payments made with their true purpose shielded from the accounting and auditing function. As of last spring, Walmart had spent more than $100 million on improvements to business software alone to clean up its problems.

If you want to take away any good news from the Layne Christensen case, it’s this: the company scored roughly $3.9 million in benefits thanks to its bribes, and the company paid roughly $3.9 million in disgorged profits, plus $858,000 in interest. Thanks to its aggressive efforts to improve compliance after the bribes and to cooperate with the SEC, the actual penalty it paid was a mere $375,000. The Justice Department filed no charges at all, and closed its case against the company months ago.

The bad news is effective systems of internal control are still the lynchpin to reducing FCPA liability, and they are still the hardest part to achieve.