Compliance lessons from Cardinal Health’s FCPA settlement

According to the facts laid out in the Feb. 28 administrative order, Cardinal entered the Chinese market by acquiring the Chinese subsidiaries of a pharmaceutical distribution company in November 2010 and rebranded the acquired entities as “Cardinal China.” Between 2010 and 2016, Cardinal China served as the exclusive product distributor in the Chinese market for a large European dermo-cosmetic company and administered marketing accounts on its behalf.

Additionally, as part of an administrative and HR service agreement with the dermo-cosmetic company, Cardinal Health retained approximately 2,400 employees on the company’s behalf, including sales and marketing employees who were responsible for promoting the sale of the dermo-cosmetic company’s products and interacted with employees of state-owned hospitals and retailers.

“Although the marketing employees were managed day-to-day by, and reported to, the dermo-cosmetic company, Cardinal China entered into employment contracts with the marketing employees, administered their payroll, and assumed other human resource and administrative functions for them,” the order stated. “Because Cardinal China received a distribution margin from the sales of the dermo-cosmetic company’s products, Cardinal China profited from the marketing employees’ successful marketing efforts, including through improper payments made from the marketing accounts.”

In the administrative order, the SEC describes several compliance failings by Cardinal and Cardinal China, described in more detail below.

Failure to train and oversee marketing employees: Even after determining that certain marketing accounts should be terminated because of “significant FCPA-related compliance risks,” Cardinal inaccurately assessed the risks of the arrangements with the dermo-cosmetic company as minimal, the order stated. As a result, employees didn’t receive FCPA and anti-bribery training. Nor were they overseen in their interactions with third parties in China, the SEC said.

Failure to implement controls over marketing accounts: Without the authorization of Cardinal’s management, Cardinal China, at the request of the marketing employees, regularly made improper payments from the marketing accounts to government-employed healthcare providers and employees of Chinese state-owned retailers to promote the sale of the dermo-cosmetic company’s products. “The improper payments took varied forms, including cash, luxury goods, gift cards, and travel,” the order stated.

The order continued: “Due to Cardinal’s insufficient internal accounting controls, marketing employees were able to easily disguise these payments by channeling funds through complicit third-party vendors and by characterizing transactions with healthcare providers as payments to printing companies for ‘production fees,’ and they were also reimbursed for high-value gifts based on falsified or incomplete documentation.”

Failure to follow up on red flags that were identified: Shortly after acquiring Cardinal China in November 2010, Cardinal determined that Cardinal China’s practice of administering marketing accounts for its suppliers created “excessive FCPA-compliance risks” because the accounts could be used by suppliers to facilitate surreptitious payments to government officials without Cardinal China’s knowledge. By July 2011, Cardinal directed Cardinal China to wind down all its pharmaceutical marketing accounts due to these risks, but “failed to assess whether Cardinal China followed its instruction.”

The SEC administrative order went on to describe how Cardinal and Cardinal China failed to enhance their compliance practices, even after an employee raised concerns about the legality of the marketing accounts and the marketing employees, and even after the Cardinal China was fined by the Shanghai Administration of Industry and Commerce in September 2014 for providing luxury dermo-cosmetic products to employees of a Chinese retailer equal to a percentage of the retailer’s sales of the dermo-cosmetic company’s products.

Failure to heed warnings from compliance: Warnings from Cardinal China’s vice president of compliance in an email to Cardinal China’s president regarding the “enormous compliance risk” the dermo-cosmetic company posed to Cardinal China also went ignored.

“Cardinal’s foreign subsidiary hired thousands of employees and maintained financial accounts on behalf of a supplier without implementing anti-bribery controls surrounding these high-risk business practices,” said Anita Bandy, an Associate Director in the SEC’s Division of Enforcement. “The FCPA is designed to prohibit such conduct, which undermined the integrity of Cardinal’s books and records and heightened the risk that improper payments would go undetected.”

Remedial measures

In 2016, Cardinal China compliance conducted an audit of the marketing account’s expenses, which identified evidence that payments from the marketing accounts did not comply with Cardinal China’s compliance policy requirements. Additionally, Cardinal executives in the United States received an internal report stating the marketing employees were using the marketing accounts to channel payments to government officials in China. These results were voluntarily disclosed to the SEC.

Cardinal China undertook significant remedial measures, the SEC said, including terminating the marketing accounts and its employment contracts with the marketing employees; adding anti-bribery representations and obligations to the relevant contracts; and strictly limiting the use of the remaining balance of the dermo-cosmetic company’s funds to low-risk expenses, such as salary payments, with robust controls and monitoring from Cardinal China’s legal and compliance personnel.

Without admitting or denying the SEC’s findings, Cardinal consented to the entry of an order requiring the company to cease and desist from committing violations of the books and records and internal accounting controls provisions of the FCPA and to pay $5.4 million in disgorgement, $916,887 in prejudgment interest, and a civil penalty of $2.5 million.