The Man From FCPA believes that compliance can best be seen as a process. It is a clear series of steps progressing along a continuum. Following these steps leads to more certainty in the process, documentation of the process, and results and then review up to and including a second set of eyes—all of which form the basis of a process validation program. The same is true around investigations, under the FCPA or any other statutory scheme.

With the advent of the Securities and Exchange Commission Whistleblower Program, courtesy of the Dodd-Frank Act, it became even more imperative that a company quickly and efficiently investigate all hotline reports. This means in addition to a robust recording system and speak-up culture, you need an investigation protocol in place so that the entire compliance function is on the same page and knows what to do.

The following suggested starting point is based upon Hallmark 8 in the Ten Hallmarks of an Effective Compliance Program as supplemented by information from the Justice Department in its Evaluation of Corporate Compliance Programs. Hallmark 8 itself provides scant direction stating only, “once an allegation is made, companies should have in place an efficient, reliable, and properly funded process for investigating the allegation and documenting the company’s response.”

This minimal instruction was supplemented in the Evaluation with two series of questions:

Effectiveness of the Reporting Mechanism – How has the company collected, analyzed, and used information from its reporting mechanisms? How has the company assessed the seriousness of the allegations it received? Has the compliance function had full access to reporting and investigative information? 

Properly Scoped Investigation by Qualified Personnel – How has the company ensured that the investigations have been properly scoped, and were independent, objective, appropriately conducted, and properly documented? 

The time to create an investigation protocol is when you are not under pressure from a potential Foreign Corrupt Practices Act violation, press report on the front page of the New York Times, or a whistleblower hotline call. You should have a protocol in place and execute on that protocol when so required.

Topics