Preparing for an FCPA 'Industry Sweep'

In recent years, the U.S. Department of Justice and the Securities and Exchange Commission have embraced the use of so-called “industry sweeps” as an enforcement tool against suspected violations of the Foreign Corrupt Practices Act (FCPA). Industry sweeps are wide-ranging FCPA investigations into multiple companies within a particular industry, based on the government’s belief that corrupt conduct is or may be manifest across the industry.

What is widely regarded as the first such sweep became publicized in November 2010, when Panalpina World Transport (Holding) Ltd. and its U.S. subsidiaries settled with the DOJ and SEC for alleged bribery of foreign officials on behalf of customers in the oil and gas industry. The resulting industry sweep subjected several Panalpina customers, as well as some of its competitors in the freight-forwarding industry, to investigations yielding penalties and civil disgorgement of over $200 million. Since then, regulators have launched investigations into the medical device, pharmaceutical and financial services industries, among others.

This trend of industry sweeps shows no signs of abating. Recent enforcement activities that have the earmarks of sweeps include probes of the retail industry and of the Hollywood movie industry.

Industry sweeps are attractive to government authorities because they offer a uniquely efficient way of ferreting out FCPA offenses. Typically, the FCPA enforcement authorities initiate sweeps by sending out letters of inquiry from the SEC—sometimes called “Hello There” letters—encouraging the recipient companies to provide information about particular business practices and/or geographic areas of their operations. These simple and oft vaguely worded letters, backed as they are by the implicit threat of an impending DOJ/SEC investigation, can yield disclosures from companies that ultimately result in the payment of many millions of dollars in penalties, as well as new compliance commitments and other remedial measures. Unfortunately, industry sweeps also risk ensnaring compliant companies, or those with relatively minor and easily remedied FCPA issues, in expensive and time-consuming investigations.

Accordingly, even companies whose business models are not considered at high risk of corruption should take reasonable precautionary steps to mitigate the disruptive impact of a possible industry sweep. Those steps include: (1) establishing a corporate FCPA “early alert system”; (2) selecting a possible response team and arming them with the information necessary to deploy quickly; and (3) as always, maintaining good corporate hygiene through risk assessments and an effective compliance program. Through these measures, companies can better position themselves to meet the challenge of this potent new enforcement tool, which is contributing to what DOJ FCPA Unit Chief Charles Duross recently described as a “tremendous pipeline of [FCPA] cases.”

Ensuring Your Company is Well-Positioned for the Possibility of an Industry Sweep

Establishing a Corporate “Early Alert System”

Unanticipated, a blitz of letters of inquiry or other simultaneous government contacts across an industry can wreak psychological havoc on corporations, triggering premature disclosures or turning companies within an industry against one another in an echo chamber of finger pointing. Although not all industry sweeps can be predicted, companies can mitigate their risks by implementing an FCPA “early alert system.”

Logistically, an early alert system involves a company’s designation of internal and external personnel responsible for scanning the horizon and keeping the company informed of corruption investigations or risky practices that might attract attention from either U.S. or non-U.S. authorities. Of course, many companies have already developed a warning system within the United States; fewer, though, have afforded adequate attention to creating those avenues of communication abroad. Coordination between foreign and U.S. antibribery authorities is on the rise, and a warning system without a robust foreign presence is soon to be obsolete.

As part of the effort to construct an early alert system, companies should ensure that senior leaders resident in countries with high degrees of real or perceived corruption (or whose business functions are otherwise susceptible to corrupt payments) are trained to be on alert for media reports or other indicators of corruption. Companies should also inform their law firms, crisis management firms, and other third-party advisers that they are interested in hearing about FCPA- and other corruption-related developments in their industry. Finally, companies should take advantage of the opportunity to share information through trade organizations whose members might be confronting identical compliance risks or government inquiries.

Deceptively simple, these measures may result in a company receiving advance notice of an industry sweep, affording it the chance to accelerate preparations and to implement remedial adjustments.

Selecting and Preparing a Response Team

A second precaution in preparing for the possibility of an industry sweep is to identify local law firms and crisis management firms in high-risk geographies that are competent in antibribery matters. An industry sweep focused on business practices in a particular country can elicit a competition among companies for the best local advisers and resources, but not all jurisdictions have more than a handful (or even fewer) professionals with meaningful and practical experience concerning corruption issues and other aspects of government investigations. While having a firm on retainer is ideal, preemptively hiring and paying advisers is not necessary. A company benefits merely from considering, in advance, which local professionals might best serve its interests. That way, valuable time that could be directed towards developing a company’s response to a government inquiry is not wasted on evaluating firms and soliciting proposals.

Time is of the essence during an industry sweep: for instance, a company that ultimately elects to make a disclosure may be better situated to argue for cooperation credit from the government if the disclosure is made early in the course of the sweep.

Companies also should ensure that, with respect to high-risk geographies, their anticipated response team includes personnel or third party advisers who are well versed in the local attorney-client privilege rules and data privacy rules. Again, these issues can create tremendous headaches and delay at the outset of an investigation. Moreover, those missed opportunities at the outset can easily result in privilege litigation and other problems that persist well into the investigation. Simple workarounds to these legal obstacles are often available if planned in advance. For example, retaining confidential materials in a particular location can help protect the attorney-client privilege in certain jurisdictions, and executing intercompany agreements or providing certain notice to employees can ameliorate data privacy issues.

Maintaining an Effective Compliance Program

Third, and unsurprisingly, having an effective FCPA compliance program in place—and working closely with the “early alert system” described above—before an FCPA probe begins is crucial to minimizing a company’s exposure to an industry sweep. A fulsome discussion of the components of an effective compliance program exceeds the scope of this article; for our purposes here, it suffices to point out that a compliance program that includes risk assessments of internal vulnerabilities may better position a company to determine whether the issues raised in an SEC “Hello There” letter are applicable to the company’s business.

For example, if the authorities have inquired about a business practice related to which the company has strong compliance procedures, positive findings from a recent and thorough internal audit, few or no complaints from a hotline system that is clearly effective in eliciting concerns, etc., then the investigation should not be as daunting. Moreover, while an initial response to the authorities describing such a strong compliance environment is unlikely to result in a swift exit from the investigation, it may make a well-deserved, positive first impression on the authorities.

Finally, an effective compliance program will enable a company to hone in quickly on areas of potential concern, including issues that the authorities have not already raised but that the company may nonetheless elect to bring to their attention (e.g., in a situation where the company anticipates that the government will eventually ask about or otherwise discover the problem). This early diagnosis of peripheral issues is important because FCPA enforcement authorities have repeatedly made public statements that companies will receive a benefit for discovering problems before the authorities do, and working to address those problems.

Conclusion