Regulators Note Common Internal Control Failures at the ACI-FCPA Conference

Companies are understandably looking for more guidance from regulators (both SEC and DOJ) to avoid FCPA violations.

Tracy Price (SEC Branch chief of the Division of Enforcement) provided some useful insights on common internal controls failures as part of her presentation at the 22nd ACI FCPA conference. We commend regulators for sharing their views at these conferences, but would encourage them to make this guidance more widely available on their agency websites.

According to our notes, some of the common internal controls failures that Tracy observed and which are worth repeating are:

1) Failure to adequately control payments to third parties.
2) Creation of contracts based on success fees where it is not clear what services the agent is providing other than obtaining the contract by any means.
3) Authorization of payments by non finance staff- i.e. sales staff can set up accounts and accruals with no oversight from the finance department and there is no adequate segregation of duties.
4) Failure by finance staff to adequately review documentation especially when even a cursory review of documentation would reveal that it is fake.
5) Payments to third parties using offshore bank accounts.
6) Payment amounts that differ from what was actually authorized.
7) Failure to follow policies and procedures and lack of adequate training on policies and procedures.
8) Absence of clear authorization processes for accruals, bank accounts.
9) Absence of adequate authorizations for the travel of Government officials and lack of supporting documentation and explanations surrounding the reasons for the travel.
10) Failure to maintain adequate controls over books and records to ensure that entries are not vague.
11) Failure to train finance staff to understand that their duties include more than mere data entry.
12) Failure by internal audit to look for common red flags in their review processes.