Avoiding “Contextual Compliance” in the Year of COVID and Beyond

Despite 2020 being an unprecedented and challenging year for business, the government has not slowed down its record-breaking enforcement actions. In late October, the U.S. Department of Justice (DOJ) and Securities and Exchange Commission (SEC) announced a $3.3 billion settlement with banking giant Goldman Sachs for violations of the Foreign Corrupt Practices Act (FCPA) — shattering Airbus SE’s $2.09 billion record breaker from only February. Goldman became the first American company to hold the top spot in more than a decade. Pursuant to a deferred prosecution agreement and a subsidiary’s guilty plea, Goldman admitted to using a third-party intermediary to bribe high-ranking government officials in Malaysia and the Emirate of Abu Dhabi, ultimately resulting in $6.5 billion in underwriting business for the firm. Notably, that scheme was detected — and objected to — by Goldman’s compliance organization, to no avail. 

In remarks at an anti-bribery virtual forum following the announcement, Charles Cain, chief of the FCPA unit at the SEC, blamed Goldman’s failure on “contextual compliance,” which allowed lucrative deals to trump compliance. He said, “Contextual compliance works well for smaller deals, but then gives way under the weight of a bigger deal or of higher-up people in the organization pushing it.” Cain’s comments made the government’s expectations clear: “When compliance is under the most pressure from the organization is when it must work best.” 

As the Goldman resolution illustrates, pressure can come even when business is good, and the increased stress caused by COVID-19 poses unique challenges. As we previously discussed here, and as the Goldman settlement emphasizes, how a business (and its compliance organization) evolves and responds in every business environment matters. Namely: 

• Compliance cannot be cyclical, seasonal, or “contextual.” Companies should evaluate the effectiveness of its compliance program and internal controls when business is booming and when it’s not, or when a deal is a huge success and when it’s a bust. Neither the high of success from a seemingly smooth deal nor financial challenges stemming from a pandemic should compromise compliance planning, review, or core ideals.

• Compliance organizations must adapt and continually evaluate sources of risk. In today’s environment — with hallways empty and watercoolers unattended — informal methods of identifying issues may be less effective. So it is even more important to encourage reporting; harness technology and data to uncover potential issues (for instance, DOJ repeatedly faulted Goldman for its failure to monitor certain individuals’ email accounts, which would have revealed incriminating evidence and corroborated compliance’s fears); and thoroughly investigate concerns. Do not expect the government to empathize with now-familiar disruptions in businesses’ operating environments to excuse compliance failures.

• Compliance is not effective just because the compliance organization detects potential issues — “[j]ust because someone flags something does not make it a success.” Compliance personnel must be empowered to effectively investigate and halt questionable business practices, but they cannot do so alone. Cain commented that “[t]he business side needs to be watching the hen house as well.” Business partners must embrace compliance expectations and processes, especially as many companies consider cuts (including compliance cuts) in response to financial pressures.

As we prepare to ring in 2021, expect DOJ to build on its banner settlements with Airbus and Goldman Sachs and engage in robust enforcement in this persistently challenging business environment. The government’s expectations are clear and not decreasing. Now is the time to ensure that your compliance department is resourced, empowered, and prepared.