“Or you got it or you ain’t” — Mel Brooks on Curb Your Enthusiasm, Season 4, Episode 1

Everyone is scrambling to put together effective anti-corruption compliance programs.  The interesting compliance situations are those involving mid-size and small companies, especially those which are privately owned.  They are not subject to SEC regulation but nonetheless can face prosecution for bribery violations.

If a company is starting from scratch and needs to get something done as soon as possible, at least as a marker to build a more comprehensive program, there are three tasks that have to be completed.  Without these three in place, there is no defense to future allegations of corporate misconduct.

1.  A Commitment to Compliance from the Board and Senior Management — the tone at the top means everything.  A statement from the Board and Senior management, designating a complaince officer, and announcing the company’s intention to comply with anti-corruption laws by designing  and implementing a compliance program.

2.  Adoption and Dissemination of a Stand-Alone Anti-Corruption Compliance Policy — the Board should include in its announcement the adoption of a company anti-corruption complaince program which addresses each of the basic elements required by the Justice Department anad the SEC for compliance.  The first task after the announcement should be a risk assessment.  Once completed, the company can modify the compliance program to address the specific risks.

3.  Training and Communication — A policy means nothing if it is not communicated to the officers and employees.  It is amazing to watch employees who attend training for the first time.  They are shocked to learn that some of their customers are in fact considered “foreign officials” under the FCPA.  But scare tactics are not the right approach.  In fact, the trainers need to underscore that they are not trying to undermine their business development, they are trying to protect their employees while allowing them to succeed in the marketplace.