In its continuing quest to push the message of aggressive FCPA enforcement, the SEC resolved FCPA charges against Orthofix, a medical device company, for $6 million in penalties and disgorgement. In a related action, the SEC announced that Orthofix and four executives agreed to pay $8 million for accounting control errors. The Justice Department declined to prosecute Orthofix.

All of this sounds reasonable, except for one big fact – Orthofix is a recidivist. In 2012, Orthofix entered into a deferred prosecution agreement (DPA) with the Justice Department and agreed to pay $7 million for FCPA violations in Mexico.

The SEC and DOJ’s resolutions are questionable, especially when one considers the prior statements by the former AAG of the Criminal Division, Leslie Caldwell, emphasizing that DOJ would tear up DPA when companies repeated violations of he FCPA (and other criminal statutes). The resolution of this case, however, raises real questions about whether DOJ meant what it said.

I admit that I am not privy to all the ins and outs of this enforcement action. But on paper the SEC and DOJ appear to have laid down on this case, allowing Orthofix to escape with a $6 million penalty and an agreement to retain an independent consultant for a one-year term. DOJ declined to prosecuted under its existing DPA.

DOJ’s failure to enforce its DPA is the most troublesome aspect of this case. If DOJ’s DPAs are going to have any integrity, it is hard to justify its failure to act.

The facts surrounding Orthofix’s bribery scheme are fairly instructive on the use of different types of third parties. One overarching concern noted by the SEC in its settlement order was Orthofix’s decentralized management and accounting system. For compliance practitioners, the SEC’s comments underscore the difficulty companies face when administering financial controls in a decentralized system. As explained by the SEC, circumventing such controls is a higher risk in decentralized system for obvious reasons.

Orthofix employed two different distribution schemes, relying on sales representatives who in turn employed agent, and distributors who bought and resold Orthofix products.

In the case of the sales representatives who relied on commercial agents to sell Orthofix’s products, the bribery scheme involved the payment of large commissions, between 33 and 43 percent of the sales price, 20 to 25 percent of which was paid to the doctors who used Orthofix products.

A second scenario involved the invoicing of related services by a company employed by the commercial sales agents where the services were never provided. Orthofix Brazil supervisors approved the invoices knowing that the money was being passed to Brazil doctors.

Orthofix also employed distributors to pay bribes to Brazil doctors. To fund the bribery scheme, Orthofix gave certain distributors a large discount of roughly 70 percent. A second mechanism used by Orthofix was to pay companies related to the distributors for services that were never provided. The related companies prepared invoices for services that were never rendered and received the funds to pay the doctors.

Orthofix’s failure to remediate its accounting controls was a prime issue noted in its original FCPA enforcement action that centered on bribery in Mexico. Notwithstanding the weaknesses noted in the original enforcement action, Orthofix failed to revise and improve its management and accounting controls used in Brazil. Orthofix’s failure to remediate its global management and accounting controls was inexplicable. It was only after Orthofix discovered the Brazil bribery problems that it rapidly revised and improved its financial controls and compliance program.