The SEC continues to exercise its powerful enforcement tool – internal controls violations – in FCPA enforcement actions against public companies.  Kinross Gold Corporation is the latest company to enter into an FCPA settlement.

Kinross agreed to pay $950,000 for inadequate internal controls and books and records violations centered on the activities of two mining companies Kinross acquired.  The SEC cited no evidence of any bribes paid by Kinross to a foreign official.  The agreed on factual statement centered on Kinross’ failure to clean up the activities and records of two companies Kinross acquired.

In 2010, Kinross acquired two mining companies – one in Mauritania and another in Ghana.  As part of its due diligence process, Kinross learned that the two mining companies, which were commonly owned by Red Back, did not have any anti-corruption internal financial and compliance controls.  In particular, Kinross had inadequate internal controls governing vendors that were government-owned or controlled by family members of government officials.  Lower level employees were permitted to engage vendors and pay them for goods and services using cash from petty cash funds.

In April 2011, an internal audit report identified several deficiencies in Kinross ERP system and its inability to identify suspect payments, excessive rebates and discounts, unjustified advance payments and unsupported business expenses.  Notwithstanding the internal audit report, no changes were implemented.  One year later, internal audit issued a new report that largely repeated the same deficiencies noted in the original 2011 report.

The specific deficiencies included lack of formal delegations of authority to approve disbursements; absence of formal contracting and tender procedures; and lacked a formal ERP system and instead relied on a manual process.  In sampling the contracts at one of the mines, three-quarters of the same did not have written contracts.  Numerous transactions sampled did not include a purchase order or invoice.  Disbursements at both mines failed to include proper documentation of signatories and whether appropriate approval was obtained.

In response to the second internal audit report, management allegedly committed to implementing the recommended remedial steps. In the end, however, many of the changes were never implemented.

The SEC cited a number of specific transactions that were conducted without reasonable assurance that the payments were for proper purposes and approved by management.  For example, Kinross paid a Ghanaian government official for regular travel to a mine to complete needed paperwork.  During 2012 to 2014, Kinross paid the government official for weeks that the foreign official did not travel to the mine.

In another example, Kinross paid a third-party consultant $12,000 for undocumented services in relation to resolving an environmental compliance issue.  Within one month of the undocumented payment, the government official approved the resolution of the environmental issue.

Finally, Kinross paid a third-party consultant for visa and work permit assistance.  Kinross paid $1000 per visa or work permit from petty cash.  The typical processing time for visas and work permits was reduced from ten weeks to three weeks.

In 2013, Kinross implemented enhancements to its internal controls.  However, one year later, on two separate occasion, Kinross failed to maintain its internal controls.

In 2014, Kinross intended to award a three-year $50 million contract for international shipping.  Kinross tentatively selected the lowest-cost vendor consistent with its specific policies, but ultimately awarded the contract to a higher-cost, less experienced, vendor because it was preferred by a government official.  One year after selecting the vendor, Kinross has to terminate the contract for poor performance, and awarded the contract to a qualified vendor.

In a second instance, Kinross hired a well-connected individual to assist in its government relations activities, and in particular, to manage Kinross’ relationship with a high-level official in the Mauritania government.  Kinross avoided the required due diligence for the government relations official by defining the contract as a supply contract.  As a result, Kinross conducted a minimal due diligence review prior to engaging the former official.