When reviewing a major enforcement case, I always ask two basic questions:

• What was the role of Board and senior management in the failure, and how did they fail to exercise proper oversight and ensure compliance?

• What was the company’s culture and what steps did the Board and senior management take to implement and monitor an effective ethical culture?

After reading the Airbus’ factual proffer, it is clear that Airbus’ culture was clear – sell and secure money at almost any expense.  Whether it was paying bribes or relying on extensive third party representatives to circumvent existing controls, Airbus executives and employees had no problem advancing sales without any attention to compliance.  No one at Airbus emphasized and pushed the importance of ethics and compliance.

The Board and senior management have to take responsibility for this fundamental failure.  It is their responsibility to define, implement, monitor and ensure an ethical culture.  It appears that there were no significant efforts to take basic steps to reinforce compliance.  At no point was there a meaningful effort to support the compliance function.

In this environment and with a singular focus on sales, Airbus inevitably was on a path to legal and compliance failures.  Eventually, a UK whistleblower reported Airbus’ violations of law, leading to this global enforcement action.

But there are others who have to be held accountable.  Airbus’ compliance function, especially related to ITAR compliance, failed to act and mislead the new General Counsel who raised questions concerning compliance with basic ITAR reporting requirements.  Instead of welcoming a review, Airbus’ senior export control management knowingly mislead the General Counsel as to Airbus’ existing compliance program.

Airbus’ compliance function failed in a basic way – they failed to be honest and they failed to speak up.  DOJ’s factual proffer suggests that compliance failed because it was siloed within the organization.  Notwithstanding this characterization, the factual proffer recounts numerous instances where compliance knew, should have known or was indifferent.  

In the face of overwhelming problems and indications that business was circumventing compliance controls, the compliance function and legal failed to speak up, demand accountability and start to investigate and audit overall compliance.  Had they done so, Airbus’ problems may not have spiraled out of control.

Even after the DDTC contacted Airbus to inquire and ensure Airbus’ compliance with ITAR reporting requirements, there is no indication that compliance or legal took this inquiry and leveraged it to senior management to demand that action needs to be taken.

Furthermore, given Airbus’ obvious high-risk profile, selling its products and services to foreign governments and military organizations, Airbus compliance and legal personnel ignored the overwhelming risk created by use of approximately a thousand third parties. 

Considering all of these factors, compliance and legal fell silent in a culture dedicated to sell at any and all costs.  There were numerous signs and crossroads that Airbus faced and failed to act or address significant problems.  Everyone bears some responsibility – from the board, to senior management, the business incentives and sales staff, and ultimately legal and compliance.