The worldwide outrage at corrupt practices in the business sector continues to drive efforts by global organizations to develop effective frameworks to prevent, detect and report bribery and corruption.
In fortifying their anti-bribery management systems, these organizations are helping their own cause in that in the event of a bribery accusation such systems can have a pivotal role in establishing an “adequate procedures” compliance defence.
“Adequate procedures” is a term made popular through the UK Bribery Act of 2010, which requires a company seeking to avoid liability for failing to prevent bribery to demonstrate sound and established policies and procedures to deter questionable or corrupt conduct.
A key challenge, though, is that “adequate procedures” takes on various forms and meanings, depending on which country or jurisdiction one resides in. Further, most enforcement agencies and government authorities offer little guidance on what exactly “adequate procedures” means to be considered a possible defence in legal proceedings.
There is a strong likelihood that ISO 37001 Anti-Bribery Management System will continue to set the pace for a globally recognized adequate-procedures standard for corporations embroiled in corruption litigation proceedings. It is the best insurance so far both public and private sector organizations can buy
Let us review two international legislative provisions that offer “adequate procedures” as a possible legal defense and the most recent National Anti-Corruption Plan of the Malaysian government and see how a newly adopted international standard can offer multi-national organizations specific guidelines on developing a globally acceptable anti-bribery management system that may support most “adequate procedures” defences.
UK Bribery Act of 2010
Under the UK Bribery Act, an “adequate procedures” defence would be considered during an investigation into a corporate failure to prevent bribery. The Act provides commercial organizations with a defence to liability when commercial organizations can demonstrate that they had in place proper procedures designed to prevent persons associated with them from taking bribes.
Consequently, corporations otherwise liable for failure to prevent bribery can escape criminal liability if they can prove that they had in place “adequate procedures” to prevent the relevant illegal conduct. This defence is unique in that the contention is that the corporations are acting in good faith and taking proper precautions throughout the organization in implementing adequate compliance procedures. It is significant in that there is no such defence under most other foreign anti-bribery laws.
FCPA (U.S. Dept. of Justice)
While corporate compliance procedures are not considered in the liability phase of the FCPA, they are taken into account during the sentencing phase by the US Department of Justice. The United States Sentencing Commission outlines through its Federal Sentencing Guideline Manual six factors – four aggravating and two mitigating – that a sentencing court must consider in determining the appropriate penalty for organizations convicted under the FCPA. The existence of an effective compliance programme is one of the two mitigating factors. An organization convicted of an FCPA violation can thus use the existence of an effective compliance programme to potentially reduce a penalty against it.
Malaysian National Anti-Corruption Plan 2019-2023
Section 17A (3) of the Malaysian Anti-Corruption Commission provides that if a commercial organization is found liable under corporate liability provisions, a person who is the director, controller, officer or partner of the organization, or a person who is concerned with the organization’s management affairs at the time of commission of an offence, is deemed to have committed that offense unless such a person can prove that the corrupt act was committed without his consent or connivance and that he exercised due diligence to prevent that commission of the offence as he ought to have exercised with regard to the nature of his function in that capacity and the circumstances.
Hence, there is a need for the company to put in place “adequate procedures.” The Malaysian Anti-Corruption Commission has now issued guidelines which constitute “adequate procedures.”
The National Anti-Corruption Plan seeks “To introduce Anti-Bribery Management System (ABMS)MS ISO 37001 certification in all Government agencies” within two years. The guidelines further calls for an Anti-Bribery Management System (ABMS) MSISO 37001 certification as a requirement for State-Owned Enterprises (SOEs), Company Limited by Guarantee (CLBG) and the private sector to bid for Government contracts”.
To be in compliance with these guidelines all public and private sector organizations shall need to implement the ISO 37001 certification process which would provide an assurance that the organization has succeeded in establishing, implementing, maintaining, reviewing and improving its Anti-Bribery Management System.
Demonstrating “Adequate Procedures” through ISO 37001 Certification
ISO 37001 Anti-Bribery Management System is an internationally accepted standard that specifies the procedures by which an organization should prevent bribery by detecting and reporting any incident.
The standard requires organizations to implement these procedures on a reasonable and proportionate basis according to the type and size of the organization, and the nature and extent of bribery risks faced. It applies to small, medium and large organizations in the public and private sector and can be implemented in any country. Though it will not provide absolute assurance that bribery will completely cease, the standard can help establish that the organization has in place reasonable, proportionate and adequate anti-bribery procedures.
Auditing takes a risk-based approach to examining an organization’s Anti-Bribery Management System). An audit team will increase the scale of the investigation if they determine that a specific process presents a higher risk.
Then there is a process-based approach where auditors examine the organization’s processes and the interaction between those processes. Finally, there is a sampling-based approach where certification incorporates an appropriate sampling plan to support the audit findings and results.
The audit is extremely thorough and results in an accredited certification. Because of the international acceptance and the thoroughness of the audit process, such certification can provide a valuable safeguard in demonstrating an “adequate procedures” compliance.
From an FCPA perspective, such certification may provide tangible evidence that a compliance programme was in place at the time of the alleged bribery. From a UK Bribery Act perspective, the certification could provide the company with tangible prima facie evidence of establishment and effectiveness of the organization’s compliance programme. Notably, the Malaysian Anti-Corruption Commission has declared ISO 37001 certification a requirement for companies operating in Malaysia.
There is a strong likelihood that ISO 37001 Anti-Bribery Management System will continue to set the pace for a globally recognized “adequate procedures” standard for corporations embroiled in corruption litigation proceedings. It is currently the best insurance both public and private sector organizations can buy.
The writer is the chief executive officer of the CRI Group