KPMG urges firms to conduct anti-bribery specific risk assessments across business units and in foreign jurisdictions where they operate
There is lots of room for improvement in companies’ anti-bribery and corruption (ABC) compliance programs, according to the results of a recent survey by KPMG International.
Some of the most striking findings concern companies’ use of third party service providers, such as local agents with experience dealing with government officials in foreign markets. Many companies perform upfront due diligence when bringing third parties aboard, but most don’t go far enough. Fewer than three quarters of the 217 survey respondents from US-listed companies say they have a formal process for identifying high-risk third parties. Fewer than half say their companies have right-to-audit clauses in their third party contracts, and slightly more than half of those that do say they are actually exercising these rights. The findings are available in a report, Anti-Bribery and corruption: rising to the challenge in the age of globalization.
Perhaps the bigger issue is that companies aren’t minding their own stores as well as they could be. Only 68 percent of companies polled incorporate continuous monitoring and internal audit protocols in their ABC compliance programs. Even when it comes to mergers and acquisitions, where acquirers may not be fully informed about how target companies conduct their business with foreign governments, slightly more than half of companies polled say they include ABC considerations in their pre-acquisition due diligence.
‘Companies under-utilize data analytics to support their ABC compliance programs and monitoring activities and many organizations lack the necessary resources to effectively manage ABC-related risk in the face of expanding global regulation,’ Pamela Parizek, a partner in forensic advisory services at KPMG, said in an email.
Also noteworthy is the increase in the number of total respondents who are forthcoming about how tough it is to stay on top of ABC issues. ‘This may be explained, in part, by the complexity and extent of international ABC regulation,’ says Parizek. ‘The survey results suggest respondents find these developments more challenging than in the past.’
Parizek advises companies to perform a risk assessment focused on anti-bribery and corruption across their business units and in high-risk jurisdictions where they operate. ‘An ABC-specific assessment is distinct from an enterprise-wide risk assessment, and is essential to meet regulatory expectations to adopt a risk-based approach to designing an organization’s compliance program,’ she says. An ABC-specific risk assessment may be used to guide priorities and resources in the compliance effort. The survey finds that executives believe this is one of the top challenges for their companies.
Parizek also urges companies to embed ABC compliance considerations within the M&A due diligence process – something that’s ‘particularly important as organizations continue to grow through acquisition.’
A robust program for third-party risk management is an essential pillar of an effective compliance program, given that third-party risk is the most significant risk that companies face, she says.
Corporate boards have their work cut out for them as well. Although overall, board awareness of ABC risk has markedly improved in recent years, boards must realize the depth of their oversight role, says Parizek. ‘They need to understand their management’s response to ABC issues, including the results of the organization’s ABC risk assessment and the resulting compliance priorities.’
It’s also up to the board to emphasize the importance of ABC compliance so that management receives appropriate resources and support to implement the compliance program. Boards of companies with global operations have an even higher bar to meet. Historically, ABC enforcement was driven by the US, but this is no longer true, as governments around the world are tightening their ABC regulations or introducing new laws.
‘It is increasingly important to think about the organization’s geographic footprint and what this means in terms of its ABC risk profile,’ says Parizek.
