Anti Bribery Basics: International Standards and...

©2016 TRACE International, Inc.Raising the Standard of Anti‐Bribery Compliance Worldwide

Anti‐Bribery Basics: International Standards

and RegulationsAlexandra WragePresident and Founder

Business Without Corruption: U.S. Anti‐Corruption Best Practices Tailored To The Needs Of The Romanian Business

Environment

7 March 2017

5/12/2017 2

2©2016 TRACE International, Inc.Raising the Standard of Anti‐Bribery Compliance Worldwide

Anti‐Bribery Laws and International Conventions

25/12/2017

©2016 TRACE International, Inc.Raising the Standard of Anti‐Bribery Compliance Worldwide 35/12/2017

Timeline of Anti‐Bribery Laws and International Conventions

1977 1995 1997 2000 2003 2004 2005 2007 2010 2013

Inter‐American (“OAS”) Convention Against Corruption (1996)

OECD Convention on Combating Bribery of Foreign Public Officials in International Business Transactions (1997)

Council of Europe: Criminal Law Convention on Corruption (1998)

African Union Convention on Preventing and Combating Corruption (2003) United Nations

Convention Against Corruption (“UNCAC”) enters into force (2005)

U.S. passes FCPA (1977)

UK Bribery Act passed (2010)

Brazil passes Clean Company Act (2013)

China revises its Criminal Law code to outlaw bribery of foreign officials (2011)


Anti‐Corruption Laws & Conventions

• U.S. Foreign Corrupt Practices Act (“FCPA”): applies to United States companies (and their agents and affiliates)

• U.K. Bribery Act: applies inside/outside United Kingdom

• UN Convention Against Corruption (“UNCAC”): 181 countries are parties to this convention that requires countries to implement anti‐corruption lawsRomania ratified UNCAC in 2004Every country required to criminalize bribery of public officials

• Enforcement of local laws varies widely

75/12/2017


Anti‐Corruption Laws & Conventions (cont’d)

• United Nations Convention against Transnational Organized Crime (adopted 2000)• Romania ratified in 2002

• Organisation for Economic Co‐operation and Development (“OECD”) Convention on Combating Bribery of Foreign Public Officials in International Business Transactions (adopted 1997)

• Council of Europe: Criminal Law Convention on Corruption (adopted 1999)• Romania ratified in 2002

• Council of Europe: Civil Law Convention on Corruption (adopted 1999)• Romania ratified in 2002

• EU Convention Against Corruption Involving Officials (adopted 1997)• Romania acceded to convention in 2008

75/12/2017


General overview of the FCPA

FCPA

ANTI‐BRIBERY PROVISION:No bribes to

government officialsoutside the U.S.

BOOKS & RECORDS PROVISION:Maintain accurate

documents.


Who’s Covered by the FCPA

• “Issuers”Publicly‐traded U.S. companies Foreign companies traded on U.S. exchanges

• “Domestic Concerns”Non‐public U.S. businesses U.S. citizens U.S. residents

• Foreign Companies “While in the territory of the United States” Employing use of an “instrumentality of interstate commerce”


UK Bribery Act (2010) Basics

Four Offenses Under UKBA1. Paying or receiving a bribe2. Bribing a foreign public official3. Failure to prevent bribery4. Senior directors/officers who consent or connive

to one of the other offenses


What is Covered by the UK Bribery Act

• Any part of the act (including but not limited to the improper performance) takes place in the UK; or

• All parts of the act take place outside the UK, but the offender is:A UK citizen, or overseas citizen,Ordinarily resident of the UKA UK incorporated entity A person associated with UK entity,

anyone who performs services on behalf of the companymay specifically include employees, agents or subsidiaries, but is not limited to them


Components of a Bribe

• Offer, promise or payment• Of anything of value• (U.S.: to a government official)• Directly or indirectly• To win business or gain an inappropriate advantage


Offer, promise, or payment

• Payments, promises to pay or authorizations to pay “anything of value” to any government official to obtain a business advantage.

• What does this mean?The bribe offer need not be accepted to violate the lawThe bribe need not be actually paid to violate the lawThe bribe does not have to be successful to violate the lawThe approver of the bribe is as responsible than the payer of

the bribeMere “offers” could violate the law Understand what you are approving


of anything of value

Anything:• Cash• Jewelry• Airline tickets• Medical Expenses• Hotel stays• Vacation • Housing expenses• Club membership• Employment / internships

• Loans• Sports events• Prize drawing• Charitable contributions• Hospitality• Gifts• Excess profit margin• Gambling “wins”


to a government official (U.S. FCPA)

• Payments, promises to pay or authorizations to pay “anything of value” to any government official to obtain a business advantage.

• Who is a government official? Executive branch employees Elected legislators Low level employees of a foreign government Employees of state‐owned commercial enterprises (SOEs)Officials and employees of public international organizationsMembers of royal families International Olympic Committee, Red Cross/Red CrescentPolitical parties, officials and candidatesDon’t forget: schools, universities, hospitals, police, military,

transportation, communications, post office, utilities, etc. and anyone acting on their behalf!


directly or indirectly

• A company is responsible for any improper payments made by third parties that it authorizes or “knows” will be paid for its benefit.

• Knowledge includes:Actual knowledgeConstructive knowledge

• Under the law, a person “knows” a bribe will occur if they are aware of circumstances that indicate a payment is a high probability.


to obtain or retain a business advantage.

• Being awarded a contract• Early access to bid details• Not obtaining an otherwise necessary permit• Even reducing taxes or fees, avoiding enforcement of a particular law or regulation,or preventing a competitor from entering a market.• Success is not required

©2016 TRACE International, Inc.Raising the Standard of Anti‐Bribery Compliance Worldwide 16

Accounting Provisions

• 2 Requirements Books and Records Internal Controls

• Issuers only: companies that are required to file reports with the SEC or that have securities registered with the SEC

• Strict liability: includes +50% owned subsidiaries and JVs

15/12/2017


Books and Records

• Make and keep accurate books, records, and accounts, that in reasonable detail, accurately and fairly reflect the issuer's transactions and disposition of assets

• All payments MUST be accurately recorded – even bribes!

• “Books and records” is interpreted broadly: third party contracts, meeting minutes, invoices, and bid proposals


Internal Controls

• Devise and maintain reasonable internal accounting controls aimed at preventing and detecting FCPA violations

• Remember: no requirement for link to improper payment – false record or internal controls deficiency is enough for violation

• Sarbanes‐Oxley also requires internal controls


Areas of Risk and Cost of Non‐Compliance

195/12/2017


• Customs• Gifts, Meals, and Entertainment• Facilitating Payments• Third Parties distributorssubcontractors vendors brokersjoint venture partners consultantscontractors

Areas of Risk


Non‐compliance risks

More and more jurisdictions fining companies that bribe – the risk of being penalised is higher than ever US govt is a robust enforcer against companies that bribe foreign officials and so is UK, China, Brazil, France, Germany…

• Reasons that companies avoid bribing

• Right thing to do• Fines are substantial• Reputational harm • Expensive legal fees• Remediation fees

• Derivative action risk • Appointment of a monitor • Disbarment and profit

disgorgement• Director accountability,

including jail time for offending directors


Larger Fines and Disgorgement in Settlements

• 2016: USD $2.41 billion • 2015: USD $138.2 million • 2014: USD $1.56 billion• 2013: USD $720.6 million

• Not limited to the U.S.: Brazil: USD $2.5 billion in 2016 (Odebrecht/Braskem, Embraer, Rolls‐Royce)

Netherlands: USD $397.5 million in 2016 (VimpelCom); $248 million in 2014 (SBM Offshore and KPMG)

China: USD $490 million in 2014 (GlaxoSmithKline)

$2,410,000,000

$138,200,000

$1,560,000,000

$720,600,000

2016201520142013


Top 10 Global Monetary Settlements for Bribery

• Odebrecht/Braskem (Brazil): $3.5 billion in 2016

• Siemens (Germany): $1.6 billion in 2008

• VimpelCom (Netherlands): $835 million in 2016

• Rolls‐Royce (U.K.): $800 million in 2016

• Alstom (France): $772 million in 2014

• KBR / Halliburton (USA): $579 million in 2009

• Teva Pharmaceuticals (Israel): $519 million in 2016

• GlaxoSmithKline (UK): $490 million in 2014

• Och‐Ziff (USA): $412 million in 2016

• Total S.A. (France): $398 million in 2013

5/12/2017


Enforcement Actions Initiated Against Individuals

0

5

10

15

20

25

30

35

40

2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 20160

84 4 2 3

6 7

1418

33

10

2

12 10 8 80

3

3 4

01

8 7

5

5

7

12

4

0 22

8

DOJ SEC(YTD)


Direct Costs to Company

• Paying the initial bribe – and additional, escalating demands thereafterOnce it pays an initial bribe, a company becomes an easy target for more requests creating an endless “bribery cycle”

• Covering up the bribe is often an even bigger wasteshell companies, false accounts, offshore slush funds, etc.


Compliance Lessons from Recent Cases

265/12/2017


VimpelCom

Lessons Learned:• Increased focus on non‐US companies• Larger fines and disgorgement in settlements• International authorities are cooperating more extensively


Key Energy

Lessons Learned:• Policies alone are not enough• Continuous monitoring required to ensure controls are being followed and effective


Cadbury/Mondelez

Lessons Learned:• No proof of improper payment needed for a violation of the FCPA accounting provisions

• Failure to conduct due diligence or conduct proper monitoring of a third party may lead to liability under the FCPA


Biomet

Lessons Learned:• Misconduct predating a DPA may be a new violation of the FCPA

• Misconduct that is the subject of and continues after a DPA may lead to further action by the DOJ


Case Study: SAP

Lessons Learned: • Legal business practices can be misused to funnel bribe payments and lead to violations if preventative controls are not in place

• A “rogue” employee can still expose a company to liability if internal controls are deficient

• US enforcement authorities are increasingly focusing on individual liability and will expect companies to identify individuals responsible for misconduct


Development of a Compliance Program and Culture


Environment

675/12/2017


Agenda

• Framework of Corporate Compliance

• Elements of a Robust Anti‐Corruption Compliance Program Top level commitmentRisk assessmentsDue diligence Training and internal communicationsMonitoring and reviewDocumentation

• Code of Ethics / Conduct • Confidential Reporting Policy and Procedures • Innovations to Efficiently Allocate and Use Resources • The Business Case for Compliance

5/12/2017


Framework of Corporate Compliance

Ethics and Compliance Program Elements


Elements of a Robust Compliance Program

• Top level commitment• Risk assessment• Due diligence• Internal communications and training• Monitoring and review• Documentation


1. Top Level Commitment

• Clear message from the top and effective communication to employeesA company must ensure that its directors and senior management provide strong, explicit, and visible commitment to its corporate compliance policy. ‐‐ Asst. Attorney Gen. Leslie Caldwell (2014)

• Should be reinforced and implemented by middle managers also


2. Risk Assessment Approach

Risk Based Approach• Don’t boil the ocean• Achieve anti‐bribery compliance through risk based approach• Convergence of guidance under FCPA and UK Bribery Act• Not for a organization’s absolute risk

What are the steps to a Risk Based Approach?• Identifying high risk areas• The problems of ignoring low‐risk areas• Verifying and collecting information• Red flags and deal breakers with third parties• Regular review – tailor to risk


Examples Of Risk Assessment Questions

1. Where is the company headquartered and are its corporate formalities in order?

2. What is the primary customer segment?

3. Which areas in the organizational chart are most prone to bribery?

4. Are there trends in the company’s industry?

5. Interactions with government customers?

6. Type and amount of compensation?

7. Countries of operation?

8. More detailed risk assessment based on information collected?

9. Relationship with company?


3. Risk Based Due Diligence

• Risk based approach to the initial review Reviewing type of third party, services being performed, country of operation and amount and type of payment to determine risk level Collecting reasonable information for each category of third party

• Risk based approach to monitoring Lower risk intermediaries every three yearsHigher risk annually or every two years with certifications in between reviewsConstant monitoring of some information – restricted parties lists


Results of Effective Due Diligence

• Customization: Tailored to company’s risk profile• Consistency: Similarly situated third parties must be

analyzed in a similar manner• Opportunity to project company image• Chance to influence whole supply chain• Collaborative vs covert


4. Internal Communications and Training

• Communicating the policy: Easy to locate, initially and when updatedAccessible language; avoid jargon or legaleseAppropriate translationsBe aware of priorities company is communicating:

• Training:Online vs in‐person trainingRule‐based vs ethics based Invest time to understand challengesProfessional, respectfulBuild trust with relevant examples


• Compliance program should not go stale• Monitor the business environment• Monitoring by using existing resources• Regular certification by key actors• Include and use audit rights• Schedule regular reviews of due diligence• Mock investigations to train those responsible• Use monitoring information as a review of anti‐bribery compliance regime

5. Monitoring And Review


• Why important?Means of defining, detecting and investigating wrongdoingMeans of review and improvementRequired under legislation e.g. books and records provisions of FCPA Means of protection when things go wrong

• Consider data protection and retention requirements locally, e.g. EU‐US Privacy Shield

6. Documentation


Code of Ethics/Conduct

• Code of Ethics/Conduct: a written code that commits the company to a culture of compliance, educates employees about the standards to which the company holds itself, and explicitly prohibits bribery and corruption. Defines company’s stand on ethics.Outlines and details internal controls, monitoring and evaluation, and disciplinary action.


Anti‐Corruption Policy

• Anti‐Corruption Policy: should confirm the Company’s position regarding the prohibition of corruption by the company, its employees and business practices.Clearly define activities prohibited by the company and address

specific areas that would come under an anti‐corruption policy, for example:

Giving or receiving of gifts, travel or hospitality. Use of third party intermediaries. Sponsorships and donations to charitable organizations. Acquisitions and divestments.


Anti‐Corruption Procedures

• Anti‐Corruption Procedures: written procedures to implement the company’s policies and effectively prevent and detect bribery and corruption.The procedures should be proportionate to the company’s risk of bribery and corruption, as well as the scale and complexity of the company’s operations

• Procedures should cover: Accounting and record keeping.

Use of third parties, including risk management, due diligence and monitoring.

Specific risks, including gifts, interactions with public officials, travel, hospitality, entertainment and expenses, political contributions, charitable donations and sponsorships, facilitating payments, and solicitation and extortion.


Confidential Reporting Policy and Procedures

• A secure, confidential and accessible method should be established for employees and third parties to report misconduct or allegations of bribery or corruption. The method may be, for example, in the form of a hotline, via emails or through in‐person reports to managers, human resources or the legal or compliance departments.Those reporting should be adequately protected from retaliation.


• Risk based approach allows effective resource allocation• Use existing business structures:Existing CEO emails for communicationMonitoring using existing business supervision eg activity reports and certifications

• Avoiding the ‘silo problem’ decreases unnecessary expense

• Tone from the top is almost free

• Three additional areas worth exploring:A) Using technology to support anti‐bribery complianceB) Portable due diligenceC) Down streaming

Innovations to Efficiently Allocate and Use Resources


A) Using Technology to Support Anti‐Bribery Compliance

• There are a number of reasons to use technology to support current compliance:Cost‐effectiveStreamline functionsImprove ability to meet legal requirementsGreater accuracy

• Examples:Online TrainingGifts & HospitalityMonitoringCase management


• Third parties complete due diligence process – to a high standard – one time per year at the entity’s expense.

• Monitors and certifies entities for transparent conduct.

• Achieves collective action goal of finding practical and standard‐setting solutions.

50

B) What is Portable Due Diligence?

5/12/2017


Portable Due Diligence Benefits

• Shifts the burden of screening third parties away from companies.

• Eliminates most of the expense and delay associated with the vetting process.

• Enables third parties to share their verified due diligence information with all of their business partners.

• Offers ongoing monitoring of third party relationships with daily screening of names against international sanctions and enforcement lists.

• Provides certified intermediaries with a valuable business credentialand companies with the confidence they are looking for in selecting business partners.

• Simplifies third party recertification process for companies.

5/12/2017


• What is down streaming?The process by which the burden is shifted to other parties in a business relationship, when adequately monitored by the company, to support an anti‐bribery regime.

• Examples include:Portable due diligence and recertification at regular intervals;Adopting a code of conduct for third parties;Ongoing training of third party employees;Contractual requirements on the use of 2nd and 3rd tier suppliers and their anti‐bribery compliance, e.g. prohibition on their use.

C) Down Streaming


Business Case for Compliance


Business Case for Compliance

• Bribery is bad for businessBribery is expensive Prevention is more cost‐effective than remediationInvestigations disrupt businessReputation matters

• Compliance is good for businessDetect & deter inappropriate paymentsImprove overall bookkeepingCreate culture of good governanceEnhance company’s reputationReduce liability if something goes wrong


Risk Assessment of Company’s Exposure to Bribery and Corruption


Environment

915/12/2017


Agenda

Developing a Risk Assessment Approach Proportionate to Your Company’s Size, Structure and Risk Profile Risk Factors (i.e. Company Size, Structure, Industry, Geography, etc.)Verifying and Collecting Information Examples of Risk Assessment Questions Documenting and Standardizing the Risk Assessment Process

5/12/2017


Risk Assessments

How often should risk assessments/compliance audits be conducted?Who should be involved?What areas should be examined? Targeted audits vs. global auditsReporting/metricsOther forms of program assessment/evaluation

Surveys Focus Groups


Developing a Proportionate Risk Assessment Approach

• Risk assessments assist management with determining the risk of bribery and corruption across the company. Should be proportionate to the company’s size and structure, as well as the scale and complexity of the company’s operations. The process and structure of the risk assessment should change as the company’s operations and risks change.

Should be Targeted and Tiered in Approach Focus assessment on those departments that could have the greatest risk to corruption exposure E.g., Business Development, Sales and Marketing, Finance & Accounting, Customer Service/Field Support, Human Resources


Risk Assessment Life Cycle


Risk Factors

• Company Size & Structure• Industry• Geography• Interaction with Foreign Government Officials• Interaction with Business Partners• Interaction with Suppliers and Vendors• Interaction with Third Party Intermediaries


Example: TRACE Matrix ‐Assessing Geographical Risks

• First‐global business bribery risk index for the compliance community

• Helps companies assess the propensity for public‐sector bribery and its associated business risks and so provides actionable intelligence to inform a company’s compliance procedures

• Factors in:Business interactions with governmentAnti‐bribery laws and their enforcementGovernment and civil transparencyCapacity for civil society oversight.

5/12/2017 76


Risk Factors cont’d

• Organizational risks:Use of third parties. Internal controls.Business development and expansion. Existing compliance policies, procedures and practices and potential gaps.

• Transactional risks: Importance of license and permits in the company’s operations.Degree of government oversight and inspection.Public procurement or contract with a government.Consider: the value of the transaction, the number of third parties

involved.


Verifying and Collecting Information

• Conduct a periodic risk assessment of the company’s anti‐corruption program and processesMeasure performance of compliance against documented policies and proceduresReview quality of documentation regarding the recording of business costs and operating expensesEvaluate level of awareness of anti‐corruption compliance with your employees


Examples Of Risk Assessment Questions

1. Where is the company headquartered and are its corporate formalities in order?

2. What is the primary customer segment?

3. Which areas in the organizational chart are most prone to bribery?

4. Are there trends in the company’s industry?

5. Interactions with government customers?

6. Type and amount of compensation?

7. Countries of operation?

8. More detailed risk assessment based on information collected?

9. Relationship with company?


Documenting and Standardizing the Risk Assessment Process

• Develop standard risk assessment tools that all parts of the company can useStandardize the use of assessment documents and formsProvide clear and concise instructions as to how to conduct a risk assessment, how to use the assessment tools and how to complete the assessment formsStore copies of completed risk assessments at your corporate headquarters for future audit or investigative purposesInclude in your compliance policy a requirement that your companies complete a risk assessment periodically, have it reviewed and approved by the business unit’s management, and submitted to your corporate headquarters for evaluation and recording.


Use of Third Parties and Due Diligence Process


Environment

1295/12/2017


Agenda

• Risks Associated with Third Parties • Where to Begin? Third Party Risk Sorting • Third Party Red Flags and Deal Breakers• Scope of a Robust Third Party Review • Managing Third Party Relationships

5/12/2017


What do you view as your company’s most significant anti‐bribery compliance challenge?

5.4%8.1%

58.1%

18.9%

9.5%

Understanding government expectations when evaluating adequacy of compliance programs

Gifts, hospitality and entertainment

Third party due diligence

Supply and marketing chain compliance

Dealing with state‐owned enterprises

58.1%

5/12/2017


Risks Associated with Third Parties

5/12/2017

Corruption and bribery

Money‐laundering

International sanctions

Forced and trafficked

labor

International crime

Conflict mineral usage

Substantive Risks Practical Risks

Increasing number of international business partners

Expanding risks: companies held accountable for a growing number of compliance issues

Organizations are struggling to remain within “best practices”

Third parties that want to embrace compliance are often confused about conflicting messages

Cumulative effect: expense & waste


Importance of Third Party Due Diligence

• Business inherently rely upon third parties to achieve a wide range of business objectives

• DOJ and SEC considers the level and thoroughness of Third Party Due Diligence when they decide whether to prosecute under the FCPA

5/12/2017

Third parties can include:• Suppliers• Freight forwarders • Agents, Traders • Consultants• Resellers• Distributors• Channel Partners• System Integrators • Subcontractors• Customs Brokers • Legal/Accounting Firms • PR Companies• Travel Agents• JV Partners, etc.


Third Party Risk Sorting

Where to Begin? Budget analysis Internal resources Company policies Technology solutions

What are the steps to a Risk Based Approach?Identifying high risk third partiesRisks of ignoring low‐risk third partiesVerifying and collecting informationRed flags and deal breakersRegular review – tailor to risk

5/12/2017


Determining the Proper Level of Due Diligence

• Risk based approach to the initial review Reviewing type of third party, services being performed, country of operation and amount/type of payment to determine risk level Similarly situated third parties must be analyzed in a similar manner

• Risk based approach to monitoring Higher risk intermediaries renewed annually Lower risk intermediaries less frequently Constant monitoring of some information – restricted parties lists


Third Party Risk Assessment

• What type of intermediary (IM) is this?

• In what countr(y)(ies) will the IM be providing services?

• What is the IM’s scale of operation?

• Is a government entity or official involved with the IM (e.g., through ownership, employment or a consulting relationship)?

• How/where will the IM be compensated?

• Will the IM be operating to any extent on the company’s behalf or as a representative of the company in connection with a government entity, an entity that is owned or controlled by a government or a government official?


Risk‐based Due Diligence

Companies should choose the appropriate level of due diligence based on the information reasonably available to them. Risks of ignoring low‐risk third parties


Due Diligence

Due diligence should be applied consistently and be responsive to changes in structure, needs, laws and regulations. Tailored to the company’s risk profile. Third parties should be analyzed similarly to other third parties that are similarly situated.

Who should be performing due diligence? Internal: Compliance team or business team? External: Law firm, due diligence provider?

Whether to involve the third party in the due diligence process

Document your due diligence process


Keys to a Successful Review

Third party should know that:1. We are not questioning your integrity2. We know this is a burden on you3. Resisting slows things down and may

make it seem like you have something to hide

4. There is a business advantage to handling compliance well


Third Party Red Flags

Family members who are government officials Payment outside of territory or through a third party Refusal to sign on to company’s code of conduct or undergo due diligence Bankruptcy or other financial difficulty Request for an unusually large commission The intermediary is recommended by a government official A history of corruption in the country of the commercial transaction.


More Third Party Red Flags

Reference to political or charitable contributions as a way of influencing official action Personal or business relationship with a foreign government official

Lack of credentials or experience you would expect for the services being offered Requests for reimbursement for poorly documented or last minute expenses Credible rumors or media reports of corrupt behavior


Scope of a Robust Review

• Detailed company information, including information on subsidiaries and affiliated entities Business registrations, as applicable Corporate literature or a company description One financial reference or audited financial statement

• Beneficial ownership (except for shareholders owning less than 5% of publicly‐traded companies)

• Identification of directors and key employees Curriculum vitae for owners, directors and

key employees

• Additional ownerships, directorships and employment of all owners, directors and key employees

• Current and previous government employment of owners, directors and key employees


Scope of a Robust Review (continued)

Contact information for business references

Media search dating back seven years in a comprehensive international database

Local language media searches

Litigation searches

Denied party screening

Internet based searches

Intermediary code of conduct

Anti‐bribery training in local language


Managing Third Party Relationships

• Exercising audit rights: routine vs. triggered third party audits

• Third party training• Securing certifications• Re‐screening: how often?What level of monitoring is viewed by regulators as an indication of a robust program?

• Monitoring payments to third parties• Performance monitoring• Termination rights


Thank you

Alexandra [email protected]

825/12/2017

Anti Bribery Basics: International Standards and...

Documents

Transcript of Anti Bribery Basics: International Standards and...