COMPLIANCE AND INVESTIGATIONS IN AN AGE OF TURMOIL AND DISRUPTION: WHAT HAPPENS WHEN THIS BECOMES THE NEW NORMAL? – PERUMAY 2020 PREPARED BY PHILIP UROFSKY, KATHERINE STOLLER, AND CARLOS PATRÓN

2

PRESENTING TODAY

PHILIP UROFSKY

SHEARMAN & STERLING Partner, Washington, D.C.

KATHERINE STOLLER

SHEARMAN & STERLINGCounsel, New York

CARLOS PATRÓN

PAYET, REY, CAUVI, PÉREZ ABOGADOSPartner, Peru

3

• OPERATING A COMPLIANCE PROGRAM REMOTELY

• RESPONDING TO WHISTLEBLOWERS – DOES WORKING REMOTELY CHANGE ANYTHING?

• HOW DO YOU DO INVESTIGATIONS REMOTELY? SHOULD YOU?

• ARE THE GOVERNMENT ENFORCEMENT AGENCIES OPEN FOR BUSINESS?

• IS THERE A COVID-19 DEFENSE?

• Q&A

OVERVIEW

3

COMPLIANCE MONITORING, OVERSIGHT, ADVISORY, AND APPROVAL

4

RISK ASSESSMENT

5

• What has changed?o Pressure on corporation to surviveo Changes in sales channels and customerso Greater interaction with government programso Disruption in supply chaino Changes in procurement procedureso Changes in working conditions

• How has the company responded?o Cutting costs – compliance and audit?o Expedited procedures?o New vendorso New customerso New marketso New products

THE EASY (?) STUFF

6

Tone at the Top

Helplines• Remote access

Hotlines• Remote access• Specialized lines for specific frauds

Training• Greater risk – more training!• Be relevant – be immediate• Online training modules• Webinars, Zoom calls, etc.

ADVICE AND APPROVAL

7

• Risk: out of sight, out of mindo Not really an excuse!o Access by phone, computer, etc.o Remote access to systems

• Crisis may require expediting approval but not shortcutso Due diligence and verification of qualifications still essentialo Identify new risk areas and ensure compliance is involved

Procedures may be enhanced or modified to reflect risk and practicalityo Common sense evaluation – a red flag is still a red flag

• Beware of cutting compliance resources

AUDITING AND MONITORING

8

Internal Audit• Remote access to SAP or other ERP systems• Ability to run red flag or anomaly searches• Gaps in ability to obtain information may result in additional follow-up

points

Compliance Audit – to defer or not to defer• Focus on existing and new risk areas• Use remote access to systems and interviews to evaluate:

• Business mix and how it has changed• New vendors, consultants, etc. and due diligence procedures• Interaction with government programs and officials• Political donations• Charitable contributions/CSR• Roll-out, implementation, and training on compliance policies• Changes in regulatory landscape

WHISTLEBLOWERS

9

RECEIVING WHISTLEBLOWER REPORTS

10

• Disruption and stress may cause:

o Existing misconduct to surface

o New misconduct

• Phones, emails, and bulletin boards still work

o Access

o Respond

• Assign responsibility as usual

• Priority/Triage

WHAT IS DIFFERENT?

11

Difficulty in reaching

whistleblower

Ability to access

systemsEnsuring

confidentiality

Ability to conduct

investigationsTriage and

prioritization

REMOTE INVESTIGATIONS

12

BASICS REMAIN THE SAME

13

Initial assessment

Assignresponsibility

Preserve evidence

Analyze data and

documents

Interviews Reporting

14

DATA COLLECTION

• Follow normal protocols as much as possible

• Issue document holds – in most cases

• Identify IT resources in advance

o Consider retainer agreement with IT forensics firm

• Most accounting, email, sales, and project data can be collected remotely

• Challenges

o Hard copy

o Personal devices

• Review platforms and data security

INTERVIEWS

15

Obvious difficulties

• No face-to-face• Sharing documents• Ensuring confidentiality• Translation

Solutions

• Accept imperfection!• Video if possible but not everyone has video

capability at home• Set ground rules• Be aware of technological pitfalls• Multiple short interviews vs. traditional long

interviewReserve possibility of second interview in person in the future

Be wary of witnesses using COVID-19 crisis as a pretext to avoid interviews

GOVERNMENT ENFORCEMENT AGENCIES

16

THE GOVERNMENT IS NOT CLOSED

17

• After initial upheaval, government back at work

• Some government offices still adjusting

• Some agencies less tech-savvy or equipped

• Some agencies more security focused than others

• COVID-19 Task Forces

• Increasing view that impact of COVID-19 (and hence ability to cooperate ) varies by region

INTERACTING WITH THE GOVERNMENT

18

Voluntary disclosures

Ongoing investigations

Government interviews

Statute of Limitations

tolling agreements

COVID-19

19

20

THE LAW HAS NOT CHANGED

20

COVID-19 programs may involve expedited procurement and less upfront controls but . . .• Anti-corruption and anti-fraud laws still apply• Labor protections may be even stronger• Economic pressure may lead to accounting

fraud, securities, fraud, procurement fraud, bank fraud

Enforcement risk:

• Less risk (perhaps) of immediate enforcement but

• Great risk of post-crisis audits and enforcement

Greater reputational risk for profiteers and opportunists

• No!• OFAC has

indicated it will be a factor in its response to apparent violations

• Brazil GRU has indicated it will consider COVID-19 issues with respect payment schedule but not amount of fines

. . . if a business facing technical andresource challenges caused by theCOVID-19 pandemic chooses, as part ofits risk-based approach to sanctionscompliance, to account for suchchallenges by temporarily reallocatingsanctions compliance resourcesconsistent with that approach, OFAC willevaluate this as a factor in determiningthe appropriate administrative responseto an apparent violation that occursduring this period.

21

IS THERE A COVID-19 DEFENSE?

Q&A

22

23

• PLEASE LISTEN FOR THE PRESENTER TO READ THE ATTENDANCECODE

• INCLUDE THIS CODE ON YOUR INDIVIDUAL LAWYER AFFIRMATION FORM AND RETURN THAT FORM TO CELINA.IRBY@SHEARMAN.COM

• PLEASE SUBMIT ALL QUESTIONS VIA THE Q&A BOX

CLE Information

Q&A