He’s watching for a sign*: Working effectively with a Corporate Compliance Monitor

Nigel Coles 2016In the UK, a deferred prosecution agreement (DPA) is an agreement between a prosecutor and a company–but not an individual–which the prosecutor is considering prosecuting for any one, or more, of a number of offences of financial crime as defined in the Crime and Courts Act by Parliament in 2013. Whilst designated offences include theft, conspiracy to defraud, customs and excise offences, forgery, fraud, and contraventions of the Financial Services and Markets Act, those most likely to feature in DPAs are offences of bribery and corruption, or of money laundering.

In June 2013, the Directors of the Serious Fraud Office and of Public Prosecutions jointly issued a draft Code for consultation that explicitly referred to the use of a compliance monitor as one of the possible terms of a DPA. Perhaps surprisingly, no objections to the use of a monitor were received during the consultation period, and detailed suggested practices on the use of monitors duly appeared in the final version of the Code of Practice, issued in February 2014.

The corporate compliance monitor

A DPA is an agreement between two parties, each of whom has very different objectives. For the prosecutor, with limited resources, the use of a monitor extends reach and capability, as it provides the ability to dedicate a team of professionals to a single issue for an extended period. For the offending corporation, the active engagement of a monitor provides reassurance that remediation measures, albeit with some readjustment along the way, will satisfy the terms of the DPA and avoid more serious sanctions.

Actively negotiating the requirement for, and the terms under which a monitor is to operate, should be the first step for a company considering a DPA.

Negotiating the monitor requirement in a DPA

Not every instance of corporate misconduct leading to a DPA will necessitate the appointment of a monitor. A single instance of criminal conduct, however egregious, or conduct in a rogue unit or subsidiary may not in itself warrant the continuous attention of a monitor.

Where the conduct forms a pattern, and there has been systemic failure over an extended period, an independent monitor is more likely than the company to be able to persuade the prosecutor and the ratifying court of the company’s genuine contrition and desire to fix its failures. Similarly, if an inappropriate “tone from the top” has been a significant factor in allowing the offending company to engage in criminal conduct–perhaps through a “results at all costs” company ethos–then the programme necessary to address the consequent negative behaviours may benefit from the discipline afforded by monitor oversight.

The requirement for the formal appointment of a monitor may, however, be avoided if the company acts decisively during the period between the discovery of criminal conduct and the final negotiation of the detailed provisions of the DPA. For instance, if the company self-disclosed the conduct in question, initiated a thorough independent external review of its compliance processes–perhaps by an individual who has undertaken the role of monitor in the past–assists investigators in identifying errant employees and makes significant changes, e.g., to its training programme, then a monitor might not be deemed necessary.

Multiple monitors

An offending company could breach, say, both the US Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act and be potentially faced with more than one prosecution on similar facts. In such a case, a DPA might be negotiated with each of the prosecuting agencies.

Alternatively, where a DPA is being contemplated by a prosecutor, the primary regulator–such as the Financial Conduct Authority–might also decide to impose parallel supervisory arrangements under its Section 166 (Financial Services and Markets Act) powers. Although the prosecutors will often be cooperating with one another, separate negotiations are typically necessary. The temptation to consider appointing different individuals for each role would therefore likely be a mistake for a number of reasons.

The engagement of a monitor and team is expensive, and will require considerable time and effort on the part of the company. He will be collecting information, preparing reports and making recommendations, and will spend considerable time communicating with the lawyers representing the company. Not only would a second monitor effectively double the time, effort and financial commitments required of the company, the company could also be presented with conflicting recommendations. A company faced with the potential for the appointment of multiple monitors or “skilled persons” should, therefore, endeavour to negotiate an agreement between the prosecutors for a joint monitor. In such negotiations, the advice of an experienced monitor will pay dividends.

Selecting the right monitor

If a monitor is required, it will be vitally important for the company to secure the services of a monitor with which it will be comfortable working. This will be a long-term engagement of at least three years, and possibly more than five. Critical to the selection will be a genuine appreciation of the monitor’s fundamental role.

A monitor is not a compliance consultant or a corporate advisor. Although paid for by the offending company, the monitor is an independent third party. Monitors have been described as “corporate probation officers”, an analogy that neatly encapsulates the relationship between the monitor and the offending corporate. The monitor will be duty-bound to point out uncomfortable facts and will have to report in detail on the progress of the engagement to the prosecutor at various stages. The relationship should be business-like and supportive, but it is never going to be entirely comfortable.

For these reasons, the initial selection of the right monitor is of the utmost importance. In the US, it has often been the practice for the offending company to provide a shortlist of three candidate monitors to the prosecutor, indicating their preferred choice, a practice that has been adopted in its entirety in the UK.

Separately engaging an experienced monitor (who is not vying for the job) to assist in the process of identifying the shortlist of monitors may be an astute move. The advising monitor will have experienced the best and the worst aspects of a monitored compliance programme, and will be able to advise accordingly. Monitors and their teams should not only be experts in corporate compliance, but must also have an understanding of government and regulators’ expectations of what constitutes an effective programme, and how the engagement of a monitor will facilitate its implementation. Because any monitorship will at times involve the consideration of complex legal issues, many monitors also have a legal background and, in the US, many have been prosecutors in white-collar crime cases.

The nationality of a monitor can be important and sometimes is effectively prescribed by law, especially where the activity to be monitored is conducted in multiple jurisdictions. For example, in the 2010 DPA between the US Department of Justice and the French company Technip SA, it was specified that the monitor should be a French citizen, because domestic French law prohibits any foreign investigation on French soil. Conversely, many non-US companies party to a DPA with US authorities have chosen US citizens to be monitors because of their experience with the US prosecuting and regulatory agencies. As the use of corporate compliance monitors becomes a common feature of UK DPAs, companies may find that experienced monitors (or their teams) with an established UK footprint can provide a useful level of insight.

A corporate compliance monitor must be able to demonstrate manifest independence and objectivity. Often this will mean that the proposed monitor has had no previous (or at least recent) relationship with the offending corporation, or a position in the government of the jurisdiction into which the DPA was entered or where the corporation has major operational centres. Inevitably, this may mean that large professional services firms that have engaged with the offending corporate in the past will struggle to demonstrate a sufficient level of third party independence. UK prosecutors are entitled to reject a company’s preferred monitor if they consider there to be a conflict of interest.

Another critical factor will be the level of specialist resources accessible by monitor candidates. Although it is not essential that the monitor should personally have detailed knowledge of the specific business sector, she will need to be able to access that knowledge within the monitor team. Many monitor teams are therefore multidisciplinary groups comprising lawyers who may have subject matter expertise in the particular field, former compliance officers, ex-prosecutors and those with investigative or audit experience. Successful monitor teams are also able to attract the services of senior individuals with technical or operational experience of the relevant business sector.

Working with the monitor

The offending company must immediately grasp the fundamental function of a monitor. Following early experience in the US, there has been increasing clarification of the role of a monitor there. For example, according to a Memorandum from Craig Morford, Acting Deputy Attorney General to Heads of Department and US Attorneys (March, 2008) (commonly called the Morford Memorandum),

A monitor’s primary responsibility should be to assess and monitor a corporation’s compliance with those terms of an agreement that are specifically designed to address and reduce the risk of recurrence of the corporation’s misconduct, including, in most cases, evaluating (and where appropriate proposing) internal controls and corporate ethics and compliance programs.

Because the monitor is duty bound to assess and oversee compliance with the terms of the DPA, the company should understand from the outset that the monitor will be constantly watching, testing and assessing how closely the company is complying with the agreement’s key elements. This is not a retrospective assessment at the end of the DPA period, but real-time, live oversight through the collection of information and the preparation of reports.

Typically a monitor will issue a “work plan” that sets out the key areas of the company that he will be inquiring into, a timeline along which the work plan will be conducted and the dates by which key reports will be submitted. The Code actually requires the work plan to be agreed in advance of the DPA being finalised, in considerable detail for the first year but less so for subsequent years. The work plan will be set out at a fairly high level, but the company should use this as a clear indication of what the monitor is interested in and therefore prepare its managers and staff as best it can.

The information collection process will usually start with the provision by the company of compliance policies and procedures, management information report, and internal audit findings, and is often augmented by presentations from key company personnel.

The monitor will not ordinarily seek to reinvestigate the findings that led to the DPA itself, but will need to understand the full extent of the company’s misdeeds, whether those conditions persist, and how they are being ameliorated. The monitor will inevitably be extremely demanding in her request for documents, and these demands may initially be relatively unfocussed until the monitor has reached a fuller understanding. This is hugely resource-intensive for the company and it is worth providing a well-staffed monitor liaison team from the outset rather than continually reinforcing an under-strength unit.

The Code asserts that a company subject to a DPA “shall afford to the monitor complete access to all relevant aspects of its business during the monitoring period as requested by the monitor”.  Nevertheless, there will inevitably be difficult negotiations between a company and its monitor with regard to access to confidential information, and the amount of time and effort required by each party to debate this should not be underestimated. It is beyond the scope of this article to detail every aspect of what is always a complex and detailed area, but discussions usually include issues of attorney-client privilege, data protection, client confidentiality and the information security arrangements in the monitor’s team.

US DPAs tend to specifically state that there is no attorney-client privilege attached to communications between the monitor and the company, because otherwise the monitor’s independence might be compromised. The absence of this privilege can, however, give rise to heightened legal risk for the company, as such material can be discovered in third party litigation. Any company subject to a monitorship provision in a DPA must contemplate the requirement for significant in-house or seconded specialist legal counsel,  the cost of which is likely to be considerable.

In relation to costs more generally, the Code makes it clear that the subject company is responsible for paying “all the costs of the selection, appointment, (and) remuneration of the monitor” in addition to “the reasonable costs of the prosecutor”. These costs are likely to be substantial, as they will include not only those of the monitor but all the members of the monitor team: professional members, administrative staff and legal counsel.

In addition, there will be  the expense of the company’s own staff seconded to the in-house monitor liaison team, any external legal expenses, and the opportunity costs associated with senior and mid-level personnel preparing for and engaging directly with the monitor.

Developing an effective relationship with the monitor

Like all relationships, the strongest are built on mutual trust, respect and cooperation, but there is always the potential for tension in the relationship between the monitor and the company, and there will be periods when this is more strained that usual. Both parties will need to put considerable effort into developing a strong relationship that is effective from each of their perspectives. For the monitor, this means a company that is responsive to requests for information, freely provides access to senior executives and other staff, and allows him to visit company premises without impediment.

The company will gain confidence in the monitor if she is transparent and communicative and keeps directors abreast of thoughts and assessments. Sharing drafts of the monitor’s formal reports before they are submitted to the overseeing prosecutor is not always possible and may even be constrained by the terms of the DPA itself. Nevertheless, in a healthy and cooperative monitorship, as long as the monitor remains cognizant of his duty of absolute independence, he will usually be keen to ensure that the Chief Executive Officer, General Counsel and certain senior executives, such as the Chief Risk Officer, are briefed in advance on the main themes of the findings.

This is why it is so important for a company entering into a DPA to understand what it is signing up to at the outset. To be satisfied that she is obtaining a genuinely accurate picture of the company, the monitor will initially adopt what may appear to be a highly intrusive approach. Every monitor will wish to leave the company in better shape than it was in at the start of the relationship, but the monitor cannot shrink from reporting what he identifies as failures to satisfy the terms of the DPA. A company should therefore recognise that this isn’t personal, it’s business.

The company cannot afford for the relationship to become anything less than respectful and functional but it does happen.

It is certainly unusual for a dispute between a monitor and a company to reach court in the US. More commonly, the prosecutor will be the final arbiter in any dispute and, in the absence of manifest error, will likely support the monitor. Although the Code is silent on this issue, there is no reason to think that the position will be at all different in the UK.

Reports and recommendations

A monitor will be required to make periodic reports to the prosecuting agency and, through them, to the supervising court. These reports are typically an initial assessment report in the first year of the monitorship and annual reports thereafter, perhaps following particular themes or specific jurisdictions, but various ad hoc reporting may also be requested in the intervening periods. The style and nature of these reports will vary with the nature of the monitorship, but will often include a number of recommendations by the monitor.

The nature of any recommendations will vary with the specific DPA and with the professional style of the monitor himself. Where the monitor and the company have an effective relationship, any disagreements over recommendations are likely to be confined to the timescales for implementation rather any substantive difference of view. But if a corporation does not adopt the recommendations of the monitor within the specified time, the monitor will be expected to report that fact together with any explanations the company has provided. In practice, these recommendations come to be seen by the internal compliance personnel as supporting them in their own efforts to persuade sceptical executives of the merits of an effective control environment in the company.

Prompt implementation of the monitor’s recommendations, not just a written acceptance of them, during the course of the monitorship will help to persuade the monitor that the factors which led to the DPA are being satisfactorily addressed by the company. Significant progress may even lead to the monitor’s advising the prosecutor that his appointment may appropriately be terminated early.

Conversely, any hesitation in accepting the recommendations, or delay in actively implementing them, will make the monitor consider carefully whether there is a requirement for her appointment to be extended, with all the consequent additional costs.

Concluding the monitorship

The monitorship comes to an end with a determination by the monitor and the prosecutor that the company has satisfactorily completed the terms of the agreement. Hopefully, the presence of the monitor will have come to be seen by the company as an opportunity for it to re-set what is considered to be normal behaviour.

Where a company had inadequately resourced its audit or compliance functions, had been reluctant to implement an effective committee structure or had tolerated a mismatch between income generation and risk control, then a monitor can actually represent a tipping point. Over time, a monitor can push a company into a more responsible long-term state.

It will likely not have been easy. It certainly will have been an expensive exercise. But if a company truly understands what it is getting in to at the outset, works with a monitor rather than against her, and sees the engagement as an opportunity, it can be a genuinely positive experience.

A version of this article first appeared in Money Laundering Bulletin.

*‘He’s watching for a sign’ is taken from ‘The Sentinel’: Judas Priest, 1984

Nigel Coles 2016

About Nigel Coles

Nigel Coles is a Managing Director with Exiger Ltd, a global regulatory and financial crime, risk and compliance firm that advises on and conducts corporate compliance monitorships.

Contact Details
Email: ncoles@exiger.com
Tel: +44 (0) 207 489 5501

This entry was posted in 2016 Newsletter, 2016-07, Newsletter and tagged , , . Bookmark the permalink.