As usual, Mike Volkov has solid points in a piece he posted this past Monday over at the Corruption, Crime & Compliance blog. In it, he proffers five suggestions that smaller organizations should follow in order to make certain that they are doing all that they can in attaining compliance and ethics programs that are worth their salt. One of them has some obvious implications on the internal inquiry front that nonetheless can’t be overlooked.
The “Medium and Small Company Compliance” posting surely recognizes that the trickle-down effect is necessarily a matter of slow drips. This is particularly so in the compliance and ethics world where compelling the largest companies to establish top-notch compliance and ethics programs in order to drag their supply and distribution chains along for the ride - sort of the proverbial rising tide that raises all boats - may be theoretically sound, but the results to date have been neither instantaneous nor perfect.
Most organizations in the Fortune 50 have “Cadillac” compliance programs that are well-designed, well-run, and models for the industry. But even many of them are deficient in certain areas. For instance, Volkov relates that roughly 40% of all Fortune 500 companies do not have specific FCPA programs in place. If that be the case at the top of the heap, then surely there are gaps in the programs of smaller organizations that face cost, staffing, and other hurdles that are not impediments to their big brothers.
The Volkov article does contain a critical recommendation to smaller companies that addresses this issue: design something consistent with available resources. If it is true that “[n]either the DOJ nor the SEC can hold medium and small companies to a standard of compliance achieved by Fortune 50 (not 500) companies which have access to abundant resources,” then smaller organizations doing the best they can within legitimate budgetary parameters will mean something in subsequent enforcement actions.
So what about investigations and where they fit in for these organizations?
Surely the DOJ and SEC are not going to let companies ignore wrongdoing. Further, cooperation credits have to be earned and the government is not going to hand them out to organizations that fail to probe their own failures and remediate the problems discovered. So, internal investigations have to be part of the compliance and ethics effort, regardless of a company's size. Earnestly, effectively, and appropriately conducting them is key.
As part of their compliance and ethics programs, medium to small companies should have a mechanism in place for triaging their internal investigations needs. Some inquiries will be able to be handled by non-lawyer security personnel, others by the Chief Compliance Officer and his or her staff, and still others - climbing the ladder of seriousness - by perhaps the General Counsel and the Law Department. At the top of the heap, of course, will be those critical investigations that require the engagement of outside investigations counsel.
If Volkov has hit the nail on the head, the government will give companies credit for investigations responses equal to the challenges presented. If, that is, they are consistent with available financial and other resources.
