The importance of C&E program assessments was underscored earlier this month when a working group of the Organization of Economic Cooperation and Development (“OECD”) representing the thirty OECD member nations and eight other countries issued its much-awaited Good Practice Guidance for anti-bribery compliance programs, a set of C&E standards which seems likely to become the global equivalent of the Corporate Sentencing Guidelines.

Among other things, the Guidance provides that companies should undertake “periodic reviews of the ethics and compliance programmes or measures, designed to evaluate and improve their effectiveness in preventing and detecting foreign bribery, taking into account relevant developments in the field, and evolving international and industry standards.”

Of course, the notion of assessing anti-bribery programs is not entirely new. Indeed, in the Siemens prosecution the government faulted the company for (among other things) not having reviewed its FCPA program.

Additionally, the general logic of C&E program assessments has long had a special force in the anti-bribery realm. That is because the breadth, depth and complexity of anti-bribery compliance programs make them particularly prone to operational failure. An informed and independent program assessment can help identify possible weaknesses and prevent such failures. Indeed, earlier this year, KPMG’s Audit Committee Institute listed anti-bribery compliance program reviews among its ten recommended “to do’s” for audit committee members.

What, then, should an anti-bribery compliance review entail?

Read the rest of this entry »

In January, to the surprise of many, the Sentencing Commission issued draft proposed revisions to the Sentencing Guidelines provisions on C&E programs. Some of the proposals have been the source of confusion within the C&E community, such as a section that would require managers to “be aware of the organization’s document retention policies and conform any such policy to meet the goals of an effective [C&E] program…” This is perplexing because there is no similar awareness requirement for areas of greater risk for most companies – such as fraud, corruption and antitrust; one can only hope that before the final proposals are sent to Congress in May that this provision – which could skew risk mitigation in many companies – will be dropped.

Read the rest of this entry »

On January 1, 2010, two important state data security and privacy laws took effect in Nevada and New Hampshire. The laws create new obligations for most companies that do business in Nevada and for health care providers and business associates in New Hampshire.

Nevada’s law requires “data collectors,” including government agencies and businesses, that accept payment cards and are “doing business” in Nevada to comply with the Payment Card Industry Data Security Standard (“PCI DSS”). Nevada now becomes the only state to require compliance with PCI DSS in its entirety.

Read the rest of this entry »